49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
id: http-block-sqli-markers
|
|
name: Block obvious SQLi markers
|
|
protocol: http
|
|
description: Stops common SQL injection probes before they reach the app.
|
|
category: http
|
|
family: web-hardening
|
|
tags:
|
|
- sqli
|
|
- web
|
|
- block
|
|
action: block
|
|
summary: Stops common SQL injection probes before they reach the app.
|
|
behavior: Matches a short list of high-signal SQLi markers in path, query, and body,
|
|
then serves a blank HTML page and logs the hit.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import http
|
|
|
|
BLOCKED_MARKERS = (
|
|
"' or 1=1",
|
|
'" or 1=1',
|
|
"union select",
|
|
"sleep(",
|
|
"information_schema",
|
|
"--",
|
|
)
|
|
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
body = flow.request.get_text(strict=False)
|
|
haystack = "\n".join(
|
|
[flow.request.path, str(flow.request.query), body]
|
|
).lower()
|
|
for marker in BLOCKED_MARKERS:
|
|
if marker in haystack:
|
|
logging.warning(
|
|
"[http-block-sqli-markers] blocked marker=%r url=%s",
|
|
marker,
|
|
flow.request.pretty_url,
|
|
)
|
|
flow.response = http.Response.make(
|
|
200,
|
|
b"",
|
|
{"content-type": "text/html; charset=utf-8"},
|
|
)
|
|
return
|