mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
79 lines
2.1 KiB
Markdown
79 lines
2.1 KiB
Markdown
# Domain Fronting C2 Traffic Detection API Reference
|
|
|
|
## Domain Fronting Mechanism
|
|
|
|
```
|
|
TLS ClientHello: SNI = legitimate-cdn-domain.cloudfront.net
|
|
HTTP Request: Host: attacker-c2-server.evil.com
|
|
```
|
|
|
|
The CDN accepts the TLS connection based on SNI, then routes the HTTP request
|
|
to the backend specified in the Host header. Network monitoring sees only the
|
|
legitimate SNI domain.
|
|
|
|
## MITRE ATT&CK
|
|
|
|
| Technique | ID | Description |
|
|
|---|---|---|
|
|
| Proxy: Domain Fronting | T1090.004 | Route C2 through CDN using SNI/Host mismatch |
|
|
|
|
## CDN Provider Identification
|
|
|
|
### Certificate Issuers
|
|
| CDN | Certificate CN Pattern |
|
|
|---|---|
|
|
| CloudFront | *.cloudfront.net |
|
|
| Azure CDN | *.azureedge.net |
|
|
| Cloudflare | sni.cloudflaressl.com |
|
|
| Akamai | *.akamaiedge.net |
|
|
| Fastly | *.fastly.net |
|
|
|
|
## Proxy Log Detection
|
|
|
|
### Squid Proxy Log Fields
|
|
```
|
|
timestamp src_ip CONNECT sni:443 -> status Host: host_header
|
|
```
|
|
|
|
### Palo Alto Threat ID
|
|
```
|
|
Threat ID 86467: Domain fronting detected (SNI/Host mismatch)
|
|
```
|
|
|
|
### Splunk Detection Query
|
|
```spl
|
|
index=proxy sourcetype=squid OR sourcetype=bluecoat
|
|
| eval sni_root=mvindex(split(sni, "."), -2) + "." + mvindex(split(sni, "."), -1)
|
|
| eval host_root=mvindex(split(host_header, "."), -2) + "." + mvindex(split(host_header, "."), -1)
|
|
| where sni_root != host_root
|
|
| stats count by sni, host_header, src_ip
|
|
| sort -count
|
|
```
|
|
|
|
## pyOpenSSL Certificate Inspection
|
|
|
|
```python
|
|
from OpenSSL import crypto
|
|
import ssl, socket
|
|
|
|
ctx = ssl.create_default_context()
|
|
with ctx.wrap_socket(socket.socket(), server_hostname=hostname) as s:
|
|
s.connect((hostname, 443))
|
|
der_cert = s.getpeercert(True)
|
|
|
|
x509 = crypto.load_certificate(crypto.FILETYPE_ASN1, der_cert)
|
|
subject_cn = x509.get_subject().CN
|
|
issuer_cn = x509.get_issuer().CN
|
|
|
|
for i in range(x509.get_extension_count()):
|
|
ext = x509.get_extension(i)
|
|
if ext.get_short_name() == b"subjectAltName":
|
|
print(str(ext)) # DNS:*.cloudfront.net, DNS:cloudfront.net
|
|
```
|
|
|
|
## CLI Usage
|
|
```bash
|
|
python agent.py --proxy-log squid_access.csv --output fronting_report.json
|
|
python agent.py --proxy-log logs.csv --check-certs
|
|
```
|