N.A.D.S. — Normalized Attack Detection System. An HTTP normalization library and Squid ACL helper, from back before projects like this had a natural home on GitHub. Kept here, unchanged, so old links still work.
What it does
NADS normalizes HTTP requests so that IDS/IPS pattern matching and Squid access-control decisions see the same URL a target webserver would actually resolve — closing the evasion tricks that rely on a normalizer and an origin server disagreeing about what a URL means. It supports different normalization levels for different webserver emulation types; out of the box that's Apache and IIS, mapped per host/port pair, with a configurable default for anything unmapped.
There are two programs: nads, the
Squid external ACL helper, and testnads,
which just takes URLs on the command line and prints their
normalized form.
Squid integration
Configure Squid to shell out to the helper:
external_acl_type nads %PROTO %SRC %DST %PORT %METHOD %PATH /usr/bin/nads
acl nads external nads
http_access deny nads
The helper reads one request per line on stdin in that same field order, e.g.:
http 192.168.0.107 www.scaramanga.co.uk 80 GET /firestorm/index.html
Downloads
nads-0.3.tar.gz — hacker documentation, safer handling of user input, nicer testnads output.
nads-0.2.tar.gz — added the Squid ACL helper and webserver emulation mapping.
nads-0.1.tar.gz — first release.
License
GNU GPL v2. Copyright © 2003 ECSC Ltd. Author: Gianni Tedesco.