Files

Hubert Cornet ed4c37af89 Upload files to "cybersecurity/Network Reputation Service"

2025-09-04 13:26:42 +02:00

8.0 KiB

Raw Permalink Blame History

🛡️ Firewall Audit - Network Reputation Service

A professional PowerShell audit tool to evaluate your firewall's filtering effectiveness by testing categorized URLs based on their network reputation.

🎯 Overview

This PowerShell script tests your firewall's effectiveness by verifying that malicious URLs are correctly blocked while legitimate sites remain accessible. It generates a professional HTML report with scoring, statistics, and recommendations.

Author: Hubert Cornet
Version: 1.3
Date: September 3, 2025

✨ Features

🔍 Automated testing of hundreds of categorized URLs
📊 Smart scoring with grades from A+ to F
📱 Responsive HTML report with interactive interface
🔧 Proxy support with authentication
⚡ Real-time progress bars
🎨 Color-coded visualizations of results
💾 JSON export of raw data
🌐 Multi-method detection of blocks

📋 Prerequisites

System Requirements

Windows 10/11 or Windows Server 2016+
PowerShell 5.1 or higher
Active Internet connection
Write permissions in the script directory

PowerShell Modules (installed automatically)

PSWriteHTML
PSWriteColor

Required Files

file-nrs.json - Categorized URLs database

🚀 Installation

Download the script to a dedicated folder

Download the JSON file from:

https://gitea.tips-of-mine.com/Tips-Of-Mine/Powershell/src/branch/main/cybersecurity/Network%20Reputation%20Service/file-nrs.json

Place both files in the same directory

💻 Usage

Basic Usage

.\AuditFirewall.ps1

With Proxy

.\AuditFirewall.ps1 -ProxyUrl "http://proxy.company.com:8080"

With Proxy Authentication

.\AuditFirewall.ps1 -ProxyUrl "http://proxy.company.com:8080" -ProxyUseAuthentication

With Custom Timeout

.\AuditFirewall.ps1 -TimeoutSeconds 15

⚙️ Configuration

Available Parameters

Parameter	Type	Description	Default
`ProxyUrl`	String	Network proxy URL	None
`ProxyUseAuthentication`	Switch	Enable proxy auth	False
`TimeoutSeconds`	Integer	Timeout per URL	10

Customizing Block Keywords

Modify the $BlockKeywords variable in the script:

$BlockKeywords = @("site blocked", "access denied", "web filtering", "Access Denied", "Site Blocked")

📊 Generated Report

The script automatically generates:

📁 Output File Structure

Reports/
└── [Date and Time]/
    ├── Audit_Firewall_Report.html    # Main report
    └── Results.json                   # Raw data

🎨 HTML Report Content

Executive Summary: Global score and key statistics
Score Table: Performance by category
Interactive Details: Individual tests by URL
Grading Scale: Scoring system explanation

📁 Data Structure

`file-nrs.json` Format

{
  "categorie": [
    {
      "id": "malware",
      "nom": "Malware",
      "description": "Sites distributing malicious software",
      "urls": [
        {
          "url": "http://example-malware.com",
          "reputation": "malicious",
          "expected_action": "block"
        },
        {
          "url": "https://legitimate-site.com",
          "reputation": "safe",
          "expected_action": "allow"
        }
      ]
    }
  ]
}

Expected Actions

"block": URL should be blocked by firewall
"allow": URL should remain accessible

📈 Scoring System

Grading Scale

Grade	Score	Interpretation
A+	95-100%	🟢 Excellent / Perfect
A	90-95%	🟢 Very good filtering level
B+	85-90%	🟡 Very good
B	80-85%	🟡 Good, some adjustments needed
C+	75-80%	🟠 Fairly good
C	70-75%	🟠 Average, significant gaps
D+	65-70%	🔴 Acceptable
D	60-65%	🔴 Weak, ineffective filtering
E+	55-60%	🔴 Very weak
E	50-55%	🔴 Insufficient
F+	45-50%	⚫ Critical
F	0-45%	⚫ Immediate action required

Calculation Method

Score = (Correctly filtered URLs / Total tested URLs) × 100

🔍 Detection Methods

How the script detects blocks:

Content Analysis: Search for block page keywords
Network Timeouts: Requests that expire (probable firewall block)
Connection Errors: Unable to reach the server
HTTP Status Codes: Analysis of server responses

Simulated HTTP Headers:

The script simulates a modern browser to avoid detection:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...
Accept: text/html,application/xhtml+xml,application/xml...
Accept-Language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7

🔧 Troubleshooting

Common Issues

❌ "File 'file-nrs.json' does not exist!"

Solution: Download the JSON file from the provided link and place it in the same folder as the script.

❌ "Cannot install module X"

Solution: Run PowerShell as administrator or use:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

❌ Frequent Timeouts

Solutions:

Increase -TimeoutSeconds value
Check your network connection
Configure proxy settings correctly

❌ False Positives/Negatives