[FEATURE] Extensible Auto-calibration strategies #694
Conversation
There was a problem hiding this comment.
There's couple of linter issues that need fixing. In addition for information for others that may have eyes on this PR, we're discussing a larger strategy (pun inteded) for autocalibration OOB with @aristosMiliaressis
|
Initial implementation refactored to allow for extensible auto-calibration strategies -acs, --autocalibration-strategy (can be used with comma separated values or multiple times) sample strategies for reference basic.json (default strategy, autogenerate for backwards compatibility) {
"basic_admin":["adminNFCTzMVyppxaVOUi","adminYEEzbfyp"],
"basic_random":["CfrPyBYAvAYSqFgl","dPKhFxKq"],
"htaccess":[".htaccessbeoigKocENPTFAUF",".htaccessRpTeQwbV"]
}advanced.json (autogenerate for backwards compatibility) {
"admin_dir":["adminxJyMWnxrFSuymAXL/","adminKOwGZBBQ/"],
"basic_admin":["adminhmPschjKHKniEDIH","adminUHMMvPHv"],
"basic_random":["pcKqahbrJknwNYFH","dZQmyqXj"],
"htaccess":[".htaccessrWgUxyDzDQzMXVHC",".htaccessxZzqfJSG"],
"random_dir":["pNdPspnFahKlNMoe/","oFUPFxQF/"]
}waf.json (custom strategy not auto generated) {
"WAF_PATH_XSS":["sgdsfgsgf/<script>alert(1)</script>","asdfasdfdsaf/<script>alert(22)</script>"],
"WAF_PATH_LFI":["asdfaasg/../../etc/passwd","sadgfdsdfhgdf/../../etc/passwd"],
"WAF_PATH_LFI2":["sadgkj/.../.../etc/passwd","asdsdfgfdgd/.../.../etc/passwd"],
"WAF_DOUBLE_SLASH":["sadfghkj//etc//passwd","sadfihuyus//etc//passwd"],
"WAF_FUZZY_CHAR":["sdfgdsfg::~$()><'!","asfdasdfjlk::~$()><'!"],
"WAF_FUZZY_CHAR2":["pNdPspnFahKlNMoe%20/","oFUPFxQF%20/"],
"WAF_FUZZY_CHAR3":["pNdPspnFahKlNMoe%0a.html","oFUPFxQF%0a.html"],
"WAF_QUERY_XSS":["pNdPspnFahKlNMoe?x=<script>alert(1)</script>","oFUPFxQF?x=<script>alert(22)</script>"],
"WAF_FUZZY_QUERY":["pNdPspnFahKlNMoe?x=::~$()><'!","oFUPFxQF?x=~$()><'!:::"]
} |
|
Hi, sorry for taking some time to get back on this. There are two linter issues (unused struct members), but other than that it looks good to merge! |
Description
Added an autocalibration strategy
extrathat uses a list of commonly blacklisted files to detect & filter blacklisted responsesFixes: #689