38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
id: http-block-command-injection-markers
|
|
name: Block command injection markers
|
|
protocol: http
|
|
description: Rejects obvious shell metacharacters and command-substitution markers.
|
|
category: http
|
|
family: web-hardening
|
|
tags:
|
|
- command-injection
|
|
- web
|
|
- block
|
|
action: block
|
|
summary: Rejects obvious shell metacharacters and command-substitution markers.
|
|
behavior: Scans URL and body for shell-style injection markers, logs the first hit,
|
|
and drops the client connection.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import http
|
|
|
|
BLOCKED_MARKERS = (";", "&&", "||", "$(", "`", "|sh", "|bash")
|
|
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
body = flow.request.get_text(strict=False)
|
|
haystack = "\n".join(
|
|
[flow.request.pretty_url, body]
|
|
).lower()
|
|
for marker in BLOCKED_MARKERS:
|
|
if marker in haystack:
|
|
logging.warning(
|
|
"[http-block-command-injection-markers] blocked marker=%r url=%s",
|
|
marker,
|
|
flow.request.pretty_url,
|
|
)
|
|
flow.kill()
|
|
return
|