diff --git a/etc/checksum/md5sum.md5 b/etc/checksum/md5sum.md5 index a4e387d..181a968 100644 --- a/etc/checksum/md5sum.md5 +++ b/etc/checksum/md5sum.md5 @@ -56,7 +56,7 @@ cb45428e92485b759ff5cb46a0be9c73 ./lib/firewall/yunsuo.py bbd8b4c6100070d420d48dc7dfc297eb ./lib/firewall/webknight.py 95b908a21c0ff456ae59df4c6c189c54 ./lib/firewall/wallarm.py 6ea65a0160c21e144e92334acc2e3667 ./lib/firewall/anquanbao.py -ad238be8225c2791d82d4c7582afe820 ./lib/firewall/generic.py +7f4e3ba2f459926fc77bcddc17b933aa ./lib/firewall/generic.py cf236a16c7869282f55dd4c5ad6347a5 ./lib/attacks/gist_lookup/__init__.py 7183dbd7106ecb436176cebcca4e499f ./lib/attacks/clickjacking_scan/__init__.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/__init__.py @@ -68,11 +68,11 @@ d2846e039fefee741db24dd64f7bd50e ./lib/attacks/admin_panel_finder/__init__.py b5cd5e913cc62112776153bdf0f60fa4 ./lib/attacks/xss_scan/__init__.py 63c45495ec1ed2e98946bef514d8805e ./lib/attacks/nmap_scan/__init__.py 216999fa0e84866d5c1d96d5676034e4 ./lib/attacks/nmap_scan/nmap_opts.py -545de148cbb330e3e1aa91de05d6e16c ./lib/header_check/__init__.py +7267f30f11ed3d096e222da949da5bea ./lib/header_check/__init__.py 9a2bb0d52f64e12d5a63ce83874ea74a ./lib/core/common.py 1faa2b5dfad6eb538bbfe42942d2a9da ./lib/core/errors.py d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py -4126cf6962354db415835b42d054b85b ./lib/core/settings.py +bf158550d8f51f4841fd1b003cb71c55 ./lib/core/settings.py 9a02e5b913d210350545ac26510a63c9 ./var/search/__init__.py 8402f23a2586b6f684fb1c3c04c4386f ./var/search/selenium_search.py 63ba132381a0cc2d7629852bd5e4aa17 ./var/search/pgp_search.py diff --git a/lib/core/settings.py b/lib/core/settings.py index a09de6c..a3aa1ba 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -46,7 +46,7 @@ CLONE = "https://github.com/ekultek/zeus-scanner.git" ISSUE_LINK = "https://github.com/ekultek/zeus-scanner/issues" # current version -VERSION = "1.2.40.{}".format(PATCH_ID) +VERSION = "1.2.41.{}".format(PATCH_ID) # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} diff --git a/lib/firewall/generic.py b/lib/firewall/generic.py index daa591f..dd17f87 100644 --- a/lib/firewall/generic.py +++ b/lib/firewall/generic.py @@ -1,5 +1,6 @@ import re +from lib.core.common import HTTP_HEADER from lib.core.settings import PROTECTION_CHECK_PAYLOAD @@ -8,6 +9,7 @@ __item__ = "Generic (Unknown)" def detect(content, **kwargs): content = str(content) + headers = kwargs.get("headers", None) status = kwargs.get("status", None) if status == 403: # if the error HTML is an Apache error, Apache has a tendency to be fucking stupid @@ -15,11 +17,17 @@ def detect(content, **kwargs): # Apache is a killer of fun and doesn't like anything decent in this life. if re.compile(r"<.+>403 Forbidden<.+.>", re.I).search(content) is not None: return False + if re.compile(r"apache.\d+", re.I).search(headers.get(HTTP_HEADER.SERVER, "")) is not None: + return False + # make sure that it's not just a `didn't find what you're looking for` page + # this will probably help out a lot with random WAF detection + if status == 200 or "not found" in content.lower(): + return False detection_schema = ( re.compile("blocked", re.I), re.compile("forbidden", re.I), re.compile("illegal", re.I), re.compile("reported", re.I), re.compile("logged", re.I), re.compile("access denied", re.I), - re.compile("ip address logged", re.I) + re.compile("ip address logged", re.I), re.compile("banner", re.I), ) for detection in detection_schema: if detection.search(content) is not None: diff --git a/lib/header_check/__init__.py b/lib/header_check/__init__.py index 1ba0ad7..c4a969d 100644 --- a/lib/header_check/__init__.py +++ b/lib/header_check/__init__.py @@ -116,7 +116,6 @@ def detect_protection(url, **kwargs): return None except Exception as e: - print logger.exception(e) if "Read timed out." or "Connection reset by peer" in str(e): logger.warning(set_color( "detection request failed, assuming no protection and continuing...", level=30