Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit be50192

Browse files
stamparmstamparm
committed
Refactoring WAF scripts
1 parent e5835dc commit be50192

13 files changed

Lines changed: 115 additions & 45 deletions

‎lib/core/settings.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,7 @@
384384

385385
# Vectors used for provoking specific WAF/IDS/IPS behavior(s)
386386
WAF_ATTACK_VECTORS = (
387+
"", # NIL
387388
"search=<script>alert(1)</script>",
388389
"file=../../../../etc/passwd",
389390
"q=<invalid>foobar",

‎waf/airlock.py‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,17 @@
88
import re
99

1010
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
1112

1213
__product__ = "Airlock (Phion/Ergon)"
1314

1415
def detect(get_page):
15-
page, headers, code = get_page()
16-
return re.search(r"\AAL[_-]?(SESS|LB)=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\AAL[_-]?(SESS|LB)=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
21+
if retval:
22+
break
23+
24+
return retval

‎waf/barracuda.py‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,17 @@
88
import re
99

1010
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
1112

1213
__product__ = "Barracuda Web Application Firewall (Barracuda Networks)"
1314

1415
def detect(get_page):
15-
page, headers, code = get_page()
16-
return re.search(r"\Abarra_counter_session=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\Abarra_counter_session=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
21+
if retval:
22+
break
23+
24+
return retval

‎waf/bigip.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@
1313
__product__ = "BIG-IP Application Security Manager (F5 Networks)"
1414

1515
def detect(get_page):
16-
page, headers, code = get_page()
17-
retval = re.search(r"\ATS[a-zA-Z0-9]{3,6}=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
16+
retval = False
1817

19-
if not retval:
20-
for vector in WAF_ATTACK_VECTORS:
21-
page, headers, code = get_page(get=vector)
22-
retval = headers.get("X-Cnection", "").lower() == "close"
23-
if retval:
24-
break
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = headers.get("X-Cnection", "").lower() == "close"
21+
retval |= re.search(r"\ATS[a-zA-Z0-9]{3,6}=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
22+
retval |= re.search(r"BigIP|BIGipServer", headers.get(HTTPHEADER.SERVER, ""), re.I) is not None
23+
if retval:
24+
break
2525

2626
return retval

‎waf/binarysec.py‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,18 @@
88
import re
99

1010
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
1112

1213
__product__ = "BinarySEC Web Application Firewall (BinarySEC)"
1314

1415
def detect(get_page):
15-
page, headers, code = get_page()
16-
retval = re.search(r"BinarySec", headers.get(HTTPHEADER.SERVER, ""), re.I) is not None
17-
if not retval:
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
1820
retval = any(headers.get(_) for _ in ("x-binarysec-via", "x-binarysec-nocache"))
21+
retval |= re.search(r"BinarySec", headers.get(HTTPHEADER.SERVER, ""), re.I) is not None
22+
if retval:
23+
break
24+
1925
return retval

‎waf/datapower.py‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,18 @@
77

88
import re
99

10+
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
12+
1013
__product__ = "IBM WebSphere DataPower (IBM)"
1114

1215
def detect(get_page):
13-
page, headers, code = get_page()
14-
return re.search(r"\A(OK|FAIL)", headers.get("X-Backside-Transport", ""), re.I) is not None
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\A(OK|FAIL)", headers.get("X-Backside-Transport", ""), re.I) is not None
21+
if retval:
22+
break
23+
24+
return retval

‎waf/denyall.py‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,13 @@
1313
__product__ = "Deny All Web Application Firewall (DenyAll)"
1414

1515
def detect(get_page):
16-
page, headers, code = get_page()
17-
retval = re.search(r"\Asessioncookie=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
16+
retval = False
1817

19-
if not retval:
20-
for vector in WAF_ATTACK_VECTORS:
21-
page, headers, code = get_page(get=vector)
22-
retval = code == 200 and re.search(r"\ACondition Intercepted", page, re.I) is not None
23-
if retval:
24-
break
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\Asessioncookie=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
21+
retval |= code == 200 and re.search(r"\ACondition Intercepted", page, re.I) is not None
22+
if retval:
23+
break
2524

2625
return retval

‎waf/hyperguard.py‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,17 @@
88
import re
99

1010
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
1112

1213
__product__ = "Hyperguard Web Application Firewall (art of defence Inc.)"
1314

1415
def detect(get_page):
15-
page, headers, code = get_page()
16-
return re.search(r"\AODSESSION=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\AODSESSION=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
21+
if retval:
22+
break
23+
24+
return retval

‎waf/netcontinuum.py‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,17 @@
88
import re
99

1010
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
1112

1213
__product__ = "NetContinuum Web Application Firewall (NetContinuum/Barracuda Networks)"
1314

1415
def detect(get_page):
15-
page, headers, code = get_page()
16-
return re.search(r"\ANCI__SessionId=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
16+
retval = False
17+
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\ANCI__SessionId=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
21+
if retval:
22+
break
23+
24+
return retval

‎waf/netscaler.py‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,14 @@
1313
__product__ = "NetScaler (Citrix Systems)"
1414

1515
def detect(get_page):
16-
page, headers, code = get_page()
17-
retval = re.search(r"\A(ns_af=|citrix_ns_id|NSC_)", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
18-
retval |= re.search(r"\ANS-CACHE", headers.get(HTTPHEADER.VIA, ""), re.I) is not None
16+
retval = False
1917

20-
if not retval:
21-
for vector in WAF_ATTACK_VECTORS:
22-
page, headers, code = get_page(get=vector)
23-
retval = re.search(r"\Aclose", headers.get("Cneonction", "") or headers.get("nnCoection", ""), re.I) is not None
24-
if retval:
25-
break
18+
for vector in WAF_ATTACK_VECTORS:
19+
page, headers, code = get_page(get=vector)
20+
retval = re.search(r"\Aclose", headers.get("Cneonction", "") or headers.get("nnCoection", ""), re.I) is not None
21+
retval = re.search(r"\A(ns_af=|citrix_ns_id|NSC_)", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
22+
retval |= re.search(r"\ANS-CACHE", headers.get(HTTPHEADER.VIA, ""), re.I) is not None
23+
if retval:
24+
break
2625

2726
return retval

0 commit comments

Comments
 (0)