one more patch for the generic WAF detection script, another private report, will not detect Apache now

etc/checksum/md5sum.md5

@@ -56,7 +56,7 @@ cb45428e92485b759ff5cb46a0be9c73  ./lib/firewall/yunsuo.py
 bbd8b4c6100070d420d48dc7dfc297eb  ./lib/firewall/webknight.py
 95b908a21c0ff456ae59df4c6c189c54  ./lib/firewall/wallarm.py
 6ea65a0160c21e144e92334acc2e3667  ./lib/firewall/anquanbao.py
-ad238be8225c2791d82d4c7582afe820  ./lib/firewall/generic.py
+7f4e3ba2f459926fc77bcddc17b933aa  ./lib/firewall/generic.py
 cf236a16c7869282f55dd4c5ad6347a5  ./lib/attacks/gist_lookup/__init__.py
 7183dbd7106ecb436176cebcca4e499f  ./lib/attacks/clickjacking_scan/__init__.py
 d41d8cd98f00b204e9800998ecf8427e  ./lib/attacks/__init__.py
@@ -68,11 +68,11 @@ d2846e039fefee741db24dd64f7bd50e  ./lib/attacks/admin_panel_finder/__init__.py
 b5cd5e913cc62112776153bdf0f60fa4  ./lib/attacks/xss_scan/__init__.py
 63c45495ec1ed2e98946bef514d8805e  ./lib/attacks/nmap_scan/__init__.py
 216999fa0e84866d5c1d96d5676034e4  ./lib/attacks/nmap_scan/nmap_opts.py
-545de148cbb330e3e1aa91de05d6e16c  ./lib/header_check/__init__.py
+7267f30f11ed3d096e222da949da5bea  ./lib/header_check/__init__.py
 9a2bb0d52f64e12d5a63ce83874ea74a  ./lib/core/common.py
 1faa2b5dfad6eb538bbfe42942d2a9da  ./lib/core/errors.py
 d41d8cd98f00b204e9800998ecf8427e  ./lib/core/__init__.py
-4126cf6962354db415835b42d054b85b  ./lib/core/settings.py
+bf158550d8f51f4841fd1b003cb71c55  ./lib/core/settings.py
 9a02e5b913d210350545ac26510a63c9  ./var/search/__init__.py
 8402f23a2586b6f684fb1c3c04c4386f  ./var/search/selenium_search.py
 63ba132381a0cc2d7629852bd5e4aa17  ./var/search/pgp_search.py

lib/core/settings.py

@@ -46,7 +46,7 @@ CLONE = "https://github.com/ekultek/zeus-scanner.git"
 ISSUE_LINK = "https://github.com/ekultek/zeus-scanner/issues"
 
 # current version <major.minor.commit.patch ID>
-VERSION = "1.2.40.{}".format(PATCH_ID)
+VERSION = "1.2.41.{}".format(PATCH_ID)
 
 # colors to output depending on the version
 VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}

lib/firewall/generic.py

@@ -1,5 +1,6 @@
 import re
 
+from lib.core.common import  HTTP_HEADER
 from lib.core.settings import PROTECTION_CHECK_PAYLOAD
 
 
@@ -8,6 +9,7 @@ __item__ = "Generic (Unknown)"
 
 def detect(content, **kwargs):
     content = str(content)
+    headers = kwargs.get("headers", None)
     status = kwargs.get("status", None)
     if status == 403:
         # if the error HTML is an Apache error, Apache has a tendency to be fucking stupid
@@ -15,11 +17,17 @@ def detect(content, **kwargs):
         # Apache is a killer of fun and doesn't like anything decent in this life.
         if re.compile(r"<.+>403 Forbidden<.+.>", re.I).search(content) is not None:
             return False
+        if re.compile(r"apache.\d+", re.I).search(headers.get(HTTP_HEADER.SERVER, "")) is not None:
+            return False
+    # make sure that it's not just a `didn't find what you're looking for` page
+    # this will probably help out a lot with random WAF detection
+    if status == 200 or "not found" in content.lower():
+        return False
     detection_schema = (
         re.compile("blocked", re.I), re.compile("forbidden", re.I),
         re.compile("illegal", re.I), re.compile("reported", re.I),
         re.compile("logged", re.I), re.compile("access denied", re.I),
-        re.compile("ip address logged", re.I)
+        re.compile("ip address logged", re.I), re.compile("banner", re.I),
     )
     for detection in detection_schema:
         if detection.search(content) is not None:

lib/header_check/__init__.py

@@ -116,7 +116,6 @@ def detect_protection(url, **kwargs):
             return None
 
     except Exception as e:
-        print logger.exception(e)
         if "Read timed out." or "Connection reset by peer" in str(e):
             logger.warning(set_color(
                 "detection request failed, assuming no protection and continuing...", level=30