three new WAF scripts, armor, fortigate, and akamai. updates to generic WAF

lib/firewall/akamai.py

@@ -0,0 +1,21 @@
+import re
+
+from lib.core.common import HTTP_HEADER
+
+
+__item__ = "AkamaiGHost Website Protection (Akamai Global Host)"
+
+
+def detect(content, **kwargs):
+    headers = kwargs.get("headers", None)
+    content = str(content)
+    detection_schema = (
+        re.compile(r"you.don.t.have.permission.to.access", re.I),
+        re.compile(r"<.+>access.denied<.+.>", re.I),
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            if re.compile(r"\bakamaighost", re.I).search(headers.get(HTTP_HEADER.SERVER, "")) is not None:
+                return True
+            if re.compile(r"\bak.bmsc.", re.I).search(headers.get(HTTP_HEADER.SET_COOKIE, "")) is not None:
+                return True

lib/firewall/armor.py

@@ -0,0 +1,15 @@
+import re
+
+
+__item__ = "Armor Protection (Armor Defense)"
+
+
+def detect(content, **kwargs):
+    content = str(content)
+    detection_schema = (
+        re.compile(r"\barmor\b", re.I),
+        re.compile(r"blocked.by.website.protection.from.armour", re.I)
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            return True

lib/firewall/fortigate.py

@@ -0,0 +1,22 @@
+import re
+
+from lib.core.common import HTTP_HEADER
+
+
+__item__ = "FortiWeb Web Application Firewall (Fortinet)"
+
+
+def detect(content, **kwargs):
+    headers = kwargs.get("headers", None)
+    content = str(content)
+    detection_schema = (
+        re.compile(r"<.+>powered.by.fortinet<.+.>", re.I),
+        re.compile(r"<.+>fortigate.ips.sensor<.+.>", re.I),
+        re.compile(r"fortigate", re.I), re.compile(r".fgd_icon", re.I),
+        re.compile(r"\AFORTIWAFSID=", re.I)
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            return True
+        if detection.search(headers.get(HTTP_HEADER.SET_COOKIE, "")) is not None:
+            return True

lib/firewall/generic.py

@@ -26,8 +26,8 @@ def detect(content, **kwargs):
     detection_schema = (
         re.compile("blocked", re.I), re.compile("forbidden", re.I),
         re.compile("illegal", re.I), re.compile("reported", re.I),
-        re.compile("logged", re.I), re.compile("access denied", re.I),
-        re.compile("ip address logged", re.I), re.compile("banner", re.I),
+        re.compile("ip.logged", re.I), re.compile("access.denied", re.I),
+        re.compile("ip.address.logged", re.I), re.compile(r"not.acceptable")
     )
     for detection in detection_schema:
         if detection.search(content) is not None: