49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
id: http-block-path-traversal
|
|
name: Block path traversal
|
|
protocol: http
|
|
description: Stops common path traversal probes in path and query.
|
|
category: http
|
|
family: web-hardening
|
|
tags:
|
|
- path-traversal
|
|
- web
|
|
- block
|
|
action: block
|
|
summary: Stops common path traversal probes in path and query.
|
|
behavior: Logs the matched traversal token and immediately drops the client connection
|
|
before the request reaches the upstream service.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
from urllib.parse import unquote
|
|
|
|
from mitmproxy import http
|
|
|
|
TRAVERSAL_MARKERS = (
|
|
"../",
|
|
"..\\",
|
|
"%2e%2e",
|
|
"%252e%252e",
|
|
"..%2f",
|
|
"..%5c",
|
|
)
|
|
|
|
|
|
def request(flow: http.HTTPFlow) -> None:
|
|
raw_target = (
|
|
f"{flow.request.path}?{flow.request.query}"
|
|
if flow.request.query
|
|
else flow.request.path
|
|
)
|
|
normalized = unquote(unquote(raw_target)).lower()
|
|
for marker in TRAVERSAL_MARKERS:
|
|
if marker in normalized:
|
|
logging.warning(
|
|
"[http-block-path-traversal] blocked %s %s from %s",
|
|
flow.request.method,
|
|
flow.request.pretty_url,
|
|
flow.client_conn.peername,
|
|
)
|
|
flow.kill()
|
|
return
|