RomanNum3ral
/
Cybersecurity-Projects
mirror of https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[feat]: add XXE_INJECTION regex pattern to ATTACK_COMBINED

This commit is contained in:
surya 2026-07-04 21:36:03 +05:30
parent 51830a5ae8
commit 22c9f66dcf
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py
View File

@ -3,7 +3,7 @@
patterns.py patterns.py
Compiled regex patterns for web attack detection covering Compiled regex patterns for web attack detection covering
9 OWASP categories plus encoding anomalies 10 OWASP categories plus encoding anomalies
Defines case-insensitive compiled patterns for: SQLI Defines case-insensitive compiled patterns for: SQLI
(union select, sleep, benchmark, information_schema, hex (union select, sleep, benchmark, information_schema, hex
@ -14,13 +14,16 @@ document.cookie/write, eval/alert/prompt), PATH_TRAVERSAL
etc/passwd, .git/config, .env), COMMAND_INJECTION etc/passwd, .git/config, .env), COMMAND_INJECTION
(semicolon/pipe chaining to shell commands, $() and (semicolon/pipe chaining to shell commands, $() and
backtick substitution, ${} expansion), FILE_INCLUSION backtick substitution, ${} expansion), FILE_INCLUSION
(php://, file://, data://, phar:// wrapper schemes), SSRF (php://, file://, data://, phar:// wrapper schemes),
(cloud metadata IPs 169.254.169.254, localhost with paths, XXE_INJECTION (<!ENTITY / <!DOCTYPE declarations, SYSTEM
dict:// and gopher://), LOG4SHELL (${jndi, ${lower, ${:- "file:///" references, xmlns:xi includes, and their
patterns), CRLF_INJECTION (%0d%0a sequences, bare CR/LF), URL-encoded variants), SSRF (cloud metadata IPs
169.254.169.254, localhost with paths, dict:// and
gopher://), LOG4SHELL (${jndi, ${lower, ${:- patterns),
CRLF_INJECTION (%0d%0a sequences, bare CR/LF),
OPEN_REDIRECT (redirect params pointing to external URLs). OPEN_REDIRECT (redirect params pointing to external URLs).
Also provides ENCODED_CHARS, DOUBLE_ENCODED for evasion Also provides ENCODED_CHARS, DOUBLE_ENCODED for evasion
detection, and ATTACK_COMBINED unioning all 9 patterns detection, and ATTACK_COMBINED unioning all 10 patterns
Connects to: Connects to:
core/features/ core/features/
@ -103,6 +106,14 @@ _FILE_INCLUSION = (r"(?:php://|"
r"phar://|" r"phar://|"
r"glob://)") r"glob://)")
_XXE_INJECTION = (
r"(?:<!\s*(?:ENTITY|DOCTYPE)\b|"
r"SYSTEM\s+[\"']\s*(?:file|http|https|ftp|php|data)://|"
r"xmlns\s*:\s*xi\s*=|"
r"%(?:25)?3[Cc]!(?:ENTITY|DOCTYPE)|"
r"&(?:xxe|xml|ext|file);|"
r"%(?:25)?(?:53|73)(?:25)?(?:59|79)(?:25)?(?:53|73)(?:25)?(?:54|74)(?:25)?(?:45|65)(?:25)?(?:4d|6d))")
_SSRF = ( _SSRF = (
r"(?:169\.254\.169\.254|" r"(?:169\.254\.169\.254|"
r"metadata\.google\.internal|" r"metadata\.google\.internal|"
@ -129,6 +140,7 @@ XSS = re.compile(_XSS, re.IGNORECASE)
PATH_TRAVERSAL = re.compile(_PATH_TRAVERSAL, re.IGNORECASE) PATH_TRAVERSAL = re.compile(_PATH_TRAVERSAL, re.IGNORECASE)
COMMAND_INJECTION = re.compile(_COMMAND_INJECTION, re.IGNORECASE) COMMAND_INJECTION = re.compile(_COMMAND_INJECTION, re.IGNORECASE)
FILE_INCLUSION = re.compile(_FILE_INCLUSION, re.IGNORECASE) FILE_INCLUSION = re.compile(_FILE_INCLUSION, re.IGNORECASE)
XXE_INJECTION = re.compile(_XXE_INJECTION, re.IGNORECASE)
SSRF = re.compile(_SSRF, re.IGNORECASE) SSRF = re.compile(_SSRF, re.IGNORECASE)
LOG4SHELL = re.compile(_LOG4SHELL, re.IGNORECASE) LOG4SHELL = re.compile(_LOG4SHELL, re.IGNORECASE)
CRLF_INJECTION = re.compile(_CRLF_INJECTION, re.IGNORECASE) CRLF_INJECTION = re.compile(_CRLF_INJECTION, re.IGNORECASE)
@ -137,7 +149,7 @@ OPEN_REDIRECT = re.compile(_OPEN_REDIRECT, re.IGNORECASE)
ATTACK_COMBINED = re.compile( ATTACK_COMBINED = re.compile(
r"|".join(( r"|".join((
_SQLI, _XSS, _PATH_TRAVERSAL, _COMMAND_INJECTION, _SQLI, _XSS, _PATH_TRAVERSAL, _COMMAND_INJECTION,
_FILE_INCLUSION, _SSRF, _LOG4SHELL, _FILE_INCLUSION, _XXE_INJECTION, _SSRF, _LOG4SHELL,
_CRLF_INJECTION, _OPEN_REDIRECT, _CRLF_INJECTION, _OPEN_REDIRECT,
)), )),
re.IGNORECASE, re.IGNORECASE,