Skip to content

Commit 5932490

Browse files
FallDiFallDi
committed
add ip blacklist processing
1 parent 1f853dd commit 5932490

13 files changed

+135
-57
lines changed

‎LinksExtractor/src/ru/nsu/xwaf/Main.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,15 @@ public static void main(String[] args) {
3535
worker.start(args[SITE_ITEM], limit);
3636
worker.getResult(outputFileName);
3737
} catch (MalformedURLException error) {
38-
System.err.println("Sorry, we can\'t connect to the URL");
38+
System.err.println("Sorry, we can\'t connect to the URL: " + error.toString());
3939
} catch (IOException error) {
4040
error.printStackTrace(System.err);
4141
} catch (ParserConfigurationException e) {
42-
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
42+
e.printStackTrace();
4343
} catch (TransformerException e) {
44-
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
44+
e.printStackTrace();
4545
} catch (XMLStreamException e) {
46-
e.printStackTrace(); //To change body of catch statement use File | Settings | File Templates.
46+
e.printStackTrace();
4747
}
4848
}
4949
}

‎ProxyFilter/answers/blacklist_ip.html

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
2+
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
3+
<head>
4+
<title>Your IP is blocked</title>
5+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
6+
<link rel="stylesheet" type="text/css" href="./style/style.css" />
7+
<link rel="shortcut icon" href="./favicon.ico" type="image/x-icon" />
8+
</head>
9+
<body>
10+
<p>Your IP <b><ip/></b> has been blocked</p>
11+
</body>
12+
</html>
13+
14+

‎ProxyFilter/logs/result.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<link rel="stylesheet" type="text/css" href="style.css" />
77
</head>
88
<body>
9-
<p>Log from <b>2012/05/17 00:00:00</b> to <b>2013/09/23 21:51:47</b></p>
9+
<p>Log from <b>2012/05/17 00:00:00</b> to <b>2013/10/30 20:56:27</b></p>
1010
<table border="1">
1111
<tr>
1212
<td align="center" class="table_title">Rule</td>
@@ -22,7 +22,7 @@
2222
</tr>
2323
<tr>
2424
<td>DirectoryTraversal</td>
25-
<td>1</td>
25+
<td>2</td>
2626
</tr>
2727
<tr>
2828
<td>SQLInjection(UNION)</td>

‎ProxyFilter/src/ru/nsu/xwaf/Answer.java

+9-2
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,17 @@
66
import java.io.InputStreamReader;
77

88
/**
9+
* HTML response template
910
*
10-
* @author daredevil
11+
* @author FallDi
1112
*/
1213
public class Answer {
1314

1415
private String answer;
1516
private String fileName;
1617
private static final String REQUEST_PATTERN = "<request/>";
1718
private static final String BLOCKED_RULE = "<rule/>";
19+
private static final String BLOCKED_IP = "<ip/>";
1820

1921
public Answer(String fileName) {
2022
this.fileName = fileName;
@@ -34,7 +36,12 @@ public void loadFile() {
3436
}
3537
}
3638

37-
public String getAnswer(String request, Rule rule) {
39+
public String getAnswerBlockIp(String ip) {
40+
String fullAnswer = answer.replace(BLOCKED_IP, ip);
41+
return "HTTP/1.1 200 OK\r\nContent-Length: " + String.valueOf(fullAnswer.length()) + "\r\n\r\n" + fullAnswer;
42+
}
43+
44+
public String getAnswerBlock(String request, Rule rule) {
3845
String fullAnswer = answer.replace(REQUEST_PATTERN, request);
3946
fullAnswer = fullAnswer.replace(BLOCKED_RULE, rule.getName());
4047
return "HTTP/1.1 200 OK\r\nContent-Length: " + String.valueOf(fullAnswer.length()) + "\r\n\r\n" + fullAnswer;

‎ProxyFilter/src/ru/nsu/xwaf/DatabaseManager.java

+46-14
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,21 @@
1010
import java.text.SimpleDateFormat;
1111
import java.util.Calendar;
1212
import java.util.GregorianCalendar;
13+
import java.util.HashMap;
14+
import java.util.Map;
1315

1416
/**
17+
* Database management class
1518
*
16-
* @author daredevil
19+
* @author FallDi
1720
*/
1821
public class DatabaseManager {
1922

2023
public static String DB_PATH = "../vulnerabilities_signatures.sqlite";
2124
public static String LOG_FILE_NAME = "./logs/result.html";
2225
public static String RULE_TABLE_NAME = "rules";
2326
public static String LOGGER_TABLE_NAME = "logger";
27+
public static String BLACKLIST_IP_TABLE_NAME = "blacklistIp";
2428

2529
public DatabaseManager() {
2630
}
@@ -89,19 +93,48 @@ public RulesGroup loadDatabase() {
8993
return rulesGroup;
9094
}
9195

96+
public Map<Integer, String> getIpBlacklist() {
97+
Connection connection = null;
98+
ResultSet resultSet = null;
99+
Statement statement = null;
100+
HashMap<Integer, String> blacklistIp = new HashMap<Integer, String>();
101+
try {
102+
Class.forName("org.sqlite.JDBC");
103+
connection = DriverManager.getConnection("jdbc:sqlite:" + DB_PATH);
104+
statement = connection.createStatement();
105+
resultSet = statement.executeQuery("SELECT id, ip FROM " + BLACKLIST_IP_TABLE_NAME);
106+
while (resultSet.next()) {
107+
int id = resultSet.getInt("id");
108+
String ip = resultSet.getString("ip");
109+
blacklistIp.put(id, ip);
110+
}
111+
} catch (Exception e) {
112+
System.out.println(e.toString());
113+
} finally {
114+
try {
115+
resultSet.close();
116+
statement.close();
117+
connection.close();
118+
} catch (SQLException ex) {
119+
System.out.println(ex.toString());
120+
}
121+
}
122+
return blacklistIp;
123+
}
124+
92125
public String getLog(GregorianCalendar from, GregorianCalendar to) {
93126
Connection connection = null;
94127
PreparedStatement statement = null;
95128
ResultSet resultSet = null;
96129
String result = new String();
97-
result = "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n" +
98-
"<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" lang=\"en\">\n" +
99-
" <head>\n" +
100-
" <title>Logger</title>\n" +
101-
" <meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" />\n" +
102-
" <link rel=\"stylesheet\" type=\"text/css\" href=\"style.css\" />\n" +
103-
" </head>\n" +
104-
" <body>\n";
130+
result = "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n"
131+
+ "<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" lang=\"en\">\n"
132+
+ " <head>\n"
133+
+ " <title>Logger</title>\n"
134+
+ " <meta http-equiv=\"content-type\" content=\"text/html; charset=utf-8\" />\n"
135+
+ " <link rel=\"stylesheet\" type=\"text/css\" href=\"style.css\" />\n"
136+
+ " </head>\n"
137+
+ " <body>\n";
105138
try {
106139
Class.forName("org.sqlite.JDBC");
107140
connection = DriverManager.getConnection("jdbc:sqlite:" + DB_PATH);
@@ -127,8 +160,8 @@ public String getLog(GregorianCalendar from, GregorianCalendar to) {
127160
} catch (Exception ex) {
128161
System.out.println(ex.toString());
129162
}
130-
result += " </body>\n" +
131-
"</html>";
163+
result += " </body>\n"
164+
+ "</html>";
132165
return result;
133166
}
134167

@@ -152,9 +185,8 @@ public void addLog(URL url, Rule rule, String sourceIP) {
152185
System.out.println(ex.toString());
153186
}
154187
}
155-
156-
public void updateLogFile()
157-
{
188+
189+
public void updateLogFile() {
158190
try {
159191
GregorianCalendar start = new GregorianCalendar(2012, 05 - 1, 17);
160192
GregorianCalendar end = new GregorianCalendar();

‎ProxyFilter/src/ru/nsu/xwaf/FilterProxy.java

+10-6
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,27 @@
22

33
import java.io.IOException;
44
import java.net.ServerSocket;
5+
import java.util.Map;
56

67
/**
8+
* Proxy class. Listening all incoming connection and make thread on new client.
79
*
8-
* @author daredevil
10+
* @author FallDi
911
*/
1012
public class FilterProxy extends Thread {
1113

1214
private int port;
1315
private boolean listening;
1416
private ServerSocket serverSocket;
1517
private RulesGroup rules;
18+
private Map<Integer, String> blacklistIp;
1619
private DatabaseManager dbm;
17-
18-
public FilterProxy(int port, RulesGroup rules, DatabaseManager dbm) {
19-
listening = true;
20+
21+
public FilterProxy(int port, RulesGroup rules, Map<Integer, String> blacklistIp, DatabaseManager dbm) {
22+
this.listening = true;
2023
this.port = port;
2124
this.rules = rules;
25+
this.blacklistIp = blacklistIp;
2226
this.dbm = dbm;
2327
}
2428

@@ -29,12 +33,12 @@ public void run() {
2933
System.out.println("Started on: " + port);
3034
ProxyThread pt;
3135
while (listening) {
32-
pt = new ProxyThread(serverSocket.accept(), rules, dbm);
36+
pt = new ProxyThread(serverSocket.accept(), rules, blacklistIp, dbm);
3337
pt.start();
3438
}
3539
serverSocket.close();
3640
} catch (IOException e) {
37-
System.err.println("Could not listen on port: " + port);
41+
System.err.println("Could not listen on port: " + port + " " + e.toString());
3842
System.exit(-1);
3943
}
4044
}

‎ProxyFilter/src/ru/nsu/xwaf/HTTPRequest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
/**
1010
*
11-
* @author daredevil
11+
* @author FallDi
1212
*/
1313
public class HTTPRequest {
1414

‎ProxyFilter/src/ru/nsu/xwaf/ProxyFilter.java

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
package ru.nsu.xwaf;
22

3+
import java.util.Map;
4+
35
/**
46
*
5-
* @author daredevil
7+
* @author FallDi
68
*/
79
public class ProxyFilter {
810

@@ -17,7 +19,8 @@ public class ProxyFilter {
1719
public static void main(String args[]) {
1820
DatabaseManager dbm = new DatabaseManager();
1921
RulesGroup mainRules = dbm.loadDatabase();
20-
FilterProxy fp = new FilterProxy(port, mainRules, dbm);
22+
Map<Integer, String> blacklistIp = dbm.getIpBlacklist();
23+
FilterProxy fp = new FilterProxy(port, mainRules, blacklistIp, dbm);
2124
fp.start();
2225
}
2326
}

‎ProxyFilter/src/ru/nsu/xwaf/ProxyThread.java

+35-24
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
package ru.nsu.xwaf;
22

33
import java.io.*;
4+
import java.net.InetSocketAddress;
45
import java.net.Socket;
56
import java.net.URL;
67
import java.net.URLDecoder;
78
import java.util.Map;
89

910
/**
11+
* Main logic of analyze request/response
1012
*
11-
* @author daredevil
13+
* @author FallDi
1214
*/
1315
public class ProxyThread extends Thread {
1416

@@ -17,12 +19,14 @@ public class ProxyThread extends Thread {
1719
private static final int READ_BUFFERD_SIZE_REQUEST = 1;
1820
private static final int BUFFER_SIZE = 32000;
1921
private RulesGroup rules;
22+
private Map<Integer, String> blacklistIp;
2023
private DatabaseManager dbm;
2124

22-
public ProxyThread(Socket socket, RulesGroup rules, DatabaseManager dbm) {
25+
public ProxyThread(Socket socket, RulesGroup rules, Map<Integer, String> blacklistIp, DatabaseManager dbm) {
2326
super("ProxyThread");
2427
this.socket = socket;
2528
this.rules = rules;
29+
this.blacklistIp = blacklistIp;
2630
this.dbm = dbm;
2731
}
2832

@@ -34,8 +38,10 @@ public void run() {
3438
DataOutputStream servOut = null;
3539
Socket server = null;
3640
try {
41+
// initialize input streams
3742
clientOut = new DataOutputStream(socket.getOutputStream());
3843
clientIn = new DataInputStream(socket.getInputStream());
44+
String clientIpAddress = ((InetSocketAddress) socket.getRemoteSocketAddress()).getHostName();
3945
// get request
4046
HTTPRequest hr;
4147
Map<String, String> fields;
@@ -58,34 +64,39 @@ public void run() {
5864
break;
5965
}
6066
}
61-
System.out.println(requestStr);
67+
//System.out.println(requestStr);
6268
String[] tokens = requestStr.split(" ");
6369
String urlToCall = tokens[1];
6470
URL url = new URL(urlToCall);
65-
Rule blockedRule = null;
66-
if (null == (blockedRule = rules.isVulnerable(URLDecoder.decode(requestStr, "UTF-8")))) {
67-
// get response and send to client
68-
server = new Socket(url.getHost(), 80);
69-
servIn = new DataInputStream(server.getInputStream());
70-
servOut = new DataOutputStream(server.getOutputStream());
71-
servOut.write(requestByte, 0, sizeRequest);
71+
if (blacklistIp.containsValue(clientIpAddress)) {
72+
Answer answer = new Answer("./answers/blacklist_ip.html");
73+
answer.loadFile();
74+
byte[] answerByte = (answer.getAnswerBlockIp(clientIpAddress)).getBytes();
75+
clientOut.write(answerByte, 0, answerByte.length);
76+
} else {
77+
Rule blockedRule = null;
78+
if (null == (blockedRule = rules.isVulnerable(URLDecoder.decode(requestStr, "UTF-8")))) {
79+
// get response and send to client
80+
server = new Socket(url.getHost(), 80);
81+
servIn = new DataInputStream(server.getInputStream());
82+
servOut = new DataOutputStream(server.getOutputStream());
83+
servOut.write(requestByte, 0, sizeRequest);
7284

73-
//begin send response to client byte by[] = new
74-
byte[] by = new byte[BUFFER_SIZE];
75-
index = servIn.read(by, 0, READ_BUFFER_SIZE);
76-
int responseSize = 0;
77-
while (index >= 0) {
78-
clientOut.write(by, 0, index);
79-
responseSize += index;
85+
//begin send response to client byte by[] = new
86+
byte[] by = new byte[BUFFER_SIZE];
8087
index = servIn.read(by, 0, READ_BUFFER_SIZE);
88+
while (index >= 0) {
89+
clientOut.write(by, 0, index);
90+
index = servIn.read(by, 0, READ_BUFFER_SIZE);
91+
}
92+
} else {
93+
Answer answer = new Answer("./answers/block.html");
94+
answer.loadFile();
95+
byte[] answerByte = (answer.getAnswerBlock(requestStr, blockedRule) + blockedRule.getName()).getBytes();
96+
clientOut.write(answerByte, 0, answerByte.length);
97+
dbm.addLog(url, blockedRule, socket.getLocalAddress().getHostAddress());
98+
dbm.updateLogFile();
8199
}
82-
} else {
83-
Answer answer = new Answer("./answers/block.html");
84-
answer.loadFile();
85-
byte[] answerByte = (answer.getAnswer(requestStr, blockedRule) + blockedRule.getName()).getBytes();
86-
clientOut.write(answerByte, 0, answerByte.length);
87-
dbm.addLog(url, blockedRule, socket.getLocalAddress().getHostAddress());
88-
dbm.updateLogFile();
89100
}
90101
clientOut.flush();
91102
} catch (IOException e) {

‎ProxyFilter/src/ru/nsu/xwaf/Rule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
/**
77
*
8-
* @author daredevil
8+
* @author FallDi
99
*/
1010
public class Rule {
1111

‎ProxyFilter/src/ru/nsu/xwaf/RulesGroup.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
/**
88
*
9-
* @author daredevil
9+
* @author FallDi
1010
*/
1111
public class RulesGroup {
1212

0 commit comments

Comments
 (0)