From e18e4c02a28b37e00120a532612c42f350edde72 Mon Sep 17 00:00:00 2001
From: ekultek <thomas.perkins23@icloud.com>
Date: Wed, 15 Nov 2017 07:22:51 -0600
Subject: [PATCH] added pksecurity module and siteguard WAF scripts (issue
 #142)

---
 lib/firewall/pk.py        | 16 ++++++++++++++++
 lib/firewall/siteguard.py | 15 +++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 lib/firewall/pk.py
 create mode 100644 lib/firewall/siteguard.py

diff --git a/lib/firewall/pk.py b/lib/firewall/pk.py
new file mode 100644
index 0000000..657c4b2
--- /dev/null
+++ b/lib/firewall/pk.py
@@ -0,0 +1,16 @@
+import re
+
+
+__item__ = "pkSecurityModule (IDS)"
+
+
+def detect(content, **kwargs):
+    content = str(content)
+    detection_schema = (
+        re.compile(r"<.+>pkSecurityModule\W..\WSecurity.Alert<.+.>", re.I),
+        re.compile(r"<.+http(s)?.//([w]{3})?.kitnetwork.\w+.+>", re.I),
+        re.compile(r"<.+>A.safety.critical.request.was.discovered.and.blocked.<.+.>", re.I)
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            return True
diff --git a/lib/firewall/siteguard.py b/lib/firewall/siteguard.py
new file mode 100644
index 0000000..fa7c3aa
--- /dev/null
+++ b/lib/firewall/siteguard.py
@@ -0,0 +1,15 @@
+import re
+
+
+__item__ = "Website Security SiteGuard (Lite)"
+
+
+def detect(content, **kwargs):
+    content = str(content)
+    detection_schema = (
+        re.compile(r">Powered.by.SiteGuard.Lite<", re.I),
+        re.compile(r"refuse.to.browse", re.I)
+    )
+    for detection in detection_schema:
+        if detection.search(content) is not None:
+            return True