0xacab.org/kali/nowin
Let's say you need to leave certain machines out of your http server. Passive fingerprinting to the rescue!
This example uses nginx sub-requests for authorization on a particular location. It could be ported to apache, but I don't know how.
Location /nowin is the selective authorization. It delegates the request to
/auth, which is a proxy-pass to a local-only, not exposed service that we'll
be running.
location /nowin {
auth_request /auth;
auth_request_set $auth_status $upstream_status;
error_page 403 /403.html;
}
location /auth {
internal;
proxy_pass http://localhost:8000;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI $request_uri;
proxy_set_header X-Forwarded-For $remote_addr;
}
A nice detail is to specify a custom 403 template, like this one:
<html>
<head><title>403 Forbidden for windows</title></head>
<body>
<center><h1>403 Forbidden for windows</h1></center>
<center>please upgrade your client</center>
<hr><center>nginx/1.18.0 (Ubuntu)</center>
</body>
</html>
I'm using a fork that attempted to modernize a bit the original from Zalewski:
sudo apt install libcap-ng-dev
git clone https://github.com/eteran/libp0f
cd libp0f
mkdir build && cd build
cmake .. && make
We have to pass the interface (if not the default) and the path to the unix socket where our service will connect:
❯ sudo ./p0f -i wlp0s20f3 -s /var/run/p0f.socket
--- p0f 3.09b by Michal Zalewski <lcamtuf@coredump.cx> ---
[+] Closed 1 file descriptor.
[+] Loaded 322 signatures from 'p0f.fp'.
[+] Intercepting traffic on interface 'wlp0s20f3'.
[#] Computed rule: tcp or (vlan and tcp)
[+] Default packet filtering configured [+VLAN].
[+] Listening on API socket '/var/run/p0f.socket' (max 20 clients).
[+] Entered main event loop.
Compile and run the go module in this repo. Runs on port 8000 by default. The service will query p0f's in memory database via the binary API over the unix domain socket: If the info p0f has gathered tells us that this IP is identified as windows (and the user-agent is not set to the magic string), a 403 will be returned.
go build && ./nowin
make build
make install-service
make run-service
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.