Class: HttpMimic::Waf::Detector

Inherits:
Object
  • Object
show all
Defined in:
lib/http_mimic/waf/detector.rb

Class Method Summary collapse

Class Method Details

.akamai?(response) ⇒ Boolean

Returns:

  • (Boolean) 


30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/http_mimic/waf/detector.rb', line 30

def akamai?(response)
  return true if response.headers['set-cookie']&.include?('_abck=')
  return true if response.cookies.key?('_abck') || response.cookies.key?('bm_sz') || response.cookies.key?('ak_bmsc')
  return true if response.headers['x-akamai-transformed'] || response.headers['x-reference-error']

  body = response.body.to_s
  return true if body.include?('Reference Error:') && body.include?('Akamai')
  return true if body.include?('bmak') || body.include?('sensor_data')
  return true if body.include?('sec-if-cpt-container') || body.include?('sec-bc-button-parent')
  return true if body =~ /<script[^>]*src=["\x27]([^"\x27]*\/[a-zA-Z0-9_-]{10,}\?[a-zA-Z0-9_=-]+)["\x27]/

  false
end

.challenge_page?(response) ⇒ Boolean

Returns:

  • (Boolean) 


21
22
23
24
25
26
27
28
 
# File 'lib/http_mimic/waf/detector.rb', line 21

def challenge_page?(response)
  return false unless response
  body = response.body.to_s
  return true if body.include?('sec-if-cpt-container') || body.include?('sec-bc-button-parent')
  return true if body.include?('challenges.cloudflare.com') || body.include?('cf-turnstile')
  return true if body.include?('datadome.captcha') || body.include?('geo.captcha-delivery.com')
  false
end

.cloudflare?(response) ⇒ Boolean

Returns:

  • (Boolean) 


44
45
46
47
48
49
50
 
# File 'lib/http_mimic/waf/detector.rb', line 44

def cloudflare?(response)
  return true if response.headers['server']&.downcase&.include?('cloudflare')
  return true if response.headers['cf-ray'] || response.cookies.key?('cf_clearance')
  return true if response.body.to_s.include?('challenges.cloudflare.com')

  false
end

.datadome?(response) ⇒ Boolean

Returns:

  • (Boolean) 


52
53
54
55
56
57
 
# File 'lib/http_mimic/waf/detector.rb', line 52

def datadome?(response)
  return true if response.headers['x-datadome'] || response.cookies.key?('datadome')
  return true if response.headers['server']&.downcase&.include?('datadome')

  false
end

.detect(response) ⇒ Object 



7
8
9
10
11
12
13
14
15
16
17
18
19
 
# File 'lib/http_mimic/waf/detector.rb', line 7

def detect(response)
  return nil unless response

  if akamai?(response)
    :akamai
  elsif cloudflare?(response)
    :cloudflare
  elsif datadome?(response)
    :datadome
  else
    nil
  end
end