Package: pyrasp
Python RASPOverviewpyraspis aRuntime Application Self Protectionpackage for Python-based Web Servers. It protects against the main attacks web applications are exposed to, from within the application.One specificity ofpyrasprelies on the fact that it does not use signatures. Instead it will leverage decoys, thresholds, system and application internals, machine learning and grammatical analysis.Security modules, technology, and operations are provided in the table below.ModuleTechnologyFunctionFlood & Brute ForceThresholdIdentifies and blocks repetitive connections or attempts from same sourceForbidden HeadersList ValidationDenies requests with specified headersRequests ValidationApplication InternalsDenies requests with invalid path or methodsSpoofingHeader ValidationDenies requests with mismatching Host headerDecoyPathIdentifies request to known scanned pathsSQL InjectionGrammatical Analysis + Machine LearningDetects and blocks SQL injection attemptsXSSMachine LearningDetects and XSS attemptsCommand InjectionSystem InternalsPrevents command injections attemptsHTTP Parameter PolutionGroupingPrevents HPP attacks attemptsData Leak PreventionRegexpBlocks outgoing sensible dataSupported Frameworkspyrasp0.4.x supports Flask, FastAPI and DjangoIMPORTANTFastAPI support requiresstarlette>= 0.28.0InstallFrom PyPi (Recommended)pip install pyraspFrom Sourcegit clone https://github.com/rbidou/pyrasp
cd pyrasp
pip install -r requirements.txtRunClassesFrameworkrasp_classNoteFlaskFaskRASPFastAPIFastApiRASPIMPORTANTRequires starlette >= 0.28.0DjangoDjangoRASPFlask & FastAPIGuidelinespyrasprequires 2 lines of code to run.from pyrasp.pyrasp import <rasp_class><rasp_class>(<framework_instrance>, conf = <configuration_file>)Examplesfrompyrasp.pyraspimportFlaskRASPapp=Flask(__name__)FlaskRASP(app,conf='rasp.json')frompyrasp.pyraspimportFastApiRASPapp=FastAPI()rasp=FastApiRASP(app,conf='rasp.json')DjangoGuidelinesThepyraspclass must be added to theMIDDLEWAREvariable in thesettings.pyfile of the Django application.
Additionally aPYRASP_CONFvariable must be added to the same file. It contains the path of the configuration file.ExamplePYRASP_CONF='rasp.json'MIDDLEWARE=['pyrasp.pyrasp.DjangoRASP',...]StartupAt startup of the applicationpyrasploading information is displayed.### PyRASP v0.4.0 ##########
[+] Starting PyRASP
[+] Loading configuration from rasp.json
[+] XSS model loaded
[+] SQLI model loaded
[+] PyRASP succesfully started
############################ConfigurationConfiguration is set from a JSON file.pyraspfirst loads default values and overwrite data from configuration.Example File{"HOSTS":["mysite.mydomain.com"],"APP_NAME":"Web Server","GTFO_MSG":"<html><head /><body><h1>You have been blocked</h1></body></html>","DENY_STATUS_CODE":403,"VERBOSE":10,"DECODE_B64":true,"SECURITY_CHECKS":{"path":2,"headers":2,"flood":2,"spoofing":2,"decoy":2,"sqli":2,"xss":2,"hpp":2,"command":2,"dlp":2},"WHITELIST":[],"IGNORE_PATHS":["^/css","^/js","^/img"],"BRUTE_AND_FLOOD_PATHS":["^/"],"FLOOD_DELAY":60,"FLOOD_RATIO":50,"ERROR_FLOOD_DELAY":10,"ERROR_FLOOD_RATIO":100,"BLACKLIST_DELAY":3600,"BLACKLIST_OVERRIDE":false,"DECOY_ROUTES":["/admin","/login","/logs","/version","/cgi-bin/","/remote/","/.env","/owa/","/autodiscover","/Autodiscover","/.git/","/.aws/ ","/.well-known/"],"XSS_PROBA":0.80,"MIN_XSS_LEN":16,"SQLI_PROBA":0.725,"MIN_SQLI_LEN":8,"DLP_PHONE_NUMBERS":false,"DLP_CC_NUMBERS":false,"DLP_PRIVATE_KEYS":false,"DLP_HASHES":false,"DLP_WINDOWS_CREDS":false,"DLP_LINUX_CREDS":false,"LOG_ENABLED":false,"LOG_FORMAT":"Syslog","LOG_SERVER":"127.0.0.1","LOG_PORT":514,"LOG_PROTOCOL":"UDP","CHANGE_SERVER":true,"SERVER_HEADER":"Apache"}ParametersGeneric Parameters TableParameterTypeValuesDefaultUsageHOSTSlist of tringsany[]List of valid 'Host' headers checked for spoofing detectionAPP_NAMEstringany["Web Server"]Identification of the web application in the logsGTFO_MSGstringany["Blocked"]Message displayed when request is blocked. HTML page code is authorizedDENY_STATUS_CODEintegerany403HTTP status code sent in response to blocked requestsVERBOSEintegerany0Verbosity level -see "Specific Parameters Values" section belowDECODE_B64booleantrue, falsetrueDecode Base64-encoded payloadsSECURITY_CHECKSinteger0, 1, 2, 3see belowSecurity modules status -see "Specific Parameters Values" section belowWHITELISTlist of stringsany[]Whitelisted source IP addressesIGNORE_PATHSlist of regexpanysee belowPaths to which requests will entirely bypass security checks including blacklistBRUTE_AND_FLOOD_PATHlist of regexpany["^/"]Paths for which flood and brute force threshold will be enabledFLOOD_DELAYintegerany60Sliding time window (in second) against which request threshold is calculatedFLOOD_RATIOintegerany50Requests thresholdERROR_FLOOD_DELAYintegerany10Sliding time window (in second) against which error threshold is calculatedERROR_FLOOD_RATIOintegerany100Errors thresholdBLACKLIST_DELAYintegerany3600Duration (in seconds) of source IP blacklistingBLACKLIST_OVERRIDEbooleantrue, falsefalseIgnore source IP blacklisting (usually for testing)DECOY_ROUTESlist of stringsanysee belowPaths generating immediate detectionXSS_PROBAfloat0 to 10.60Machine Learning prediction minimum probability for XSS (should be left to 0.8)MIN_XSS_LENintegerany16Minimum payload size to be checked by XSS engineSQLI_PROBAfloat0 to 10.725Machine Learning prediction minimum probability for SQL injections (should be left to 0.725)MIN_SQLI_LENintegerany16Minimum payload size to be checked by SQLI engineDLP_PHONE_NUMBERSbooleantrue, falsefalseCheck phone number leakDLP_CC_NUMBERSbooleantrue, falsefalseCheck credit card number leakDLP_PRIVATE_KEYSbooleantrue, falsefalseCheck private key leakDLP_HASHESbooleantrue, falsefalseCheck hash leakDLP_WINDOWS_CREDSbooleantrue, falsefalseCheck Windows credentials leakDLP_LINUX_CREDSbooleantrue, falsefalseCheck Linux credentials leakLOG_ENABLEDbooleantrue, falsefalseEnable event loggingLOG_FORMATstringsyslog, json"syslog"Format of event log -see "Event Logs Format" section belowLOG_SERVERstringany"127.0.0.1"Log server IP address or FQDNLOG_PORTinteger1 - 36635514Log server portLOG_PROTOCOLstringtcp, udp, http, https"udp"Log server protocol (tcp or udp for syslog, http or https for json)CHANGE_SERVERbooleantrue, falsetrueChange response "Server" headerSERVER_HEADERstringany"Apache"Message displayed when request is blocked. HTML page code is authorizedDefault ignore paths"IGNORE_PATHS":["^/favicon.ico$","^/robots.txt$","^/sitemap\\.(txt|xml)$"]Default decoy paths"DECOY_ROUTES":["/admin","/login","/logs","/version","/cgi-bin/","/remote/","/.env","/owa/","/autodiscover","/Autodiscover","/.git/","/.aws/ "]Specific Parameters ValuesSECURITY_CHECKSValueUsage0Disabled1Enabled, no Blacklisting2Enabled, Blacklisting activatedDefault security checks valuesParameterFunctionDefault ValuefloodFlood & Brute Force2headersForbidden Headers0pathRequests Validation1spoofingSpoofing0decoyDecoyPathsqliSQL Injection2xssXSSMachine LearningcommandCommand Injection2hppHTTP Parameter Polution2dlpData Leak Prevention0Note:spoofingmodule refers to "Host" header validationVERBOSEValueMessages displayed0Start, Stop, Configuration load status10+Configuration loading details, XSS model load status, Logging process status, Attacks detection100+Configuration detailsEvent Logs FormatParametersParameterFormatDetail<event_time>%Y/%m/%d %H:%M:%STime on the system runningpyrasp<application_name>stringValue of theAPP_NAMEparameter<event_type>stringType of attack -see "Attack Types" section below<source_ip>stringIP address of the attack source<country>stringCountry of the source address ("Private" if internal network)<location>stringLocation of the offending payload -see "Payload Locations" section below<payload>stringSuspicious payload (base64 decoded)JSON Logs{"time":"<event_time>","application":"<application_name>","log_data":["<event_type>","<source_ip>","<country>",{"location":"<location>","payload":"<payload>"}]}Syslog Logs[<event_time>] "<application_name>" - "<event_type>" - "<source_ip>" - "<country>" - "<location>:<payload>"Attack TypesPossible values for attack types are:Blacklisted IPInvalid PathFloodHost SpoofingDecoyedFormat MismatchSQL InjectionXSSParameter PollutionCommand InjectionForbidden HeaderPayload LocationsValueLocationsource_ipSource IPrequestRequest path or methodpathRequest pathhost"Host" headerheaders_namesRequest header nameheaders_valuesRequest header valuecookiesCookiesuser_agent"User-Agent" headerreferer"Referer" headerqs_variablesQuery String variable nameqs_valuesQyery String valuepost_variablesPosted data variable namepost_valuesPosted data valuejson_keysJSON key namejson_valuesJSON key valuecontentResponse contentContactsRenaud Bidou -renaud@paracyberbellum.io