mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 11:12:29 +00:00
CyberMind-FR
e67baf4cd7
Phase 2b (#488/#489) wired mitm addons to 5 receiving modules but events
were persisted raw. This phase implements actual enrichment in each module
via the enrich_hook param, plus aggregator merge so reports show meaningful
data (YouTube/Signal/iPhone/Safari/JA4 fingerprints) instead of raw bytes.
- host_app.py : 60+ host patterns -> app + category + emoji
- cookie.py : 40+ cookie tracker patterns -> provider + category + emoji
- avatar.py : UA + Client Hints -> device + browser + OS + emoji
- ja4.py : NEW. Deterministic JA4-style fingerprint hash from
cipher_suites + alpn + extensions. Lookup table for
known JA4 fingerprints (empty for now, Phase 3 will
populate). 12-char hex (SHA256 truncated).
The host_app/cookie/avatar are copies of the secubox-toolbox classifiers
moved to secubox-core so all 5 receiving modules can import them. The
secubox-toolbox-local ones stay as-is to avoid breaking changes — Phase 3
will consolidate.
- secubox-dpi : host/SNI -> {app, category, emoji}
- secubox-cookies : cookie names -> {providers{}, categories{}}
- secubox-avatar : UA + CH -> {device, browser, os_label}
- secubox-threat-analyst : ClientHello -> {ja4_fingerprint, known_client}
- secubox-soc : indicators -> {total_weight, band, kinds}
Each is ~25 lines, called by mount_ingest_routes BEFORE persistence.
Enriched output joins the raw event under the 'enriched' key.
_pull_mitm_module_events() now also calls _summarize_enriched(kind, events)
to consolidate per-module enrichment :
- dpi : top_apps[] aggregated from enriched.app counts
- cookies : top_providers[] from enriched.providers + tracker_total
- avatar : devices{} + browsers{} from enriched.{device,browser}
- threat-analyst : top_fingerprints[] grouped by JA4 hash
- soc : total_weight + max_band + indicator_kinds
These appear under mitm_modules.<kind>.enriched_summary in the /report JSON.
POST realistic payloads to all 5 sockets :
- YouTube host -> dpi/enriched.app = 'YouTube' (streaming)
- GA + FB Pixel cookies -> cookies/providers : GA x3, FB x1, total 4
- iPhone Safari UA -> avatar/device='iPhone' (📱 iOS 17.4) + Safari (🧭)
- facebook.com ClientHello -> threat-analyst/ja4 = '7175ee3a68f0'
- 2 indicators (weight 15+25) -> soc/band='medium', total=40, kinds=[dga, suspicious]
- secubox-dpi : call live nDPI/netifyd socket (currently pattern-match only)
- secubox-threat-analyst : implement full FoxIO JA4 string format (currently
deterministic SHA256 trunc which is JA4-like but not the canonical format)
- secubox-soc : threat-intel feed lookup (currently just sums static weights)
- secubox-avatar : screen/timing fingerprinting via WebGL hash (currently UA only)
- Reports (PDF + HTML) : surface mitm_modules.enriched_summary in the report UI
|
||
|---|---|---|
| .. | ||
| apparmor | ||
| audit | ||
| nginx | ||
| secubox_core | ||