PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-09 22:21:30 +00:00
Code Issues Projects Releases Wiki Activity

Cutting down FP on Varnish WAF (ignoring Varnish Cache)

Browse Source
This commit is contained in:
Miroslav Stampar
2018-08-30 16:02:27 +02:00
parent 014978cebc
commit aefb815064
3 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
waf/varnish.py
View File

@@ -17,10 +17,7 @@ def detect(get_page):
for vector in WAF_ATTACK_VECTORS:
page, headers, code = get_page(get=vector)
retval = headers.get("X-Varnish") is not None
retval |= re.search(r"varnish\Z", headers.get(HTTP_HEADER.VIA, ""), re.I) is not None
retval |= re.search(r"varnish", headers.get(HTTP_HEADER.SERVER, ""), re.I) is not None
retval |= code == 404 and re.search(r"\bXID: \d+", page or "") is not None
retval = code == 404 and re.search(r"\bXID: \d+", page or "") is not None
retval |= code >= 400 and "Request rejected by xVarnish-WAF" in (page or "")
if retval:
break