whatwaf 1.11.2

Heuristic web application firewall (WAF) detector.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

use crate::detectors::Detector;
use crate::utils::checks::MatchMode;
use crate::utils::http::HttpResponse;
use once_cell::sync::Lazy;
use regex::Regex;

pub struct FortiWeb;

static BODY: Lazy<Vec<Regex>> = Lazy::new(|| {
    vec![Regex::new(r"Attack ID:\s*2(?:0*\d{2})").unwrap()] // https://docs.fortinet.com/document/fortiweb/8.0.1/log-message-reference/445549/attack
});

impl Detector for FortiWeb {
    fn name(&self) -> &'static str {
        "FortiWeb"
    }

    fn detect(&self, resp: &HttpResponse) -> bool {
        resp.body_has(&["<h2 class=\"fgd_icon\">block</h2>"], MatchMode::Any)
            && resp.body_matches(&BODY, MatchMode::Any)
    }
}

inventory::submit! {
    &FortiWeb as &dyn Detector
}