mirror of
https://github.com/smittix/intercept.git
synced 2026-04-24 22:59:59 -07:00
8d9e5f9d56
Security improvements: - Add interface name validation to prevent command injection - Fix XSS vulnerability in pager message display - Add security headers (X-Content-Type-Options, X-Frame-Options, etc.) - Disable Werkzeug debug PIN - Add security documentation Features: - Add bias-t power support for SDR dongles across all modes Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
90 lines
3.4 KiB
Markdown
90 lines
3.4 KiB
Markdown
# Security Considerations
|
|
|
|
INTERCEPT is designed as a **local signal intelligence tool** for personal use on trusted networks. This document outlines security considerations and best practices.
|
|
|
|
## Network Binding
|
|
|
|
By default, INTERCEPT binds to `0.0.0.0:5050`, making it accessible from any network interface. This is convenient for accessing the web UI from other devices on your local network, but has security implications:
|
|
|
|
### Recommendations
|
|
|
|
1. **Firewall Rules**: If you don't need remote access, configure your firewall to block external access to port 5050:
|
|
```bash
|
|
# Linux (iptables)
|
|
sudo iptables -A INPUT -p tcp --dport 5050 -s 127.0.0.1 -j ACCEPT
|
|
sudo iptables -A INPUT -p tcp --dport 5050 -j DROP
|
|
|
|
# macOS (pf)
|
|
echo "block in on en0 proto tcp from any to any port 5050" | sudo pfctl -ef -
|
|
```
|
|
|
|
2. **Bind to Localhost**: For local-only access, set the host environment variable:
|
|
```bash
|
|
export INTERCEPT_HOST=127.0.0.1
|
|
python intercept.py
|
|
```
|
|
|
|
3. **Trusted Networks Only**: Only run INTERCEPT on networks you trust. The application has no authentication mechanism.
|
|
|
|
## Authentication
|
|
|
|
INTERCEPT does **not** include authentication. This is by design for ease of use as a personal tool. If you need to expose INTERCEPT to untrusted networks:
|
|
|
|
1. Use a reverse proxy (nginx, Caddy) with authentication
|
|
2. Use a VPN to access your home network
|
|
3. Use SSH port forwarding: `ssh -L 5050:localhost:5050 your-server`
|
|
|
|
## Security Headers
|
|
|
|
INTERCEPT includes the following security headers on all responses:
|
|
|
|
| Header | Value | Purpose |
|
|
|--------|-------|---------|
|
|
| `X-Content-Type-Options` | `nosniff` | Prevent MIME type sniffing |
|
|
| `X-Frame-Options` | `SAMEORIGIN` | Prevent clickjacking |
|
|
| `X-XSS-Protection` | `1; mode=block` | Enable browser XSS filter |
|
|
| `Referrer-Policy` | `strict-origin-when-cross-origin` | Control referrer information |
|
|
| `Permissions-Policy` | `geolocation=(self), microphone=()` | Restrict browser features |
|
|
|
|
## Input Validation
|
|
|
|
All user inputs are validated before use:
|
|
|
|
- **Network interface names**: Validated against strict regex pattern
|
|
- **Bluetooth interface names**: Must match `hciX` format
|
|
- **MAC addresses**: Validated format
|
|
- **Frequencies**: Validated range and format
|
|
- **File paths**: Protected against directory traversal
|
|
- **HTML output**: All user-provided content is escaped
|
|
|
|
## Subprocess Execution
|
|
|
|
INTERCEPT executes external tools (rtl_fm, airodump-ng, etc.) via subprocess. Security measures:
|
|
|
|
- **No shell execution**: All subprocess calls use list arguments, not shell strings
|
|
- **Input validation**: All user-provided arguments are validated before use
|
|
- **Process isolation**: Each tool runs in its own process with limited permissions
|
|
|
|
## Debug Mode
|
|
|
|
Debug mode is **disabled by default**. If enabled via `INTERCEPT_DEBUG=true`:
|
|
|
|
- The Werkzeug debugger PIN is disabled (not needed for local tool)
|
|
- Additional logging is enabled
|
|
- Stack traces are shown on errors
|
|
|
|
**Never run in debug mode on untrusted networks.**
|
|
|
|
## Reporting Security Issues
|
|
|
|
If you discover a security vulnerability, please report it by:
|
|
|
|
1. Opening a GitHub issue (for non-sensitive issues)
|
|
2. Emailing the maintainer directly (for sensitive issues)
|
|
|
|
Please include:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (if any)
|