43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
id: tcp-block-non-printable-threshold
|
|
name: Block binary-noise threshold
|
|
protocol: tcp
|
|
description: Blocks client messages with an excessive amount of non-printable bytes.
|
|
category: tcp
|
|
family: tcp-hardening
|
|
tags:
|
|
- non-printable
|
|
- binary-noise
|
|
- tcp
|
|
- block
|
|
action: block
|
|
summary: Blocks client messages with an excessive amount of non-printable bytes.
|
|
behavior: Treats unusually binary-heavy client payloads as suspicious, logs the ratio,
|
|
and closes the flow when the threshold is exceeded.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import tcp
|
|
|
|
NON_PRINTABLE_RATIO = 0.35
|
|
|
|
|
|
def tcp_message(flow: tcp.TCPFlow) -> None:
|
|
message = flow.messages[-1]
|
|
if not message.from_client or not message.content:
|
|
return
|
|
non_printable = sum(
|
|
1
|
|
for byte in message.content
|
|
if byte < 0x20 and byte not in {0x09, 0x0a, 0x0d}
|
|
)
|
|
ratio = non_printable / len(message.content)
|
|
if ratio > NON_PRINTABLE_RATIO:
|
|
logging.warning(
|
|
"[tcp-block-non-printable-threshold] blocked ratio=%.2f size=%d",
|
|
ratio,
|
|
len(message.content),
|
|
)
|
|
message.drop()
|
|
flow.kill()
|