41 lines
1.0 KiB
YAML
41 lines
1.0 KiB
YAML
id: http-block-admin-paths
|
|
name: Block admin and debug paths
|
|
protocol: http
|
|
description: Protects common admin, console, and debug endpoints.
|
|
category: http
|
|
family: web-hardening
|
|
tags:
|
|
- admin-path
|
|
- debug-path
|
|
- web
|
|
- block
|
|
action: block
|
|
summary: Protects common admin, console, and debug endpoints.
|
|
behavior: Matches the request path against a small denylist and returns a blank 404
|
|
page before the request is forwarded.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import http
|
|
|
|
BLOCKED_PREFIXES = (
|
|
"/admin",
|
|
"/debug",
|
|
"/console",
|
|
"/actuator",
|
|
)
|
|
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
if flow.request.path.startswith(BLOCKED_PREFIXES):
|
|
logging.warning(
|
|
"[http-block-admin-paths] blocked path=%s",
|
|
flow.request.path,
|
|
)
|
|
flow.response = http.Response.make(
|
|
404,
|
|
b"",
|
|
{"content-type": "text/html; charset=utf-8"},
|
|
)
|