Red Team Consultant @ Google | MS in Cybersecurity @ NYU
● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
repos / contraband
PUBLIC MIRRORGo v1.0

Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.

$ git clone https://shehzade.io/repos/contraband.git Copy
Source ZIP (1.93 MB)
Code 174 Commits 1
contraband / docs / wiki / Synthetic-DLP-Verification.md
← Back to directory
3.6 KB
Raw

Synthetic DLP Verification Reference

Contraband includes an in-memory procedural generation engine that constructs mathematically valid test records. These records match standard DLP, CASB, and firewall signatures without exposing real customer or enterprise data.

1. Supported Secret Categories (--dlp)

Category Flag Synthetic Structure & Validation
PCI-DSS --dlp pci 16-digit Visa (prefix 4), Mastercard (prefixes 51-55), and 15-digit Amex (34, 37). Strictly validates against the Luhn Mod-10 algorithm. Generated with realistic MM/YY expiration dates and CVVs.
PII --dlp pii US SSN: 9-digit format (AAA-GG-SSSS) excluding reserved area numbers (000, 666, 900-999).
UK NINO: HMRC format (^[A-CEGHJ-PR-TW-Z]{2}[0-9]{6}[A-D]$).
Canadian SIN: 9-digit format with regional leading digits passing Luhn Mod-10.
Healthcare --dlp hipaa HL7 v2.5.1: Pipe-and-hat delimited messages (MSH, PID, PV1, DG1).
FHIR JSON: Patient, Condition, and Observation resources referencing authentic ICD-10-CM diagnosis codes (e.g. E11.9, I10).
API Keys --dlp secrets AWS Access Keys: 20-character IDs starting with AKIA + 40-character Base64 secret keys.
GitHub PAT: Modern ghp_ format + 36 alphanumeric characters.
GCP Service Account: Valid JSON credential format with RSA private key blocks.
OpenAI / Anthropic: sk-[a-zA-Z0-9]{48} and sk-ant-[a-zA-Z0-9]{95}.
PEM Keys: In-memory generated 2048-bit RSA and ECDSA private keys.
All --dlp all Generates a balanced composite stream rotating across all four categories.

2. Text Carrier Formatting (--carrier-type)

Payloads can be structured into business carrier formats to test deep content inspection:

BASH
contraband-client --carrier-type csv     # Transactional records with customer headers
contraband-client --carrier-type json    # Nested JSON object array
contraband-client --carrier-type sql     # SQL batch INSERT statements
contraband-client --carrier-type email   # RFC 5322 MIME messages with billing attachments
contraband-client --carrier-type syslog  # RFC 5424 structured syslog audit events

3. Steganographic Embedding (--stego)

To evaluate file carving and media analysis engines:

Format Flag Mechanism
PNG --stego png Synthesizes an authentic RGB PNG in memory; modifies the least significant bit (LSB) of each color byte. Recomputes valid CRC32 chunk checksums.
JPEG --stego jpeg-zip Synthesizes a valid JPEG image and injects encrypted payload chunks into COM (0xFFFE) comment markers or EXIF UserComment metadata.
PDF --stego pdf-jar Synthesizes valid %PDF-1.7 documents with authentic xref tables and compressed /FlateDecode streams, or creates dual-format PDF-ZIP polyglots.
ZIP Built-in Appends payload data into the variable-length End of Central Directory (EOCD) comment field without corrupting archive extractors (unzip, 7z).

4. Standalone Generator Command (generate)

To generate synthetic test payloads directly to disk or stdout for standalone DLP tuning:

BASH
# Generate 100 KB of synthetic credit card records as CSV
contraband generate --dlp pci --carrier-type csv --size 100KB -o pci_test.csv

# Generate 5 MB of healthcare HL7 records
contraband generate --dlp hipaa --carrier-type text --size 5MB -o hipaa_test.hl7

# Pipe synthetic secrets into an external tool
contraband generate --dlp secrets --carrier-type json --size 50KB | jq .