CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

test_private_boundary.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Harmless path checks against the local tunnel to the decoy; no payload execution."""
+import argparse
+import http.client
+import ipaddress
+import urllib.parse
+
+PATHS = (
+    '/reports', '/reports/', '/admin', '/admin/', '/dashboard', '/evidence', '/evidence/',
+    '/logs', '/logs/', '/logs/events.jsonl', '/events.jsonl', '/artifacts/',
+    '/artifacts/' + '0' * 64 + '.bin', '/http/events.jsonl', '/network/events.jsonl',
+    '/var/lib/decoy/http/events.jsonl', '/var/lib/decoy/network/events.jsonl',
+    '/opt/decoy/honeypot.py', '/honeypot.py', '/evidence.py', '/vm_backend.py', '/guest.py',
+    '/network_capture.py', '/ui/sources.json', '/README.md',
+    '/../var/lib/decoy/http/events.jsonl', '/../../var/lib/decoy/http/events.jsonl',
+    '/%2e%2e/%2e%2e/var/lib/decoy/http/events.jsonl',
+    '/%2e%2e%2f%2e%2e%2fvar%2flib%2fdecoy%2fhttp%2fevents.jsonl',
+    '/%252e%252e%252fvar%252flib%252fdecoy%252fhttp%252fevents.jsonl',
+    '/..%5c..%5cvar%5clib%5cdecoy%5chttp%5cevents.jsonl',
+    '//var/lib/decoy/http/events.jsonl', '/logs/../events.jsonl', '/logs%00/events.jsonl',
+)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--url', required=True, help='HTTP loopback tunnel URL')
+    args = parser.parse_args()
+    url = urllib.parse.urlsplit(args.url)
+    if url.scheme != 'http' or url.username or url.password or url.query or url.fragment:
+        parser.error('use an HTTP loopback tunnel URL without credentials or query')
+    try:
+        loopback = ipaddress.ip_address(url.hostname).is_loopback
+    except ValueError:
+        loopback = url.hostname == 'localhost'
+    if not loopback or url.path not in ('', '/'):
+        parser.error('test is restricted to the loopback tunnel root')
+    def request(path):
+        conn = http.client.HTTPConnection(url.hostname, url.port or 80, timeout=25)
+        try:
+            conn.request('GET', path)
+            response = conn.getresponse()
+            body = response.read(131073)
+            assert len(body) <= 131072, 'unexpected large response for ' + path
+            return response.status, body
+        finally:
+            conn.close()
+    status, body = request('/')
+    assert status == 200 and b'<html' in body.lower(), 'decoy UI unavailable'
+    for path in PATHS:
+        status, body = request(path)
+        assert status == 404, f'private path returned {status}: {path}'
+        assert body == b'Not Found', 'unexpected content at private path: ' + path
+    print(f'PASS: NetScaler UI available; {len(PATHS)} private/report/evidence/source/traversal paths return plain404')
+
+
+if __name__ == '__main__':
+    main()