From a805afd1fa6b336f748950d84fa70ca4676ba0af Mon Sep 17 00:00:00 2001 From: ekultek Date: Mon, 13 Nov 2017 20:46:26 -0600 Subject: [PATCH] minor update so that it will not keep pulling the Apache server error, this way it will truly only pull what it believes are WAF/IDS/IPS's --- lib/header_check/__init__.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/header_check/__init__.py b/lib/header_check/__init__.py index a4205c5..3522538 100644 --- a/lib/header_check/__init__.py +++ b/lib/header_check/__init__.py @@ -67,9 +67,12 @@ def detect_protection(url, **kwargs): "it appears that the WAF/IDS/IPS check threw a DBMS error and may be vulnerable " "to SQL injection attacks. it appears the backend DBMS is '{}'...".format(dbms), level=25 )) + return None retval = [] if status != 200 and "not found" not in html.lower(): + if "Apache" in headers["Server"] and "you don't have permission" in html.lower(): + return None file_list = [f for f in os.listdir(DETECT_FIREWALL_PATH) if not any(ex in f for ex in ["__init__", ".pyc"])] for item in file_list: item = item[:-3]