CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-20 18:54:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Cutting down FP on Varnish WAF (ignoring Varnish Cache)

Browse source
This commit is contained in:
Miroslav Stampar 2018-08-30 16:02:27 +02:00
parent 014978cebc
commit aefb815064
3 changed files with 4 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
waf/varnish.py
View file

@ -17,10 +17,7 @@ def detect(get_page):
for vector in WAF_ATTACK_VECTORS:
page, headers, code = get_page(get=vector)
retval = headers.get("X-Varnish") is not None
retval |= re.search(r"varnish\Z", headers.get(HTTP_HEADER.VIA, ""), re.I) is not None
retval |= re.search(r"varnish", headers.get(HTTP_HEADER.SERVER, ""), re.I) is not None
retval |= code == 404 and re.search(r"\bXID: \d+", page or "") is not None
retval = code == 404 and re.search(r"\bXID: \d+", page or "") is not None
retval |= code >= 400 and "Request rejected by xVarnish-WAF" in (page or "")
if retval:
break