From 2b39613b0576d3bce2886efc80626a4b42dc7af8 Mon Sep 17 00:00:00 2001
From: ekultek <thomas.perkins23@icloud.com>
Date: Tue, 28 Nov 2017 13:06:18 -0600
Subject: [PATCH] three new WAF scripts, armor, fortigate, and akamai. updates
 to generic WAF

---
 lib/firewall/akamai.py    | 21 +++++++++++++++++++++
 lib/firewall/armor.py     | 15 +++++++++++++++
 lib/firewall/fortigate.py | 22 ++++++++++++++++++++++
 lib/firewall/generic.py   |  4 ++--
 4 files changed, 60 insertions(+), 2 deletions(-)
 create mode 100644 lib/firewall/akamai.py
 create mode 100644 lib/firewall/armor.py
 create mode 100644 lib/firewall/fortigate.py

diff --git a/lib/firewall/akamai.py b/lib/firewall/akamai.py
new file mode 100644
index 0000000..c28d443
--- /dev/null
+++ b/lib/firewall/akamai.py
@@ -0,0 +1,21 @@
+import re
+
+from lib.core.common import HTTP_HEADER
+
+
+__item__ = "AkamaiGHost Website Protection (Akamai Global Host)"
+
+
+def detect(content, **kwargs):
+    headers = kwargs.get("headers", None)
+    content = str(content)
+    detection_schema = (
+        re.compile(r"you.don.t.have.permission.to.access", re.I),
+        re.compile(r"<.+>access.denied<.+.>", re.I),
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            if re.compile(r"\bakamaighost", re.I).search(headers.get(HTTP_HEADER.SERVER, "")) is not None:
+                return True
+            if re.compile(r"\bak.bmsc.", re.I).search(headers.get(HTTP_HEADER.SET_COOKIE, "")) is not None:
+                return True
diff --git a/lib/firewall/armor.py b/lib/firewall/armor.py
new file mode 100644
index 0000000..f134a63
--- /dev/null
+++ b/lib/firewall/armor.py
@@ -0,0 +1,15 @@
+import re
+
+
+__item__ = "Armor Protection (Armor Defense)"
+
+
+def detect(content, **kwargs):
+    content = str(content)
+    detection_schema = (
+        re.compile(r"\barmor\b", re.I),
+        re.compile(r"blocked.by.website.protection.from.armour", re.I)
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            return True
diff --git a/lib/firewall/fortigate.py b/lib/firewall/fortigate.py
new file mode 100644
index 0000000..f4293fc
--- /dev/null
+++ b/lib/firewall/fortigate.py
@@ -0,0 +1,22 @@
+import re
+
+from lib.core.common import HTTP_HEADER
+
+
+__item__ = "FortiWeb Web Application Firewall (Fortinet)"
+
+
+def detect(content, **kwargs):
+    headers = kwargs.get("headers", None)
+    content = str(content)
+    detection_schema = (
+        re.compile(r"<.+>powered.by.fortinet<.+.>", re.I),
+        re.compile(r"<.+>fortigate.ips.sensor<.+.>", re.I),
+        re.compile(r"fortigate", re.I), re.compile(r".fgd_icon", re.I),
+        re.compile(r"\AFORTIWAFSID=", re.I)
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            return True
+        if detection.search(headers.get(HTTP_HEADER.SET_COOKIE, "")) is not None:
+            return True
diff --git a/lib/firewall/generic.py b/lib/firewall/generic.py
index dd17f87..84dbe87 100644
--- a/lib/firewall/generic.py
+++ b/lib/firewall/generic.py
@@ -26,8 +26,8 @@ def detect(content, **kwargs):
     detection_schema = (
         re.compile("blocked", re.I), re.compile("forbidden", re.I),
         re.compile("illegal", re.I), re.compile("reported", re.I),
-        re.compile("logged", re.I), re.compile("access denied", re.I),
-        re.compile("ip address logged", re.I), re.compile("banner", re.I),
+        re.compile("ip.logged", re.I), re.compile("access.denied", re.I),
+        re.compile("ip.address.logged", re.I), re.compile(r"not.acceptable")
     )
     for detection in detection_schema:
         if detection.search(content) is not None: