security-gem 0.1.2 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a26fb66b43cfdd016ff96a3a4ed93ae3d081415b64b18e71d54af3f34d56846
-  data.tar.gz: 6bee7e2b0bcb7f26af85231acb44ebdce7aeab9341b2ab356de1b42dd699b346
+  metadata.gz: 2f2eecdfc5fb7ffdb08c8233fbc0c31528364e5e787241bc89351b3ceb54c844
+  data.tar.gz: e5d719157b9158bca6784763a1f8e0d6fcbcb08f11bc11246d6e14b979352753
 SHA512:
-  metadata.gz: 95874177dc445745fb5568d61cd2a3e82c4eab9c84b7d37a9493ce0536f2e9d3ccb6375887110045c2858c317175e98d247116d58648bd4674490f0362a2685c
-  data.tar.gz: d261adc97b689f58ad7014a3008dcee56dea8afd432cf1076962f8c256e3f0799221166cea1739985cfb4c42051d07e68031ebcbf55553abda6b623a8b166c6d
+  metadata.gz: 19bf4b7bf2291c2a4c5f704829f7f78b03e0726d977fdf3c72171f01c51993c3e5ee21b854407f6ff72ab089fac36822a3be9ed113603e934884c166dc039d63
+  data.tar.gz: c5914aa0c01e1978d1a2774ad2d13866e8d6bf3c3b3f20b3a40e3debb8c9588d0a748f48201754a34ca528350662eb5a8271109d2fbd917536e02ae7ae324233

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    security-gem (0.1.2)
+    security-gem (0.1.5)
 
 GEM
   remote: https://rubygems.org/

data/lib/security/gem/security.rb

@@ -0,0 +1,199 @@
+=begin   
+
+    SecurityLogger 
+    ______________
+
+    Description:
+    This module provides a simple and unified format to log security events
+
+    Classes: 
+    Sql_Injection, Xss_Injection, User_Agent
+
+    Owner:
+    Tucker Weibell - 05/09/2022
+
+=end
+
+require 'json'
+require 'logger'
+require 'logger/formatter'
+require 'net/http'
+require 'dotenv'
+Dotenv.load
+
+module SecurityLogger
+
+=begin
+
+    Sql_Injection Class
+    ___________________
+    
+    Description:
+    - Checks inputs against most commonly used sql injection commands.
+    - Inputs that match or contain probably sql commands will be logged.
+    - Payloads can be replaced by simply changing the ENV varibles
+      and pointing the URI to any custom text file
+
+    Usage: SecurityLogger::Sql_Injection.new(ip_origin: request.ip).check_input(input)
+
+=end 
+
+    class Sql_Injection
+        def initialize (ip_origin:)
+            @ip_origin = ip_origin
+        end
+
+        def log(input)
+            logger = Logger.new(STDOUT)
+            logger.formatter = proc do |severity, datetime, progname, msg|
+                {
+                  severity: severity,
+                  timestamp: datetime.to_s,
+                  app: progname,
+                  message: msg
+                }.to_json + $/  
+            end
+
+            message = {:threat => "sql_injection_attack", :input => input, :ip_origin => @ip_origin}
+            logger.warn(JSON.parse(message.to_json))
+            return
+        end
+
+        def check_input(input)
+          uri = ENV['PATH_TO_SQL_PAYLOAD']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if file.strip == input.strip
+                    self.log(input.strip)
+                    return
+                end
+            end
+
+          uri = ENV['PATH_TO_SQL_COMMON_COMMANDS']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if  input.strip.downcase.include?(file.strip.downcase)
+                    self.log(input.strip)
+                    return
+                end
+            end  
+
+        end
+    end
+
+
+=begin  
+
+    Xss_Injection Class
+    ___________________
+    
+    Description:
+    - Checks inputs against most commonly used xss scripts.
+    - Inputs that match or contain common keywords will be logged.
+    - Payloads can be replaced by simply changing the ENV varibles
+      and pointing the URI to any custom text file
+
+    Usage: SecurityLogger::Xss_Injection.new(ip_origin: request.ip).check_input(input)
+
+=end 
+
+    class Xss_Injection
+        def initialize (ip_origin:)
+            @ip_origin = ip_origin
+        end
+
+        def log(input)
+            logger = Logger.new(STDOUT)
+            logger.formatter = proc do |severity, datetime, progname, msg|
+                {
+                  severity: severity,
+                  timestamp: datetime.to_s,
+                  app: progname,
+                  message: msg
+                }.to_json + $/  
+            end
+
+            message = {:threat => "xss_attack", :input => input, :ip_origin => @ip_origin}
+            logger.warn(JSON.parse(message.to_json))
+        end
+
+        def check_input(input)
+          uri = ENV['PATH_TO_XSS_PAYLOAD']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if file.strip == input.strip
+                    self.log(input.strip)
+                    return
+                end
+            end
+
+          uri = ENV['PATH_TO_XSS_COMMON_SCRIPTS']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if  input.strip.downcase.include?(file.strip.downcase)
+                    self.log(input.strip)
+                    return
+                end
+            end 
+
+        end
+    end
+
+
+=begin  
+
+    User_Agent Class
+    ___________________
+    
+    Description:
+    - Checks inputs against most common user_agents (approx. top 1000).
+    - Inputs that DO NOT match any of the most common user agents will be logged.
+    - Payloads can be replaced by simply changing the ENV varibles
+      and pointing the URI to any custom text file
+
+    Usage: SecurityLogger::User_Agent.new(ip_origin: request.ip).check_input(input)
+
+=end 
+
+    class User_Agent
+        def initialize (ip_origin:)
+            @ip_origin = ip_origin
+        end
+
+        def log(input)
+            logger = Logger.new(STDOUT)
+            logger.formatter = proc do |severity, datetime, progname, msg|
+                {
+                  severity: severity,
+                  timestamp: datetime.to_s,
+                  app: progname,
+                  message: msg
+                }.to_json + $/  
+            end
+
+            message = {:threat => "uncommon_user_agent", :input => input, :ip_origin => @ip_origin}
+            logger.warn(JSON.parse(message.to_json))
+        end
+
+        def check_input(input)
+          uri = ENV['PATH_TO_USER_AGENT_PAYLOAD']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+          @matches = 0
+            file.each_line do |file|
+                if file.strip == input.strip
+                @matches += 1
+                end
+            end
+
+            if @matches == 0
+                self.log(input.strip)
+                return
+            end
+        end
+    end
+end

data/lib/security/gem/version.rb

@@ -2,6 +2,6 @@
 
 module Security
   module Gem
-    VERSION = "0.1.2"
+    VERSION = "0.1.5"
   end
 end

data/lib/security/gem.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "gem/version"
-require_relative "gem/builder"
+require_relative "gem/security"
 
 module Security
   module Gem

data/lib/security/test.rb

@@ -1,7 +1,17 @@
-require_relative "gem/builder"
+require_relative "gem/security"
 
 # Sample SQL input
-input = "or 1=1"
+input = "ALTER TABLE"
 
 # Using the gem to log injection attempts
-SecurityLogger::Sql_Injection.new().check_input(input)
+SecurityLogger::Sql_Injection.new(ip_origin: "123.123.123.1").check_input(input)
+
+input = "<svg"
+
+# Using gem to log xss attempts
+SecurityLogger::Xss_Injection.new(ip_origin: "123.123.123.1").check_input(input)
+
+input = "evilhacker"
+
+# Using gem to log xss attempts
+SecurityLogger::User_Agent.new(ip_origin: "123.123.123.1").check_input(input)

data/sql_common_commands.txt

@@ -0,0 +1,37 @@
+SELECT
+FROM
+SELECT FROM
+UNION
+UNION ALL
+UNION ALL SELECT
+COLLATE
+DELETE
+INSERT INTO
+CREATE DATABASE
+ALTER DATABASE
+CREATE TABLE
+ALTER TABLE
+DROP TABLE
+CREATE INDEX
+DROP INDEX
+DECLARE
+/*!32302 1/0, */
+/*!32302
+CONCAT
+1--
+admin' --
+admin' #
+admin'/*
+' or 1=1--
+' or 1=1#
+' or 1=1/*
+') or '1'='1--
+') or ('1'='1--
+' HAVING 1=1 --
+GROUP BY
+ORDER BY
+WAITFOR DELAY
+NULL--
+;
+IF EXISTS
+mysql.user

data/{payloads.txt → sql_payloads.txt}

@@ -1823,4 +1823,4 @@ t'exec master..xp_cmdshell 'nslookup www.google.com'--
 %21
 ' or ''='
 ' or 3=3
- or 3=3 --
+' or 3=3 --