[SHEHZADE//ABDULLAH ANSARI]
Red Team Consultant @ Google | MS in Cybersecurity @ NYU
● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
PUBLIC MIRRORGo v1.0
Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.
$
git clone https://shehzade.io/repos/contraband.git
Copy
Source ZIP (1.93 MB)
253 lines · 8.5 KB
| 1 | package dlp |
| 2 | |
| 3 | import ( |
| 4 | "encoding/json" |
| 5 | "fmt" |
| 6 | "math/rand" |
| 7 | "strings" |
| 8 | "time" |
| 9 | ) |
| 10 | |
| 11 | type ICD10Code struct { |
| 12 | Code string `json:"code"` |
| 13 | Description string `json:"description"` |
| 14 | } |
| 15 | |
| 16 | type CPTCode struct { |
| 17 | Code string `json:"code"` |
| 18 | Description string `json:"description"` |
| 19 | } |
| 20 | |
| 21 | type Prescription struct { |
| 22 | Medication string `json:"medication"` |
| 23 | Dosage string `json:"dosage"` |
| 24 | Frequency string `json:"frequency"` |
| 25 | Route string `json:"route"` |
| 26 | } |
| 27 | |
| 28 | type MedicalRecord struct { |
| 29 | MRN string `json:"mrn"` |
| 30 | PatientName string `json:"patient_name"` |
| 31 | DateOfBirth string `json:"dob"` |
| 32 | Gender string `json:"gender"` |
| 33 | SSN string `json:"ssn"` |
| 34 | Address string `json:"address"` |
| 35 | Phone string `json:"phone"` |
| 36 | AttendingMD string `json:"attending_physician"` |
| 37 | PhysicianNPI string `json:"physician_npi"` |
| 38 | PhysicianDEA string `json:"physician_dea"` |
| 39 | Diagnoses []ICD10Code `json:"diagnoses"` |
| 40 | Procedures []CPTCode `json:"procedures"` |
| 41 | Prescriptions []Prescription `json:"prescriptions"` |
| 42 | EncounterDate string `json:"encounter_date"` |
| 43 | FacilityName string `json:"facility_name"` |
| 44 | } |
| 45 | |
| 46 | var ICD10Dictionary = []ICD10Code{ |
| 47 | {"E11.9", "Type 2 diabetes mellitus without complications"}, |
| 48 | {"I10", "Essential (primary) hypertension"}, |
| 49 | {"J45.909", "Unspecified asthma, uncomplicated"}, |
| 50 | {"F32.9", "Major depressive disorder, single episode, unspecified"}, |
| 51 | {"Z00.00", "Encounter for general adult medical examination without abnormal findings"}, |
| 52 | {"M54.5", "Low back pain"}, |
| 53 | {"K21.9", "Gastro-esophageal reflux disease without esophagitis"}, |
| 54 | {"E78.5", "Hyperlipidemia, unspecified"}, |
| 55 | {"I25.10", "Atherosclerotic heart disease of native coronary artery"}, |
| 56 | {"N18.3", "Chronic kidney disease, stage 3 (moderate)"}, |
| 57 | } |
| 58 | |
| 59 | var CPTDictionary = []CPTCode{ |
| 60 | {"99213", "Office or other outpatient visit, 20-29 minutes"}, |
| 61 | {"99214", "Office or other outpatient visit, 30-39 minutes"}, |
| 62 | {"80053", "Comprehensive metabolic panel (CMP)"}, |
| 63 | {"85025", "Complete blood count (CBC) with automated differential"}, |
| 64 | {"71046", "Chest X-ray, 2 views"}, |
| 65 | {"93000", "Electrocardiogram, routine ECG with at least 12 leads"}, |
| 66 | } |
| 67 | |
| 68 | var MedicationDictionary = []Prescription{ |
| 69 | {"Metformin", "500mg", "PO BID", "Oral"}, |
| 70 | {"Lisinopril", "10mg", "PO Daily", "Oral"}, |
| 71 | {"Atorvastatin", "20mg", "PO QPM", "Oral"}, |
| 72 | {"Albuterol", "90mcg", "2 puffs Q4H PRN", "Inhalation"}, |
| 73 | {"Sertraline", "50mg", "PO Daily", "Oral"}, |
| 74 | {"Omeprazole", "20mg", "PO Daily AC", "Oral"}, |
| 75 | } |
| 76 | |
| 77 | // GenerateNPI generates a valid 10-digit National Provider Identifier. |
| 78 | func GenerateNPI(r *rand.Rand) string { |
| 79 | // 9 digits prefixed with 1 or 2 |
| 80 | prefix := fmt.Sprintf("%d%08d", 1+r.Intn(2), r.Intn(100000000)) |
| 81 | // Federal standard: calculate check digit using prefix "80840" + 9 digits |
| 82 | fullStr := "80840" + prefix |
| 83 | chk, _ := GenerateLuhnCheckDigit(fullStr) |
| 84 | return fmt.Sprintf("%s%d", prefix, chk) |
| 85 | } |
| 86 | |
| 87 | // GenerateDEA generates a valid 9-character US Drug Enforcement Administration registration number. |
| 88 | // Format: 2 alpha characters followed by 7 digits with Mod-10 checksum: |
| 89 | // Sum1 = d1 + d3 + d5, Sum2 = d2 + d4 + d6, CheckDigit = (Sum1 + 2*Sum2) % 10. |
| 90 | func GenerateDEA(r *rand.Rand, lastName string) string { |
| 91 | firstLetters := []string{"A", "B", "F", "M"} |
| 92 | c1 := firstLetters[r.Intn(len(firstLetters))] |
| 93 | c2 := "X" |
| 94 | trimmed := strings.TrimSpace(lastName) |
| 95 | for _, ch := range trimmed { |
| 96 | if (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') { |
| 97 | c2 = strings.ToUpper(string(ch)) |
| 98 | break |
| 99 | } |
| 100 | } |
| 101 | d1 := r.Intn(10) |
| 102 | d2 := r.Intn(10) |
| 103 | d3 := r.Intn(10) |
| 104 | d4 := r.Intn(10) |
| 105 | d5 := r.Intn(10) |
| 106 | d6 := r.Intn(10) |
| 107 | sum1 := d1 + d3 + d5 |
| 108 | sum2 := d2 + d4 + d6 |
| 109 | chk := (sum1 + 2*sum2) % 10 |
| 110 | return fmt.Sprintf("%s%s%d%d%d%d%d%d%d", c1, c2, d1, d2, d3, d4, d5, d6, chk) |
| 111 | } |
| 112 | |
| 113 | // ValidateDEA verifies that a 9-character DEA number satisfies the US DEA Mod-10 checksum. |
| 114 | func ValidateDEA(dea string) bool { |
| 115 | if len(dea) != 9 { |
| 116 | return false |
| 117 | } |
| 118 | dea = strings.ToUpper(dea) |
| 119 | c1 := dea[0] |
| 120 | if c1 != 'A' && c1 != 'B' && c1 != 'F' && c1 != 'M' && c1 != 'C' && c1 != 'D' && c1 != 'E' && c1 != 'G' && c1 != 'J' && c1 != 'K' && c1 != 'P' && c1 != 'R' && c1 != 'S' && c1 != 'T' && c1 != 'U' && c1 != 'X' { |
| 121 | return false |
| 122 | } |
| 123 | c2 := dea[1] |
| 124 | if c2 < 'A' || c2 > 'Z' { |
| 125 | return false |
| 126 | } |
| 127 | for i := 2; i < 9; i++ { |
| 128 | if dea[i] < '0' || dea[i] > '9' { |
| 129 | return false |
| 130 | } |
| 131 | } |
| 132 | d1 := int(dea[2] - '0') |
| 133 | d2 := int(dea[3] - '0') |
| 134 | d3 := int(dea[4] - '0') |
| 135 | d4 := int(dea[5] - '0') |
| 136 | d5 := int(dea[6] - '0') |
| 137 | d6 := int(dea[7] - '0') |
| 138 | chk := int(dea[8] - '0') |
| 139 | sum1 := d1 + d3 + d5 |
| 140 | sum2 := d2 + d4 + d6 |
| 141 | return (sum1+2*sum2)%10 == chk |
| 142 | } |
| 143 | |
| 144 | // GenerateMedicalRecord creates a fully populated synthetic EHR. |
| 145 | func GenerateMedicalRecord(r *rand.Rand) MedicalRecord { |
| 146 | year := 1950 + r.Intn(50) |
| 147 | month := 1 + r.Intn(12) |
| 148 | day := 1 + r.Intn(28) |
| 149 | dob := fmt.Sprintf("%04d-%02d-%02d", year, month, day) |
| 150 | |
| 151 | gender := "M" |
| 152 | if r.Intn(2) == 0 { |
| 153 | gender = "F" |
| 154 | } |
| 155 | |
| 156 | encYear := 2024 + r.Intn(3) |
| 157 | encMonth := 1 + r.Intn(12) |
| 158 | encDay := 1 + r.Intn(28) |
| 159 | encDate := fmt.Sprintf("%04d-%02d-%02d", encYear, encMonth, encDay) |
| 160 | |
| 161 | docName := GenerateRandomName(r) |
| 162 | docParts := strings.Split(docName, " ") |
| 163 | docLast := docParts[len(docParts)-1] |
| 164 | attendingMD := "Dr. " + docName + ", MD" |
| 165 | physicianDEA := GenerateDEA(r, docLast) |
| 166 | |
| 167 | return MedicalRecord{ |
| 168 | MRN: fmt.Sprintf("MRN-%08d", r.Intn(100000000)), |
| 169 | PatientName: GenerateRandomName(r), |
| 170 | DateOfBirth: dob, |
| 171 | Gender: gender, |
| 172 | SSN: GenerateSSN(r, true), |
| 173 | Address: GenerateRandomAddress(r), |
| 174 | Phone: GenerateRandomPhone(r), |
| 175 | AttendingMD: attendingMD, |
| 176 | PhysicianNPI: GenerateNPI(r), |
| 177 | PhysicianDEA: physicianDEA, |
| 178 | Diagnoses: []ICD10Code{ICD10Dictionary[r.Intn(len(ICD10Dictionary))]}, |
| 179 | Procedures: []CPTCode{CPTDictionary[r.Intn(len(CPTDictionary))]}, |
| 180 | Prescriptions: []Prescription{MedicationDictionary[r.Intn(len(MedicationDictionary))]}, |
| 181 | EncounterDate: encDate, |
| 182 | FacilityName: "Metropolitan Medical Center", |
| 183 | } |
| 184 | } |
| 185 | |
| 186 | // FormatHL7v2 produces a valid pipe-delimited HL7 v2.5 message. |
| 187 | func FormatHL7v2(m MedicalRecord) string { |
| 188 | timestamp := time.Now().Format("20060102150405") |
| 189 | msh := fmt.Sprintf("MSH|^~\\&|CONTRABAND_EHR|FACILITY_01|EXTERNAL_LISTENER|ARCHIVE|%s||ADT^A08|MSG%s|P|2.5\r\n", timestamp, m.MRN) |
| 190 | nameParts := strings.Split(m.PatientName, " ") |
| 191 | lastName := nameParts[len(nameParts)-1] |
| 192 | firstName := nameParts[0] |
| 193 | pid := fmt.Sprintf("PID|1||%s^^^MMC^MR||%s^%s||%s|%s|||%s||%s|||S||%s\r\n", |
| 194 | m.MRN, lastName, firstName, strings.ReplaceAll(m.DateOfBirth, "-", ""), m.Gender, m.Address, m.Phone, m.SSN) |
| 195 | pv1 := fmt.Sprintf("PV1|1|O|CLINIC_01||||%s^%s|||||||||||||||||||||||||||||||||||||||||||||DEA^%s\r\n", m.PhysicianNPI, m.AttendingMD, m.PhysicianDEA) |
| 196 | dg1 := fmt.Sprintf("DG1|1||%s^%s^I10|%s|%s|A\r\n", m.Diagnoses[0].Code, m.Diagnoses[0].Description, m.Diagnoses[0].Description, timestamp[:8]) |
| 197 | pr1 := fmt.Sprintf("PR1|1||%s^%s^CPT|%s|%s\r\n", m.Procedures[0].Code, m.Procedures[0].Description, m.Procedures[0].Description, timestamp[:8]) |
| 198 | rxo := fmt.Sprintf("RXO|%s^%s|%s||%s|||||\r\n", m.Prescriptions[0].Medication, m.Prescriptions[0].Medication, m.Prescriptions[0].Dosage, m.Prescriptions[0].Route) |
| 199 | |
| 200 | return msh + pid + pv1 + dg1 + pr1 + rxo |
| 201 | } |
| 202 | |
| 203 | // FormatFHIR produces a valid FHIR R4 JSON Bundle. |
| 204 | func FormatFHIR(m MedicalRecord) ([]byte, error) { |
| 205 | bundle := map[string]any{ |
| 206 | "resourceType": "Bundle", |
| 207 | "type": "collection", |
| 208 | "entry": []map[string]any{ |
| 209 | { |
| 210 | "resource": map[string]any{ |
| 211 | "resourceType": "Patient", |
| 212 | "id": m.MRN, |
| 213 | "name": []map[string]any{{"text": m.PatientName}}, |
| 214 | "gender": strings.ToLower(m.Gender), |
| 215 | "birthDate": m.DateOfBirth, |
| 216 | "telecom": []map[string]any{{"system": "phone", "value": m.Phone}}, |
| 217 | }, |
| 218 | }, |
| 219 | { |
| 220 | "resource": map[string]any{ |
| 221 | "resourceType": "Practitioner", |
| 222 | "id": m.PhysicianNPI, |
| 223 | "name": []map[string]any{{"text": m.AttendingMD}}, |
| 224 | "identifier": []map[string]any{ |
| 225 | { |
| 226 | "system": "http://hl7.org/fhir/sid/us-npi", |
| 227 | "value": m.PhysicianNPI, |
| 228 | }, |
| 229 | { |
| 230 | "system": "http://hl7.org/fhir/sid/us-dea", |
| 231 | "value": m.PhysicianDEA, |
| 232 | }, |
| 233 | }, |
| 234 | }, |
| 235 | }, |
| 236 | { |
| 237 | "resource": map[string]any{ |
| 238 | "resourceType": "Condition", |
| 239 | "code": map[string]any{ |
| 240 | "coding": []map[string]any{ |
| 241 | { |
| 242 | "system": "http://hl7.org/fhir/sid/icd-10-cm", |
| 243 | "code": m.Diagnoses[0].Code, |
| 244 | "display": m.Diagnoses[0].Description, |
| 245 | }, |
| 246 | }, |
| 247 | }, |
| 248 | }, |
| 249 | }, |
| 250 | }, |
| 251 | } |
| 252 | return json.MarshalIndent(bundle, "", " ") |
| 253 | } |