mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 13:59:40 +00:00

History

CyberMind-FR 4dd87eae2f fix(mitmproxy): ExecStartPost chmod raced socket creation -> wait+non-fatal (ref #624 )		2026-06-17 07:36:33 +02:00
..
addons	fix(waf): robust route propagation — dir bind-mount + addon live-reload (closes #609 )	2026-06-15 18:25:56 +02:00
api	feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498 )	2026-06-05 17:23:00 +02:00
bin	feat(mitmproxy): package self-healing WAF inspector watchdog (closes #624 )	2026-06-17 07:31:29 +02:00
crowdsec	feat(secubox-mitmproxy): Phase 7.A WAF→CrowdSec bridge — alerts push → nft drop (ref #498 )	2026-06-05 17:08:35 +02:00
data
debian	fix(mitmproxy): ExecStartPost chmod raced socket creation -> wait+non-fatal (ref #624 )	2026-06-17 07:36:33 +02:00
menu.d
nftables	feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498 )	2026-06-05 17:23:00 +02:00
nginx	feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498 )	2026-06-05 17:23:00 +02:00
sysctl	feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496 )	2026-06-06 07:17:29 +02:00
systemd	feat: Phase 6.P memory optimization — P3+P4+P5+P6 backported to sources (ref #496 )	2026-06-06 07:37:21 +02:00
tests
tmpfiles.d	feat(secubox-mitmproxy): Phase 6.O — kernel + memory + network perf tuning (ref #496 )	2026-06-06 07:17:29 +02:00
www/mitmproxy	feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498 )	2026-06-05 17:23:00 +02:00
README.md

README.md

🔍 MITM Proxy

Traffic inspection and WAF proxy with auto-ban

Category: Security

Screenshot

Features

Traffic inspection
Request logging
Auto-ban
SSL interception

Installation

# Add SecuBox repository
curl -fsSL https://apt.secubox.in/install.sh | sudo bash

# Install package
sudo apt install secubox-mitmproxy

Configuration

Configuration file: /etc/secubox/mitmproxy.toml

API Endpoints

GET /api/v1/mitmproxy/status - Module status
GET /api/v1/mitmproxy/health - Health check

Addons

`secubox_waf.py`

Inspects every HTTP response in transit, applies the SecuBox WAF ruleset and injects the health-banner + cookie-inventory bootstrap script before </body> on text/html responses. Domain allow/exclude lists configurable via [cdn].

`cookie_audit.py` (issue #156)

Companion to the WAF addon. Captures every Set-Cookie header observed in transit and appends a structured JSONL record to /var/log/secubox/cookie-audit/server.jsonl. Cookie values are sha256-hashed at the addon — the raw value never leaves the process.

mitmdump -s /usr/share/secubox/addons/secubox_waf.py \
         -s /usr/share/secubox/addons/cookie_audit.py

The companion browser script shared/cookie-inventory.js (loaded via the WAF banner injection) snapshots document.cookie and posts to /api/v1/cookie-audit/ingest. The secubox-metrics CookieAuditAggregator reconciles both streams and flags RGPD/ePrivacy violations (JS-set, non-strictly-necessary cookies).

Enable via [cookie_audit] enabled = true in /etc/secubox/secubox.conf.