Commit Graph

4 Commits

Author SHA1 Message Date
e58f479cd4 feat(waf): Update WAF scenarios with 2024-2025 CVEs and OWASP threats
Add detection patterns for latest actively exploited vulnerabilities:
- CVE-2025-55182 (React2Shell, CVSS 10.0)
- CVE-2025-8110 (Gogs RCE), CVE-2025-53770 (SharePoint)
- CVE-2025-52691 (SmarterMail), CVE-2025-40551 (SolarWinds)
- CVE-2024-47575 (FortiManager), CVE-2024-21887 (Ivanti)
- CVE-2024-3400, CVE-2024-0012, CVE-2024-9474 (PAN-OS)

New attack categories based on OWASP Top 10 2025:
- HTTP Request Smuggling (TE.CL/CL.TE conflicts)
- AI/LLM Prompt Injection (ChatML, instruction markers)
- WAF Bypass techniques (Unicode normalization, double encoding)
- Supply Chain attacks (CI/CD poisoning, dependency confusion)
- Extended SSTI (Jinja2, Freemarker, Velocity, Thymeleaf)
- API Abuse (BOLA/IDOR, mass assignment)

CrowdSec scenarios split into 11 separate files for reliability.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 05:02:57 +01:00
c99d49739e feat(secubox-app-mitmproxy): Add LXC container support for mitmproxy
- Create mitmproxyctl script with LXC container management
- Alpine Linux rootfs with Python and mitmproxy via pip
- Support for regular, transparent, upstream, and reverse proxy modes
- UCI configuration for proxy_port, web_port, memory_limit, etc.
- procd init script for service management
- Update luci-app-mitmproxy RPCD backend for LXC container status

Ports:
- 8080: Proxy port
- 8081: Web interface (mitmweb)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-17 06:40:08 +01:00
7f5cb14b96 feat: Rewrite mitmproxy with native OpenWrt build (v10.0.0)
Complete rewrite of secubox-app-mitmproxy to use native OpenWrt packages
instead of pip runtime installation.

New packages created:
- mitmproxy (10.0.0) - Native build from GitHub source
- python3-mitmproxy-rs (0.5.2) - Rust extension with PyO3
- python3-h11 (0.14.0) - HTTP/1.1 protocol
- python3-h2 (4.1.0) - HTTP/2 protocol
- python3-hyperframe (6.0.1) - HTTP/2 framing
- python3-hpack (4.0.0) - HPACK compression
- python3-wsproto (1.2.0) - WebSocket protocol
- python3-aioquic (1.0.0) - QUIC/HTTP3 support
- python3-pylsqpack (0.3.18) - QPACK encoder
- python3-kaitaistruct (0.10) - Binary parsing
- python3-publicsuffix2 (2.20191221) - Domain parsing
- python3-ldap3 (2.9.1) - LDAP support

Changes to secubox-app-mitmproxy:
- Removed pip dependency, now uses native +mitmproxy package
- Removed wrapper scripts (native binaries from mitmproxy package)
- Fixed iptables cleanup to use configured port
- Bumped version to 2.0.0

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-10 18:28:53 +01:00
6c4257f950 feat: Add mitmproxy HTTPS interception proxy packages
New packages for full URL/cookie/header capture via MITM proxy:

secubox-app-mitmproxy:
- Downloads mitmproxy v11.1.2 binary for aarch64
- Transparent proxy mode with iptables integration
- mitmweb UI on port 8081
- Auto CA certificate generation
- mitmproxyctl CLI management tool

luci-app-mitmproxy:
- SecuBox themed dashboard with red color scheme
- Real-time request capture view
- Top hosts statistics
- CA certificate management
- Full UCI settings interface
- RPCD backend for ubus API

This enables full HTTP/HTTPS inspection including:
- Complete URLs (not just hostnames like nDPId)
- Cookies and headers
- Request/response bodies
- Flow recording for replay

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-10 14:25:12 +01:00