mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-12 21:33:20 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,56 @@
|
||||
# API Reference: Implementing Cloud WAF Rules
|
||||
|
||||
## Libraries
|
||||
|
||||
### boto3 -- AWS WAFv2
|
||||
- **Install**: `pip install boto3`
|
||||
- **Docs**: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/wafv2.html
|
||||
|
||||
### Key Methods
|
||||
|
||||
| Method | Description |
|
||||
|--------|-------------|
|
||||
| `create_web_acl()` | Create a new Web ACL |
|
||||
| `update_web_acl()` | Add/modify rules in a Web ACL |
|
||||
| `get_web_acl()` | Retrieve Web ACL details and rules |
|
||||
| `list_web_acls()` | List all Web ACLs in scope |
|
||||
| `associate_web_acl()` | Attach ACL to ALB, API Gateway, CloudFront |
|
||||
| `get_sampled_requests()` | View sampled WAF request data |
|
||||
| `list_available_managed_rule_groups()` | List AWS managed rule sets |
|
||||
| `create_ip_set()` | Create IP allowlist/blocklist |
|
||||
| `create_regex_pattern_set()` | Custom regex matching patterns |
|
||||
|
||||
## AWS Managed Rule Groups
|
||||
|
||||
| Name | Protection |
|
||||
|------|-----------|
|
||||
| `AWSManagedRulesCommonRuleSet` | OWASP core (XSS, LFI, RFI) |
|
||||
| `AWSManagedRulesSQLiRuleSet` | SQL injection |
|
||||
| `AWSManagedRulesKnownBadInputsRuleSet` | Known exploit patterns |
|
||||
| `AWSManagedRulesLinuxRuleSet` | Linux LFI patterns |
|
||||
| `AWSManagedRulesBotControlRuleSet` | Bot detection/management |
|
||||
| `AWSManagedRulesATPRuleSet` | Account takeover prevention |
|
||||
| `AWSManagedRulesAnonymousIpList` | VPN/proxy/Tor blocking |
|
||||
|
||||
## Rule Statement Types
|
||||
- `ManagedRuleGroupStatement` -- AWS or marketplace managed rules
|
||||
- `RateBasedStatement` -- Rate limiting by IP (100-2B req/5min)
|
||||
- `GeoMatchStatement` -- Country-based blocking
|
||||
- `ByteMatchStatement` -- Custom string/header matching
|
||||
- `SqliMatchStatement` -- SQL injection detection
|
||||
- `XssMatchStatement` -- Cross-site scripting detection
|
||||
- `RegexPatternSetReferenceStatement` -- Custom regex rules
|
||||
- `IPSetReferenceStatement` -- IP allowlist/blocklist
|
||||
|
||||
## Rule Actions
|
||||
- `Allow` -- Permit the request
|
||||
- `Block` -- Reject with 403
|
||||
- `Count` -- Log only (for testing rules)
|
||||
- `CAPTCHA` -- Challenge with CAPTCHA
|
||||
- `Challenge` -- Silent browser challenge
|
||||
|
||||
## External References
|
||||
- AWS WAF Developer Guide: https://docs.aws.amazon.com/waf/latest/developerguide/
|
||||
- Managed Rules List: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html
|
||||
- Azure WAF: https://learn.microsoft.com/en-us/azure/web-application-firewall/
|
||||
- Cloudflare WAF: https://developers.cloudflare.com/waf/
|
||||
@@ -0,0 +1,210 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Cloud WAF rules management agent using AWS WAFv2 boto3 client."""
|
||||
|
||||
import json
|
||||
import sys
|
||||
import argparse
|
||||
from datetime import datetime
|
||||
|
||||
try:
|
||||
import boto3
|
||||
from botocore.exceptions import ClientError
|
||||
except ImportError:
|
||||
print("Install boto3: pip install boto3")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
MANAGED_RULE_GROUPS = [
|
||||
{"vendor": "AWS", "name": "AWSManagedRulesCommonRuleSet",
|
||||
"description": "OWASP Top 10 core protection"},
|
||||
{"vendor": "AWS", "name": "AWSManagedRulesSQLiRuleSet",
|
||||
"description": "SQL injection protection"},
|
||||
{"vendor": "AWS", "name": "AWSManagedRulesKnownBadInputsRuleSet",
|
||||
"description": "Known malicious input patterns"},
|
||||
{"vendor": "AWS", "name": "AWSManagedRulesLinuxRuleSet",
|
||||
"description": "Linux-specific LFI protection"},
|
||||
{"vendor": "AWS", "name": "AWSManagedRulesBotControlRuleSet",
|
||||
"description": "Bot management and detection"},
|
||||
{"vendor": "AWS", "name": "AWSManagedRulesATPRuleSet",
|
||||
"description": "Account takeover prevention"},
|
||||
]
|
||||
|
||||
|
||||
def get_waf_client(region="us-east-1", scope="REGIONAL"):
|
||||
"""Create WAFv2 client."""
|
||||
return boto3.client("wafv2", region_name=region)
|
||||
|
||||
|
||||
def create_web_acl(client, name, scope="REGIONAL", description=""):
|
||||
"""Create a new Web ACL with default block action."""
|
||||
try:
|
||||
resp = client.create_web_acl(
|
||||
Name=name, Scope=scope,
|
||||
DefaultAction={"Allow": {}},
|
||||
Description=description or f"WAF ACL managed by agent - {name}",
|
||||
VisibilityConfig={
|
||||
"SampledRequestsEnabled": True, "CloudWatchMetricsEnabled": True,
|
||||
"MetricName": name.replace("-", "")},
|
||||
Rules=[])
|
||||
return {"arn": resp["Summary"]["ARN"], "id": resp["Summary"]["Id"],
|
||||
"status": "created"}
|
||||
except ClientError as e:
|
||||
return {"error": str(e)}
|
||||
|
||||
|
||||
def add_managed_rule_group(client, acl_name, acl_id, lock_token, scope,
|
||||
vendor, rule_group_name, priority):
|
||||
"""Add a managed rule group to an existing Web ACL."""
|
||||
try:
|
||||
acl = client.get_web_acl(Name=acl_name, Scope=scope, Id=acl_id)
|
||||
rules = acl["WebACL"]["Rules"]
|
||||
lock_token = acl["LockToken"]
|
||||
rules.append({
|
||||
"Name": rule_group_name,
|
||||
"Priority": priority,
|
||||
"Statement": {
|
||||
"ManagedRuleGroupStatement": {"VendorName": vendor, "Name": rule_group_name}},
|
||||
"OverrideAction": {"None": {}},
|
||||
"VisibilityConfig": {
|
||||
"SampledRequestsEnabled": True, "CloudWatchMetricsEnabled": True,
|
||||
"MetricName": rule_group_name}})
|
||||
client.update_web_acl(
|
||||
Name=acl_name, Scope=scope, Id=acl_id, LockToken=lock_token,
|
||||
DefaultAction={"Allow": {}}, Rules=rules,
|
||||
VisibilityConfig=acl["WebACL"]["VisibilityConfig"])
|
||||
return {"rule_group": rule_group_name, "status": "added", "priority": priority}
|
||||
except ClientError as e:
|
||||
return {"rule_group": rule_group_name, "error": str(e)}
|
||||
|
||||
|
||||
def create_rate_limit_rule(client, acl_name, acl_id, scope, limit=2000, priority=1):
|
||||
"""Create a rate-limiting rule for DDoS/brute-force protection."""
|
||||
try:
|
||||
acl = client.get_web_acl(Name=acl_name, Scope=scope, Id=acl_id)
|
||||
rules = acl["WebACL"]["Rules"]
|
||||
lock_token = acl["LockToken"]
|
||||
rules.append({
|
||||
"Name": "RateLimitRule",
|
||||
"Priority": priority,
|
||||
"Statement": {"RateBasedStatement": {"Limit": limit, "AggregateKeyType": "IP"}},
|
||||
"Action": {"Block": {}},
|
||||
"VisibilityConfig": {
|
||||
"SampledRequestsEnabled": True, "CloudWatchMetricsEnabled": True,
|
||||
"MetricName": "RateLimitRule"}})
|
||||
client.update_web_acl(
|
||||
Name=acl_name, Scope=scope, Id=acl_id, LockToken=lock_token,
|
||||
DefaultAction={"Allow": {}}, Rules=rules,
|
||||
VisibilityConfig=acl["WebACL"]["VisibilityConfig"])
|
||||
return {"rule": "RateLimitRule", "limit": limit, "status": "created"}
|
||||
except ClientError as e:
|
||||
return {"error": str(e)}
|
||||
|
||||
|
||||
def create_geo_block_rule(client, acl_name, acl_id, scope, country_codes, priority=2):
|
||||
"""Create a geo-blocking rule for specified country codes."""
|
||||
try:
|
||||
acl = client.get_web_acl(Name=acl_name, Scope=scope, Id=acl_id)
|
||||
rules = acl["WebACL"]["Rules"]
|
||||
lock_token = acl["LockToken"]
|
||||
rules.append({
|
||||
"Name": "GeoBlockRule",
|
||||
"Priority": priority,
|
||||
"Statement": {"GeoMatchStatement": {"CountryCodes": country_codes}},
|
||||
"Action": {"Block": {}},
|
||||
"VisibilityConfig": {
|
||||
"SampledRequestsEnabled": True, "CloudWatchMetricsEnabled": True,
|
||||
"MetricName": "GeoBlockRule"}})
|
||||
client.update_web_acl(
|
||||
Name=acl_name, Scope=scope, Id=acl_id, LockToken=lock_token,
|
||||
DefaultAction={"Allow": {}}, Rules=rules,
|
||||
VisibilityConfig=acl["WebACL"]["VisibilityConfig"])
|
||||
return {"rule": "GeoBlockRule", "countries": country_codes, "status": "created"}
|
||||
except ClientError as e:
|
||||
return {"error": str(e)}
|
||||
|
||||
|
||||
def list_web_acls(client, scope="REGIONAL"):
|
||||
"""List all Web ACLs."""
|
||||
try:
|
||||
resp = client.list_web_acls(Scope=scope)
|
||||
return [{"name": acl["Name"], "id": acl["Id"], "arn": acl["ARN"]}
|
||||
for acl in resp.get("WebACLs", [])]
|
||||
except ClientError as e:
|
||||
return [{"error": str(e)}]
|
||||
|
||||
|
||||
def get_sampled_requests(client, acl_arn, rule_metric, scope="REGIONAL", max_items=100):
|
||||
"""Get sampled requests for WAF rule analysis."""
|
||||
try:
|
||||
resp = client.get_sampled_requests(
|
||||
WebAclArn=acl_arn, RuleMetricName=rule_metric, Scope=scope,
|
||||
TimeWindow={"StartTime": datetime.utcnow().replace(hour=0, minute=0),
|
||||
"EndTime": datetime.utcnow()},
|
||||
MaxItems=max_items)
|
||||
return [{"action": r["Action"], "uri": r["Request"]["URI"],
|
||||
"method": r["Request"]["Method"],
|
||||
"country": r["Request"].get("Country", ""),
|
||||
"source_ip": r["Request"]["ClientIP"]}
|
||||
for r in resp.get("SampledRequests", [])]
|
||||
except ClientError as e:
|
||||
return [{"error": str(e)}]
|
||||
|
||||
|
||||
def run_waf_audit(region="us-east-1", scope="REGIONAL"):
|
||||
"""Run WAF configuration audit."""
|
||||
client = get_waf_client(region, scope)
|
||||
|
||||
print(f"\n{'='*60}")
|
||||
print(f" AWS WAF CONFIGURATION AUDIT")
|
||||
print(f" Region: {region} | Scope: {scope}")
|
||||
print(f" Generated: {datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S')} UTC")
|
||||
print(f"{'='*60}\n")
|
||||
|
||||
acls = list_web_acls(client, scope)
|
||||
print(f"--- WEB ACLs ({len(acls)}) ---")
|
||||
for acl in acls:
|
||||
if "error" in acl:
|
||||
print(f" Error: {acl['error']}")
|
||||
continue
|
||||
print(f" {acl['name']} ({acl['id']})")
|
||||
try:
|
||||
detail = client.get_web_acl(Name=acl["name"], Scope=scope, Id=acl["id"])
|
||||
rules = detail["WebACL"]["Rules"]
|
||||
print(f" Rules: {len(rules)}")
|
||||
for r in rules:
|
||||
print(f" [{r['Priority']}] {r['Name']}")
|
||||
except ClientError:
|
||||
pass
|
||||
|
||||
print(f"\n--- AVAILABLE MANAGED RULE GROUPS ---")
|
||||
for mrg in MANAGED_RULE_GROUPS:
|
||||
print(f" {mrg['name']}: {mrg['description']}")
|
||||
|
||||
print(f"\n{'='*60}\n")
|
||||
return {"acls": acls}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Cloud WAF Rules Agent")
|
||||
parser.add_argument("--region", default="us-east-1")
|
||||
parser.add_argument("--scope", default="REGIONAL", choices=["REGIONAL", "CLOUDFRONT"])
|
||||
parser.add_argument("--audit", action="store_true", help="Audit WAF configuration")
|
||||
parser.add_argument("--create-acl", help="Create new Web ACL with given name")
|
||||
parser.add_argument("--output", help="Save report to JSON")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.audit:
|
||||
report = run_waf_audit(args.region, args.scope)
|
||||
if args.output:
|
||||
with open(args.output, "w") as f:
|
||||
json.dump(report, f, indent=2, default=str)
|
||||
elif args.create_acl:
|
||||
client = get_waf_client(args.region, args.scope)
|
||||
result = create_web_acl(client, args.create_acl, args.scope)
|
||||
print(json.dumps(result, indent=2))
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user