security-gem 0.1.3 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e19b4ce5337fef141ece0c5db7d4b76031f6171065a9fee2ff1444692b3c2de
-  data.tar.gz: 85b6afc1258a32aa7ce7c61a8b465384630bb0838122b6d2d19e2cd2a270c5ae
+  metadata.gz: 91195d81663461672214a7b6dd7e6b255f1a9560447d97931dcbafdb5b3d7703
+  data.tar.gz: 3c56de327c041550882758d7874b9ded3ed693c897cde0740629cd93baca1291
 SHA512:
-  metadata.gz: b3f5b0d39f1b9f2a88f8a573881dad6e2cc265706e2fad78501c2d338f3cd431c9886f5ac60c8fd70af55aca6fc28aff5ac5c458d86512f2b3c6ba053ca003c8
-  data.tar.gz: 1a8a91cc11c917bf651c8675f90a16db7c5833ce9830eb8424647ea67095ce6f7089dd631cf7c6e0239be8f470a42dd8ce7072ebb31becb7e6cb47bf173558f1
+  metadata.gz: dae9cc4b1068fc4379719a45ff3c499a4fd89c8013ed9855947bf416b6ad87f12f983b040377373d8848bd25678a8455ebfb522180f1f9147ae77a5b9dcd160a
+  data.tar.gz: 7a625a3b0f0513eb6c2a226c52625326c2d8596ac90737be8101b83fad6120f36b9457ed2a0c4ed2df915c07323670b2a3f9828037bbf2c40cb4931516fac017

data/Gemfile

@@ -8,3 +8,5 @@ gemspec
 gem "rake", "~> 13.0"
 
 gem "rubocop", "~> 0.80"
+
+gem 'colored', '~> 1.2'

data/Gemfile.lock

@@ -1,12 +1,13 @@
 PATH
   remote: .
   specs:
-    security-gem (0.1.3)
+    security-gem (0.1.6)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.2)
+    colored (1.2)
     parallel (1.22.1)
     parser (3.1.2.0)
       ast (~> 2.4.1)
@@ -32,6 +33,7 @@ PLATFORMS
   x86_64-darwin-20
 
 DEPENDENCIES
+  colored (~> 1.2)
   rake (~> 13.0)
   rubocop (~> 0.80)
   security-gem!

data/lib/security/gem/security.rb

@@ -0,0 +1,206 @@
+=begin   
+
+    SecurityLogger 
+    ______________
+
+    Description:
+    This module provides a simple and unified format to log security events
+
+    Classes: 
+    Sql_Injection, Xss_Injection, User_Agent
+
+    Owner:
+    Tucker Weibell - 05/09/2022
+
+=end
+
+require 'json'
+require 'logger'
+require 'logger/formatter'
+require 'net/http'
+require 'dotenv'
+require 'colored'
+Dotenv.load
+
+module SecurityLogger
+
+=begin
+
+    Sql_Injection Class
+    ___________________
+    
+    Description:
+    - Checks inputs against most commonly used sql injection commands.
+    - Inputs that match or contain probably sql commands will be logged.
+    - Payloads can be replaced by simply changing the ENV varibles
+      and pointing the URI to any custom text file
+
+    Usage: SecurityLogger::Sql_Injection.new(ip_origin: request.ip).check_input(input)
+
+=end 
+
+    class Sql_Injection
+        def initialize (ip_origin:)
+            @ip_origin = ip_origin
+        end
+
+        def log(input)
+            logger = Logger.new(STDOUT)
+            logger.formatter = proc do |severity, datetime, progname, msg|
+                {
+                  severity: severity,
+                  timestamp: datetime.to_s,
+                  app: progname,
+                  message: msg
+                }.to_json + $/  
+            end
+
+            message = {:threat => "sql_injection_attack", :input => input, :ip_origin => @ip_origin}
+            puts
+            logger.warn(JSON.parse(message.to_json))
+            puts
+            return
+        end
+
+        def check_input(input)
+          uri = ENV['PATH_TO_SQL_PAYLOAD']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if file.strip == input.strip
+                    self.log(input.strip)
+                    return
+                end
+            end
+
+          uri = ENV['PATH_TO_SQL_COMMON_COMMANDS']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if  input.strip.downcase.include?(file.strip.downcase)
+                    self.log(input.strip)
+                    return
+                end
+            end  
+
+        end
+    end
+
+
+=begin  
+
+    Xss_Injection Class
+    ___________________
+    
+    Description:
+    - Checks inputs against most commonly used xss scripts.
+    - Inputs that match or contain common keywords will be logged.
+    - Payloads can be replaced by simply changing the ENV varibles
+      and pointing the URI to any custom text file
+
+    Usage: SecurityLogger::Xss_Injection.new(ip_origin: request.ip).check_input(input)
+
+=end 
+
+    class Xss_Injection
+        def initialize (ip_origin:)
+            @ip_origin = ip_origin
+        end
+
+        def log(input)
+            logger = Logger.new(STDOUT)
+            logger.formatter = proc do |severity, datetime, progname, msg|
+                {
+                  severity: severity,
+                  timestamp: datetime.to_s,
+                  app: progname,
+                  message: msg
+                }.to_json + $/  
+            end
+
+            message = {:threat => "xss_attack", :input => input, :ip_origin => @ip_origin}
+            puts
+            logger.warn(JSON.parse(message.to_json))
+            puts
+        end
+
+        def check_input(input)
+          uri = ENV['PATH_TO_XSS_PAYLOAD']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if file.strip == input.strip
+                    self.log(input.strip)
+                    return
+                end
+            end
+
+          uri = ENV['PATH_TO_XSS_COMMON_SCRIPTS']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+            file.each_line do |file|
+                if  input.strip.downcase.include?(file.strip.downcase)
+                    self.log(input.strip)
+                    return
+                end
+            end 
+
+        end
+    end
+
+
+=begin  
+
+    User_Agent Class
+    ___________________
+    
+    Description:
+    - Checks inputs against most common user_agents (approx. top 1000).
+    - Inputs that DO NOT match any of the most common user agents will be logged.
+    - Payloads can be replaced by simply changing the ENV varibles
+      and pointing the URI to any custom text file
+
+    Usage: SecurityLogger::User_Agent.new(ip_origin: request.ip).check_input(input)
+
+=end 
+
+    class User_Agent
+        def initialize (ip_origin:)
+            @ip_origin = ip_origin
+        end
+
+        def log(input)
+            logger = Logger.new(STDOUT)
+            logger.formatter = proc do |severity, datetime, progname, msg|
+                {
+                  severity: severity,
+                  timestamp: datetime.to_s,
+                  app: progname,
+                  message: msg
+                }.to_json + $/  
+            end
+
+            message = {:threat => "uncommon_user_agent", :input => input, :ip_origin => @ip_origin}
+            puts
+            logger.warn(JSON.parse(message.to_json))
+            puts
+        end
+
+        def check_input(input)
+          uri = ENV['PATH_TO_USER_AGENT_PAYLOAD']
+          uri = URI(uri)
+          file = Net::HTTP.get(uri)
+          @matches = 0
+            file.each_line do |file|
+                if file.strip == input.strip
+                @matches += 1
+                end
+            end
+
+            if @matches == 0
+                self.log(input.strip)
+                return
+            end
+        end
+    end
+end

data/lib/security/gem/version.rb

@@ -2,6 +2,6 @@
 
 module Security
   module Gem
-    VERSION = "0.1.3"
+    VERSION = "0.1.6"
   end
 end

data/lib/security/gem.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "gem/version"
-require_relative "gem/builder"
+require_relative "gem/security"
 
 module Security
   module Gem

data/lib/security/test.rb

@@ -1,7 +1,17 @@
-require_relative "gem/builder"
+require_relative "gem/security"
 
 # Sample SQL input
-input = "or 1=1"
+input = "ALTER TABLE"
 
 # Using the gem to log injection attempts
-SecurityLogger::Sql_Injection.new(ip_origin: "123.123.123.1").check_input(input)
+SecurityLogger::Sql_Injection.new(ip_origin: "123.123.123.1").check_input(input)
+
+input = "<svg"
+
+# Using gem to log xss attempts
+SecurityLogger::Xss_Injection.new(ip_origin: "123.123.123.1").check_input(input)
+
+input = "evilhacker"
+
+# Using gem to log xss attempts
+SecurityLogger::User_Agent.new(ip_origin: "123.123.123.1").check_input(input)

data/sql_common_commands.txt

@@ -0,0 +1,37 @@
+SELECT
+FROM
+SELECT FROM
+UNION
+UNION ALL
+UNION ALL SELECT
+COLLATE
+DELETE
+INSERT INTO
+CREATE DATABASE
+ALTER DATABASE
+CREATE TABLE
+ALTER TABLE
+DROP TABLE
+CREATE INDEX
+DROP INDEX
+DECLARE
+/*!32302 1/0, */
+/*!32302
+CONCAT
+1--
+admin' --
+admin' #
+admin'/*
+' or 1=1--
+' or 1=1#
+' or 1=1/*
+') or '1'='1--
+') or ('1'='1--
+' HAVING 1=1 --
+GROUP BY
+ORDER BY
+WAITFOR DELAY
+NULL--
+;
+IF EXISTS
+mysql.user

data/{payloads.txt → sql_payloads.txt}

@@ -1823,4 +1823,4 @@ t'exec master..xp_cmdshell 'nslookup www.google.com'--
 %21
 ' or ''='
 ' or 3=3
- or 3=3 --
+' or 3=3 --