e2bc4a47cd
- 🔥 Brute Force & Credential Stuffing (view_form_bruteforce_detected) - 🧬 TCP/OS Spoofing (view_tcp_spoofing_detected, 86K détections) - 📡 Header Fingerprint Clustering (agg_header_fingerprint_1h, 1374 clusters) - ⏱️ Heatmap Temporelle (agg_host_ip_ja4_1h, pic à 20h) - 🌍 Botnets Distribués / JA4 spread (view_host_ja4_anomalies) - 🔄 Rotation JA4 & Persistance (view_host_ip_ja4_rotation + view_ip_recurrence) - 🤖 Features ML / Radar (view_ai_features_1h, radar SVG + scatter plot) Backend: 7 nouveaux router FastAPI avec requêtes ClickHouse optimisées Frontend: 7 nouveaux composants React + navigation 'Analyse Avancée' dans la sidebar Fixes: alias fuzzing_index → max_fuzzing (ORDER BY ClickHouse), normalisation IPs ::ffff: Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
108 lines
3.6 KiB
Python
108 lines
3.6 KiB
Python
"""
|
|
Endpoints pour l'analyse des attaques par force brute sur les formulaires
|
|
"""
|
|
from fastapi import APIRouter, HTTPException, Query
|
|
|
|
from ..database import db
|
|
|
|
router = APIRouter(prefix="/api/bruteforce", tags=["bruteforce"])
|
|
|
|
|
|
@router.get("/targets")
|
|
async def get_bruteforce_targets():
|
|
"""Liste des hôtes ciblés par brute-force, triés par total_hits DESC."""
|
|
try:
|
|
sql = """
|
|
SELECT
|
|
host,
|
|
uniq(src_ip) AS unique_ips,
|
|
sum(hits) AS total_hits,
|
|
sum(query_params_count) AS total_params,
|
|
groupArray(3)(ja4) AS top_ja4s
|
|
FROM mabase_prod.view_form_bruteforce_detected
|
|
GROUP BY host
|
|
ORDER BY total_hits DESC
|
|
"""
|
|
result = db.query(sql)
|
|
items = []
|
|
for row in result.result_rows:
|
|
host = str(row[0])
|
|
unique_ips = int(row[1])
|
|
total_hits = int(row[2])
|
|
total_params= int(row[3])
|
|
top_ja4s = [str(j) for j in (row[4] or [])]
|
|
attack_type = (
|
|
"credential_stuffing"
|
|
if total_hits > 0 and total_params / total_hits > 0.5
|
|
else "enumeration"
|
|
)
|
|
items.append({
|
|
"host": host,
|
|
"unique_ips": unique_ips,
|
|
"total_hits": total_hits,
|
|
"total_params":total_params,
|
|
"attack_type": attack_type,
|
|
"top_ja4s": top_ja4s,
|
|
})
|
|
return {"items": items, "total": len(items)}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|
|
|
|
|
|
@router.get("/attackers")
|
|
async def get_bruteforce_attackers(limit: int = Query(50, ge=1, le=500)):
|
|
"""Top IPs attaquantes triées par total_hits DESC."""
|
|
try:
|
|
sql = """
|
|
SELECT
|
|
src_ip AS ip,
|
|
uniq(host) AS distinct_hosts,
|
|
sum(hits) AS total_hits,
|
|
sum(query_params_count) AS total_params,
|
|
argMax(ja4, hits) AS ja4
|
|
FROM mabase_prod.view_form_bruteforce_detected
|
|
GROUP BY src_ip
|
|
ORDER BY total_hits DESC
|
|
LIMIT %(limit)s
|
|
"""
|
|
result = db.query(sql, {"limit": limit})
|
|
items = []
|
|
for row in result.result_rows:
|
|
items.append({
|
|
"ip": str(row[0]),
|
|
"distinct_hosts":int(row[1]),
|
|
"total_hits": int(row[2]),
|
|
"total_params": int(row[3]),
|
|
"ja4": str(row[4]),
|
|
})
|
|
return {"items": items, "total": len(items)}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|
|
|
|
|
|
@router.get("/timeline")
|
|
async def get_bruteforce_timeline():
|
|
"""Hits par heure (dernières 72h) depuis agg_host_ip_ja4_1h."""
|
|
try:
|
|
sql = """
|
|
SELECT
|
|
toHour(window_start) AS hour,
|
|
sum(hits) AS hits,
|
|
uniq(replaceRegexpAll(toString(src_ip), '^::ffff:', '')) AS ips
|
|
FROM mabase_prod.agg_host_ip_ja4_1h
|
|
WHERE window_start >= now() - INTERVAL 72 HOUR
|
|
GROUP BY hour
|
|
ORDER BY hour ASC
|
|
"""
|
|
result = db.query(sql)
|
|
hours = []
|
|
for row in result.result_rows:
|
|
hours.append({
|
|
"hour": int(row[0]),
|
|
"hits": int(row[1]),
|
|
"ips": int(row[2]),
|
|
})
|
|
return {"hours": hours}
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=str(e))
|