wafrift-detect 0.2.13

WAF detection from response headers and body, response fingerprint drift analysis.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

[[waf]]
name = "CacheWall"
vendor = "Varnish"
confidence_threshold = 0.3
evasions = ["CaseAlternation", "SqlCommentInsertion", "DoubleUrlEncode", "ContentTypeSwitch"]
source = "WAFW00F:cachewall"
[[waf.signature]]
  header_name = "server"
  header_regex = "Varnish"
  weight = 0.5
[[waf.signature]]
  header_name = "x-varnish"
  header_regex = ".+"
  weight = 0.5
[[waf.signature]]
  header_name = "x-cachewall-action"
  header_regex = ".+?"
  weight = 0.5
[[waf.signature]]
  header_name = "x-cachewall-reason"
  header_regex = ".+?"
  weight = 0.5
[[waf.signature]]
  body_regex = "security by cachewall"
  weight = 0.4
[[waf.signature]]
  body_regex = "403 naughty.{0,10}?not nice!"
  weight = 0.4
[[waf.signature]]
  body_regex = "varnish cache server"
  weight = 0.4