GitHub - misaki7in/ipfilter: IP地址白名单过滤器,可配合微步API分析,护网蓝队重保工具
在护网场景中,作为乙方公司的蓝队防守人员,经常会遇到一些客户具有相当多的不可封禁的IP地址,如负载均衡IP,站前代理IP,内网漏扫IP,云防节点IP地址。尽管我们在研判流量威胁时,已经确认了这些IP地址确实存在攻击流量,但是在防火墙封锁恶意IP地址的时候,经常要手工剔除这些IP,十分繁琐。
之前在SXF工作时,经常会看见一线安服工程师因为封锁IP 时未过滤不可封禁IP地址,导致客户的业务中断甚至全部断网【封锁了出口IP】,被记黑事件,甚至辞退
于是针对该场景于2022年8月hvv时开发了IP地址的自动过滤工具,并于2023年3月添加了微步自动化查询IP地址和IP属性【是否具备恶意标签】的功能,方便防守人员快速输出威胁IP话术。
1.微步API接口实现
using Newtonsoft.Json.Linq; using Newtonsoft.Json; using System; using System.Collections.Generic; using System.Linq; using System.Net.Http; using System.Text; using System.Threading.Tasks; namespace IPFilter.Model { public struct Result { public bool success; public string msg; public string data; } public class WBApi { private const string useragent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36"; public HttpClient httpClient; public DateTime CurrentTime; private readonly HttpClientHandler handler; public WBApi() { handler = new HttpClientHandler { AllowAutoRedirect = false, UseCookies = true, }; httpClient = new HttpClient(handler); httpClient.DefaultRequestHeaders.Add("user-agent", useragent); } public Result ip_reputation(string apiKey, string ipString) { var r = new Result(); try { string url = $"https://api.threatbook.cn/v3/scene/ip_reputation?apikey={apiKey}&resource={ipString}&lang=zh"; var response = httpClient.GetAsync(url).Result; response.EnsureSuccessStatusCode(); var data = response.Content.ReadAsStringAsync().Result; var json = JsonConvert.DeserializeObject<JObject>(data); if (json != null && json.ContainsKey("response_code") && json.ContainsKey("verbose_msg")) { r.msg = json["verbose_msg"].ToString(); if (json["response_code"].ToString() == "0") { r.data = data; r.success = true; } } if (string.IsNullOrEmpty(r.msg)) { r.msg = "查询失败"; } } catch (Exception ex) { if (string.IsNullOrEmpty(r.msg)) { r.msg = ex.Message; } } r.msg = "微步查询信誉:" + r.msg; return r; } } }
2.白名单规则匹配实现
using Newtonsoft.Json; using System; using System.Collections.Generic; using System.Text.RegularExpressions; namespace IPFilter.Model { [JsonObject(MemberSerialization.OptIn)] internal class WhiteInfo : UIObject { private bool enable; [JsonProperty] public bool Enable { get => enable; set => this.RaiseAndSetIfChanged(ref enable, value); } private string title; [JsonProperty] public string Title { get => title; set => this.RaiseAndSetIfChanged(ref title, value); } private string whiteContents; [JsonProperty] public string WhiteContents { get => whiteContents; set => this.RaiseAndSetIfChanged(ref whiteContents, value); } public List<uint> IP; public List<(uint, byte)> IPAndMask; public List<(uint, uint)> IPRange; internal bool Has(uint targetip) { if (IP == null) { if (string.IsNullOrEmpty(WhiteContents)) return false; var str = WhiteContents.Trim(); var arr = Regex.Split(str, "\n+"); IP = new List<uint>(); IPAndMask = new List<(uint, byte)>(); IPRange = new List<(uint, uint)>(); for (int i = 0; i < arr.Length; i++) { var ip = arr[i].Trim(); if (string.IsNullOrEmpty(ip)) continue; if (SetWindow.IsIP(ip)) { uint tt = 0; var iparr = Regex.Split(ip, "\\."); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } IP.Add(tt); } else if (SetWindow.IsIPAndMask(ip)) { uint tt = 0; var iparr = Regex.Split(ip, "[\\./]+"); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } byte b = Convert.ToByte(iparr[4]); IPAndMask.Add((tt, b)); } else if (SetWindow.IsIPRange(ip)) { uint tt = 0; var iparr = Regex.Split(ip, "[\\.-]+"); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } uint bb = 0; for (int j = 0; j < 4; j++) { bb = (bb << 8) + Convert.ToUInt32(iparr[j + 4]); } IPRange.Add((tt, bb)); } } } if (IP.Contains(targetip)) return true; for (int i = 0; i < IPAndMask.Count; i++) { var right = 32 - IPAndMask[i].Item2; if ((IPAndMask[i].Item1 >> right) == (targetip >> right)) { return true; } } for (int i = 0; i < IPRange.Count; i++) { if (IPRange[i].Item1 <= targetip && targetip <= IPRange[i].Item2) { return true; } } return false; } } }
3.视图设计
4.视图逻辑
using System; using System.Collections; using System.Collections.Generic; using System.Collections.ObjectModel; using System.Linq; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Threading.Tasks; using System.Windows; using System.Windows.Documents; using System.Windows.Input; using IPFilter.Model; using Newtonsoft.Json; using Newtonsoft.Json.Linq; namespace IPFilter.ViewModel { [JsonObject(MemberSerialization.OptIn)] internal class IPFilterConfig : UIObject { [JsonProperty] public ObservableCollection<WhiteInfo> WhiteInfos { get; set; } private bool enable; [JsonProperty] public bool Enable { get => enable; set => this.RaiseAndSetIfChanged(ref enable, value); } public Window fwindow; internal void Init() { if (WhiteInfos == null) WhiteInfos = new ObservableCollection<WhiteInfo>(); } private ICommand addWhiteInfo; public ICommand AddWhiteInfo => addWhiteInfo ?? (addWhiteInfo = UIObject.Create(() => { var t = new WhiteInfo(); t.Enable = false; t.Title = WhiteInfos.Count.ToString(); var f = new SetWindow(); f.DataContext = t; f.Owner = fwindow; f.ShowDialog(); if (f.Result) { WhiteInfos.Add(t); } })); private ICommand delWhiteInfo; public ICommand DelWhiteInfo => delWhiteInfo ?? (delWhiteInfo = UIObject.Create(() => { var list = new List<WhiteInfo>(); for (int i = 0; i < WhiteInfos.Count; i++) { if (WhiteInfos[i].Enable) { list.Add(WhiteInfos[i]); } } if (list.Count > 0) { var f = new TostWindow(); f.ContentText.Text = "共删除" + list.Count + "项"; f.Owner = fwindow; f.ShowDialog(); if (f.Result) { for (int i = 0; i < list.Count; i++) { WhiteInfos.Remove(list[i]); } } } else { var f = new TostWindow(); f.ContentText.Text = "请勾选要删除的项!"; f.Owner = fwindow; f.ShowDialog(); } })); private ICommand selectAllWhiteInfo; public ICommand SelectAllWhiteInfo => selectAllWhiteInfo ?? (selectAllWhiteInfo = UIObject.Create(() => { for (int i = 0; i < WhiteInfos.Count; i++) { WhiteInfos[i].Enable = true; } })); private ICommand selectReverseWhiteInfo; public ICommand SelectReverseWhiteInfo => selectReverseWhiteInfo ?? (selectReverseWhiteInfo = UIObject.Create(() => { for (int i = 0; i < WhiteInfos.Count; i++) { WhiteInfos[i].Enable = !WhiteInfos[i].Enable; } })); private string inputIp; public string InputIp { get => inputIp; set { if (Equals(inputIp, value)) return; this.RaiseAndSetIfChanged(ref inputIp, value); if (Enable) { MyFilter(); } } } private string whiteIp; public string WhiteIp { get => whiteIp; set => this.RaiseAndSetIfChanged(ref whiteIp, value); } private string noWhiteIp; public string NoWhiteIp { get => noWhiteIp; set => this.RaiseAndSetIfChanged(ref noWhiteIp, value); } private string wbIpInfo; public string WBIpInfo { get => wbIpInfo; set => this.RaiseAndSetIfChanged(ref wbIpInfo, value); } private string evilIPInfos; public string EvilIPInfos { get => evilIPInfos; set => this.RaiseAndSetIfChanged(ref evilIPInfos, value); } private string wbAPPKey; [JsonProperty] public string WBAPPKey { get => wbAPPKey; set => this.RaiseAndSetIfChanged(ref wbAPPKey, value); } private ICommand filterFormWhiteInfos; public ICommand FilterFormWhiteInfos => filterFormWhiteInfos ?? (filterFormWhiteInfos = UIObject.Create(() => { MyFilter(); })); private ICommand showEvilIPInfos; public ICommand ShowEvilIPInfos => showEvilIPInfos ?? (showEvilIPInfos = UIObject.Create(() => { MyShowEvilIPInfos(); })); private WBApi myWBApi; private ICommand wbGetIPInfos; private List<string> WBIplist; public ICommand WBGetIPInfos => wbGetIPInfos ?? (wbGetIPInfos = UIObject.Create(() => { MyWBGetIPInfos(); })); private void MyShowEvilIPInfos() { var list = new List<string>(); for (int i = 0; i < WBIplist.Count; i++) { if (WBIplist[i].IndexOf("恶意") > -1) { list.Add(WBIplist[i].Replace("恶意"," ")); } } EvilIPInfos = string.Join("\r\n", list); } private void MyWBGetIPInfos() { if (string.IsNullOrEmpty(NoWhiteIp)) return; var arr = Regex.Split(NoWhiteIp, "[\r\n]+"); if (WBIplist == null) WBIplist = new List<string>(); else WBIplist.Clear(); WBIpInfo = string.Empty; for (int i = 0; i < arr.Length; i += 100) { var ipstirng = string.Join(",", arr.Skip(i).Take(100).ToList()); if (myWBApi == null) myWBApi = new WBApi(); var r = myWBApi.ip_reputation(wbAPPKey, ipstirng); if (r.success) { ParseWBip_reputation(r.data); } WBIpInfo += r.msg; } WBIpInfo += "\r\n" + string.Join("\r\n", WBIplist); } private void ParseWBip_reputation(string data) { /* { "data": { "159.203.93.255": { "severity": "info", "judgments": [ "IDC" ], "tags_classes": [], "basic": { "carrier": "digitalocean.com", "location": { "country": "United States", "province": "New York", "city": "New York City", "lng": "-74.006", "lat": "40.713", "country_code": "US" } }, "asn": { "rank": 2, "info": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "number": 14061 }, "scene": "", "confidence_level": "low", "is_malicious": false, "update_time": "2016-05-17 20:18:33" } }, "response_code": 0, "verbose_msg": "OK" } */ var json = JObject.Parse(data); var arr = json["data"].Children<JProperty>().Select(x => { var a = x.Name; if (x.Value["is_malicious"].Value<bool>()) { a += " 恶意"; } a += " " + x.Value["basic"]["location"]["country"].ToString() + x.Value["basic"]["location"]["province"].ToString(); return a; }).ToArray(); WBIplist.AddRange(arr); } private void MyFilter() { if (string.IsNullOrEmpty(InputIp)) return; var str = InputIp.Trim(); var arr = Regex.Split(str, "\n+"); var list = new List<string>(); var rlist = new List<string>(); for (int i = 0; i < arr.Length; i++) { var ip = arr[i].Trim(); if (string.IsNullOrEmpty(ip)) continue; if (!SetWindow.IsIP(ip)) { list.Add(ip); } else { rlist.Add(ip); } } if (list.Count > 0) { var f = new TostWindow(); f.ContentText.Text = string.Join("\r\n", list) + "\r\n不是有效IP格式"; var h = f.Height + 20 * list.Count; f.Height = h > 500 ? 500 : h; f.Owner = fwindow; f.ShowDialog(); } var whiteIpList = new List<string>(); for (int k = 0; k < rlist.Count; k++) { var has = false; uint tt = 0; var iparr = Regex.Split(rlist[k], "\\."); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } for (int i = 0; i < WhiteInfos.Count; i++) { if (WhiteInfos[i].Enable && WhiteInfos[i].Has(tt)) { has = true; break; } } if (has) { whiteIpList.Add(rlist[k]); } } var noWhiteIpList = new List<string>(); for (int i = 0; i < arr.Length; i++) { var ip = arr[i].Trim(); if (string.IsNullOrEmpty(ip)) continue; if (!whiteIpList.Contains(ip)) { noWhiteIpList.Add(ip); } } NoWhiteIp = string.Join("\r\n", noWhiteIpList); WhiteIp = string.Join("\r\n", whiteIpList); } } }
1.录入白名单的标题,如XX单位【云防节点】,输入白名单规则,支持三种IP格式的输入。
2.根据需求启用或新建白名单规则,输入对应的IP段,即可实现IP地址的过滤
3.如果你具有微步的APItoken的话【注意:微步API需要申请,并且非企业用户每天可查询额度固定为50,超出则无法查询】,可以输入APItoken,对IP地址进行威胁查询和地址查询,并过滤出恶意标签的IP地址。
获取微步API的方式: 访问链接: ThreatBook 用户登录
注意: 注意确认自己每日的API查询IP的额度,个人用户较少,每天只有50次,建议申请企业用户。
最终结果整理成值守话术,美滋滋~~~~,再也不担心封错IP地址。
1.项目目录文件如下
2.项目文件哈希值如下【注意别被攻击队钓鱼了】
SHA1 的 IPFilter.exe 哈希: ec2302560afdb52b2fe772570df7943808476158 MD5 的 IPFilter.exe 哈希: f102e67b979a4daefd195ca8e859b537
3.考虑到部分小伙伴有特殊的需求,可以在github上留言
文章浏览阅读1.6k次。安装配置gi、安装数据库软件、dbca建库见下:http://blog.csdn.net/kadwf123/article/details/784299611、检查集群节点及状态:[root@rac2 ~]# olsnodes -srac1 Activerac2 Activerac3 Activerac4 Active[root@rac2 ~]_12c查看crs状态
文章浏览阅读1.3w次,点赞45次,收藏99次。我个人用的是anaconda3的一个python集成环境,自带jupyter notebook,但在我打开jupyter notebook界面后,却找不到对应的虚拟环境,原来是jupyter notebook只是通用于下载anaconda时自带的环境,其他环境要想使用必须手动下载一些库:1.首先进入到自己创建的虚拟环境(pytorch是虚拟环境的名字)activate pytorch2.在该环境下下载这个库conda install ipykernelconda install nb__jupyter没有pytorch环境
文章浏览阅读5.2k次,点赞19次,收藏28次。选择scoop纯属意外,也是无奈,因为电脑用户被锁了管理员权限,所有exe安装程序都无法安装,只可以用绿色软件,最后被我发现scoop,省去了到处下载XXX绿色版的烦恼,当然scoop里需要管理员权限的软件也跟我无缘了(譬如everything)。推荐添加dorado这个bucket镜像,里面很多中文软件,但是部分国外的软件下载地址在github,可能无法下载。以上两个是官方bucket的国内镜像,所有软件建议优先从这里下载。上面可以看到很多bucket以及软件数。如果官网登陆不了可以试一下以下方式。_scoop-cn
文章浏览阅读4.5k次,点赞2次,收藏3次。首先要有一个color-picker组件 <el-color-picker v-model="headcolor"></el-color-picker>在data里面data() { return {headcolor: ’ #278add ’ //这里可以选择一个默认的颜色} }然后在你想要改变颜色的地方用v-bind绑定就好了,例如:这里的:sty..._vue el-color-picker
文章浏览阅读640次。基于芯片日益增长的问题,所以内核开发者们引入了新的方法,就是在内核中只保留函数,而数据则不包含,由用户(应用程序员)自己把数据按照规定的格式编写,并放在约定的地方,为了不占用过多的内存,还要求数据以根精简的方式编写。boot启动时,传参给内核,告诉内核设备树文件和kernel的位置,内核启动时根据地址去找到设备树文件,再利用专用的编译器去反编译dtb文件,将dtb还原成数据结构,以供驱动的函数去调用。firmware是三星的一个固件的设备信息,因为找不到固件,所以内核启动不成功。_exynos 4412 刷机
文章浏览阅读2w次,点赞24次,收藏42次。Linux系统配置jdkLinux学习教程,Linux入门教程(超详细)_linux配置jdk
文章浏览阅读3.3k次,点赞5次,收藏19次。xlabel('\delta');ylabel('AUC');具体符号的对照表参照下图:_matlab微米怎么输入
文章浏览阅读119次。顺序读写指的是按照文件中数据的顺序进行读取或写入。对于文本文件,可以使用fgets、fputs、fscanf、fprintf等函数进行顺序读写。在C语言中,对文件的操作通常涉及文件的打开、读写以及关闭。文件的打开使用fopen函数,而关闭则使用fclose函数。在C语言中,可以使用fread和fwrite函数进行二进制读写。 Biaoge 于2024-03-09 23:51发布 阅读量:7 ️文章类型:【 C语言程序设计 】在C语言中,用于打开文件的函数是____,用于关闭文件的函数是____。
文章浏览阅读3.4k次,点赞2次,收藏13次。跟随鼠标移动的粒子以grid(SOP)为partical(SOP)的资源模板,调整后连接【Geo组合+point spirit(MAT)】,在连接【feedback组合】适当调整。影响粒子动态的节点【metaball(SOP)+force(SOP)】添加mouse in(CHOP)鼠标位置到metaball的坐标,实现鼠标影响。..._touchdesigner怎么让一个模型跟着鼠标移动
文章浏览阅读178次。项目运行环境配置:Jdk1.8 + Tomcat7.0 + Mysql + HBuilderX(Webstorm也行)+ Eclispe(IntelliJ IDEA,Eclispe,MyEclispe,Sts都支持)。项目技术:Springboot + mybatis + Maven +mysql5.7或8.0+html+css+js等等组成,B/S模式 + Maven管理等等。环境需要1.运行环境:最好是java jdk 1.8,我们在这个平台上运行的。其他版本理论上也可以。_基于java技术的停车场管理系统实现与设计
文章浏览阅读3.5k次。前言对于MediaPlayer播放器的源码分析内容相对来说比较多,会从Java-&amp;gt;Jni-&amp;gt;C/C++慢慢分析,后面会慢慢更新。另外,博客只作为自己学习记录的一种方式,对于其他的不过多的评论。MediaPlayerDemopublic class MainActivity extends AppCompatActivity implements SurfaceHolder.Cal..._android多媒体播放源码分析 时序图
文章浏览阅读2.4k次,点赞41次,收藏13次。java 数据结构与算法 ——快速排序法_快速排序法