Ataque de Password Spraying

from collections import defaultdict
from datetime import datetime, timedelta

def detect_password_spray(auth_logs, window_minutes=30, threshold=10):
    """Detect password spraying by identifying coordinated failed logins
    across multiple accounts within a time window."""
    
    # Group failed logins by time window
    windows = defaultdict(lambda: {
        'source_ips': set(),
        'target_accounts': set(),
        'failed_count': 0,
        'timestamps': []
    })
    
    for log in auth_logs:
        if log['status'] != 'failed':
            continue
        
        # Round timestamp to window
        window_key = log['timestamp'].replace(
            minute=(log['timestamp'].minute // window_minutes) * window_minutes,
            second=0, microsecond=0
        )
        
        w = windows[window_key]
        w['source_ips'].add(log['source_ip'])
        w['target_accounts'].add(log['username'])
        w['failed_count'] += 1
        w['timestamps'].append(log['timestamp'])
    
    alerts = []
    for window_start, data in windows.items():
        # Spray signature: many accounts, few IPs, concentrated time
        accounts_hit = len(data['target_accounts'])
        unique_ips = len(data['source_ips'])
        
        if accounts_hit >= threshold:
            # High ratio of targeted accounts to source IPs = spray
            spray_score = accounts_hit / max(unique_ips, 1)
            
            if spray_score >= 5:  # 5+ accounts per IP = likely spray
                alerts.append({
                    'type': 'password_spray_detected',
                    'severity': 'critical' if accounts_hit > 100 else 'high',
                    'window_start': window_start,
                    'accounts_targeted': accounts_hit,
                    'source_ips': list(data['source_ips']),
                    'total_failures': data['failed_count'],
                    'spray_score': round(spray_score, 1)
                })
    
    return alerts

import re
import hashlib
import requests
from datetime import datetime

class PasswordPolicyChecker:
    """Enterprise password policy with spray-resistant rules"""
    
    def __init__(self, company_name):
        self.company_name = company_name.lower()
        self.company_variants = self._generate_variants(company_name)
    
    def _generate_variants(self, name):
        """Generate common leetspeak and pattern variants"""
        base = name.lower()
        variants = {base}
        # Common substitutions
        subs = {'a': '@4', 'e': '3', 'i': '1!', 'o': '0', 's': '$5'}
        for char, replacements in subs.items():
            for r in replacements:
                variants.add(base.replace(char, r))
        return variants
    
    def check(self, password):
        """Returns (is_valid, rejection_reason)"""
        pw_lower = password.lower()
        
        # Block company name variants
        for variant in self.company_variants:
            if variant in pw_lower:
                return False, 'Password contains company name'
        
        # Block seasonal patterns
        seasons = ['spring', 'summer', 'autumn', 'fall', 'winter']
        current_year = datetime.now().year
        for season in seasons:
            for year in range(current_year - 2, current_year + 2):
                if f'{season}{year}' in pw_lower:
                    return False, 'Password contains predictable seasonal pattern'
        
        # Block common base passwords
        common_bases = [
            'password', 'welcome', 'qwerty', 'admin', 'changeme',
            'letmein', 'monkey', 'dragon', 'master', 'login'
        ]
        for base in common_bases:
            if base in pw_lower:
                return False, 'Password contains common word'
        
        # Block keyboard walks
        keyboard_walks = [
            'qwerty', 'qwer', 'asdf', 'zxcv', '1234', '4321',
            'qazwsx', 'qwertyui'
        ]
        for walk in keyboard_walks:
            if walk in pw_lower:
                return False, 'Password contains keyboard pattern'
        
        # Check HaveIBeenPwned (k-anonymity API)
        if self._check_hibp(password):
            return False, 'Password found in known data breaches'
        
        return True, None
    
    def _check_hibp(self, password):
        """Check password against HaveIBeenPwned using k-anonymity"""
        sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
        prefix, suffix = sha1[:5], sha1[5:]
        resp = requests.get(f'https://api.pwnedpasswords.com/range/{prefix}')
        return suffix in resp.text