Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 40f067a

Browse files
stamparmstamparm
committed
Adding new WAF scripts (merging from identYwaf - same author)
1 parent 6cdb90d commit 40f067a

9 files changed

Lines changed: 119 additions & 7 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.3.1.49"
22+
VERSION = "1.3.1.50"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎txt/checksum.md5‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ fe370021c6bc99daf44b2bfc0d1effb3 lib/core/patch.py
4949
9a7d68d5fa01561500423791f15cc676 lib/core/replication.py
5050
3179d34f371e0295dd4604568fb30bcd lib/core/revision.py
5151
d6269c55789f78cf707e09a0f5b45443 lib/core/session.py
52-
4f9aafb24e5b12eb078b1b68719d9afe lib/core/settings.py
52+
80cfb89595be410e564c7501c530c58e lib/core/settings.py
5353
a8a7501d1e6b21669b858a62e921d191 lib/core/shell.py
5454
5dc606fdf0afefd4b305169c21ab2612 lib/core/subprocessng.py
5555
eec3080ba5baca44c6de4595f1c92a0d lib/core/target.py
@@ -404,8 +404,9 @@ b6bc83ae9ea69cf96e9389bde8250c7c waf/airlock.py
404404
425f2599f57ab81b4fff67e6b442cccc waf/armor.py
405405
33b6e6793ed3add457d7c909ec599ad3 waf/asm.py
406406
9dbec5d674ed4c762ffc9bc3ab402739 waf/aws.py
407-
4fd9a8e3aac364fe5509b23e7eb5a448 waf/barracuda.py
407+
e57a22864477ad23ae6a3d308f9b5410 waf/barracuda.py
408408
742f8c9b7f3a858e11dfd2ce3df65c6e waf/binarysec.py
409+
1712d76bd4adb705f3317ff5908acdcd waf/bitninja.py
409410
2608fbe2c80fae99bb09db1f93d80cdd waf/bluedon.py
410411
8385218d8a1863dbfd4274db36880dfe waf/cerber.py
411412
5ae64cad95b7f904c350cc81230c3bd1 waf/chinacache.py
@@ -423,22 +424,26 @@ a8412619d7f26ed6bc9e0b20a57b2324 waf/edgecast.py
423424
588d2f9a8f201e120e74e508564cb487 waf/fortiweb.py
424425
0e9eb20967d2dde941cca8c663a63e1f waf/generic.py
425426
4ea580dd1b9679bd733866976ad5d81e waf/godaddy.py
427+
27385b15477031a3aff25df601a1ff51 waf/greywizard.py
426428
256a7ea2c1cd2745fe788cf8f6123f8a waf/imunify360.py
427-
4c4d480c155ae99262043c80a76ec1d5 waf/incapsula.py
429+
f4e3fb185b92483832d14b532f467b35 waf/incapsula.py
428430
fb6be55d21a70765e35549af2484f762 waf/__init__.py
429431
a3ee375714987acccc26d1b07c2e8af7 waf/isaserver.py
432+
e6994165497cef25d7a785cd3d4a3c64 waf/janusec.py
430433
ce9cf35919a92d65347bb74ca0c5c86f waf/jiasule.py
431434
f44ed04eeb4287c11ce277703ec7d72d waf/knownsec.py
432435
8c3977c543ca4ec6d4231f604217cf94 waf/kona.py
433436
d4f36e44f496f4d51baa3241eabc60fd waf/malcare.py
434437
509af267f45485f3cb1c839fa040ff07 waf/modsecurity.py
435438
78af8e791207db9723a14bddeb7524af waf/naxsi.py
436439
504ade4d32bdbbd2932eebb07f57c3eb waf/netcontinuum.py
440+
8004b57e9b8e19060aae5b82ecb87472 waf/netscaler.py
437441
96e1902b7e4297173d519b00c86f6a02 waf/newdefend.py
438442
d03dfe93a14c966b88f5baf59ce2b091 waf/ninjafirewall.py
439443
69fc40e85751279e9018d643742db04e waf/nsfocus.py
440444
a59aff03a5b3fb40ea0feb3489677040 waf/onmessageshield.py
441445
532b6f8de357a9b88a313944e1756538 waf/paloalto.py
446+
f9de9375ffd0447ba93b215493d327a1 waf/perimeterx.py
442447
2979bb64c24256a83625d75a385dde9b waf/profense.py
443448
8de0d46738335a4e498c4ac9038ac3c3 waf/proventia.py
444449
ac60456fe7af4eb501d448910e98ee4b waf/radware.py

‎waf/barracuda.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ def detect(get_page):
1616
retval = False
1717

1818
for vector in WAF_ATTACK_VECTORS:
19-
_, headers, _ = get_page(get=vector)
19+
page, headers, _ = get_page(get=vector)
2020
retval = re.search(r"\Abarra_counter_session=", headers.get(HTTP_HEADER.SET_COOKIE, ""), re.I) is not None
2121
retval |= re.search(r"(\A|\b)barracuda_", headers.get(HTTP_HEADER.SET_COOKIE, ""), re.I) is not None
22+
retval |= "when this page occurred and the event ID found at the bottom of the page" in (page or "")
2223
if retval:
2324
break
2425

‎waf/bitninja.py‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5+
See the file 'LICENSE' for copying permission
6+
"""
7+
8+
from lib.core.settings import WAF_ATTACK_VECTORS
9+
10+
__product__ = "BitNinja (BitNinja)"
11+
12+
def detect(get_page):
13+
retval = False
14+
15+
for vector in WAF_ATTACK_VECTORS:
16+
page, _, _ = get_page(get=vector)
17+
retval = any(_ in (page or "") for _ in ("alt=\"BitNinja|Security check by BitNinja", "your IP will be removed from BitNinja", "<title>Visitor anti-robot validation</title>"))
18+
if retval:
19+
break
20+
21+
return retval

‎waf/greywizard.py‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5+
See the file 'LICENSE' for copying permission
6+
"""
7+
8+
import re
9+
10+
from lib.core.enums import HTTP_HEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
12+
13+
__product__ = "Greywizard (Grey Wizard)"
14+
15+
def detect(get_page):
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, _ = get_page(get=vector)
20+
retval = re.search(r"\Agreywizard", headers.get(HTTP_HEADER.SERVER, ""), re.I) is not None
21+
retval |= any(_ in (page or "") for _ in ("We've detected attempted attack or non standard traffic from your IP address", "<title>Grey Wizard</title>"))
22+
if retval:
23+
break
24+
25+
return retval

‎waf/incapsula.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@ def detect(get_page):
1919
page, headers, _ = get_page(get=vector)
2020
retval = re.search(r"incap_ses|visid_incap", headers.get(HTTP_HEADER.SET_COOKIE, ""), re.I) is not None
2121
retval |= re.search(r"Incapsula", headers.get("X-CDN", ""), re.I) is not None
22-
retval |= any(_ in (page or "") for _ in ("Incapsula incident ID", "_Incapsula_Resource?", "?subject=WAF Block Page:"))
23-
retval |= all(_ in (page or "") for _ in ("Application Firewall Error", "If you feel you have been blocked in error, please contact Customer Support"))
22+
retval |= "Incapsula incident ID" in (page or "")
2423
retval |= all(_ in (page or "") for _ in ("Error code 15", "This request was blocked by the security rules"))
2524
retval |= re.search(r"(?i)incident.{1,100}?\b\d{19}\-\d{17}\b", page or "") is not None
2625
retval |= headers.get("X-Iinfo") is not None

‎waf/janusec.py‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5+
See the file 'LICENSE' for copying permission
6+
"""
7+
8+
from lib.core.settings import WAF_ATTACK_VECTORS
9+
10+
__product__ = "Janusec Application Gateway (Janusec)"
11+
12+
def detect(get_page):
13+
retval = False
14+
15+
for vector in WAF_ATTACK_VECTORS:
16+
page, _, _ = get_page(get=vector)
17+
retval = all(_ in (page or "") for _ in ("Reason:", "by Janusec Application Gateway"))
18+
if retval:
19+
break
20+
21+
return retval

‎waf/netscaler.py‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5+
See the file 'LICENSE' for copying permission
6+
"""
7+
8+
from lib.core.settings import WAF_ATTACK_VECTORS
9+
10+
__product__ = "NetScaler AppFirewall (Citrix)"
11+
12+
def detect(get_page):
13+
retval = False
14+
15+
for vector in WAF_ATTACK_VECTORS:
16+
page, _, _ = get_page(get=vector)
17+
retval |= any(_ in (page or "") for _ in ("<title>Application Firewall Block Page</title>", "Violation Category: APPFW_", "AppFW Session ID", "Access has been blocked - if you feel this is in error, please contact the site administrators quoting the following"))
18+
if retval:
19+
break
20+
21+
return retval

‎waf/perimeterx.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5+
See the file 'LICENSE' for copying permission
6+
"""
7+
8+
from lib.core.settings import WAF_ATTACK_VECTORS
9+
10+
__product__ = "PerimeterX (PerimeterX, Inc.)"
11+
12+
def detect(get_page):
13+
retval = False
14+
15+
for vector in WAF_ATTACK_VECTORS:
16+
page, _, _ = get_page(get=vector)
17+
retval = "https://www.perimeterx.com/whywasiblocked" in (page or "")
18+
19+
return retval

0 commit comments

Comments
 (0)