Class: HttpMimic::Waf::Detector

Inherits:
Object
  • Object
show all
Defined in:
lib/http_mimic/waf/detector.rb

Class Method Summary collapse

Class Method Details

.akamai?(response) ⇒ Boolean

Returns:

  • (Boolean) 


42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/http_mimic/waf/detector.rb', line 42

def akamai?(response)
  return true if response.headers['set-cookie']&.include?('_abck=')
  return true if response.cookies.key?('_abck') || response.cookies.key?('bm_sz') || response.cookies.key?('ak_bmsc')
  return true if response.headers['x-akamai-transformed'] || response.headers['x-reference-error']

  body = response.body.to_s
  return true if body.include?('Reference Error:') && body.include?('Akamai')
  return true if body.include?('bmak') || body.include?('sensor_data')
  return true if body.include?('sec-if-cpt-container') || body.include?('sec-bc-button-parent')
  return true if body =~ /<script[^>]*src=["\x27]([^"\x27]*\/[a-zA-Z0-9_-]{10,}\?[a-zA-Z0-9_=-]+)["\x27]/

  false
end

.challenge_page?(response) ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
26
27
28
29
30
31
 
# File 'lib/http_mimic/waf/detector.rb', line 23

def challenge_page?(response)
  return false unless response
  body = response.body.to_s
  return true if body.include?('sec-if-cpt-container') || body.include?('sec-bc-button-parent')
  return true if body.include?('challenges.cloudflare.com') || body.include?('cf-turnstile')
  return true if body.include?('datadome.captcha') || body.include?('geo.captcha-delivery.com')
  return true if body.include?('/httpservice/retry/enablejs') || (body.include?('knitsail') && body.include?('SG_SS'))
  false
end

.cloudflare?(response) ⇒ Boolean

Returns:

  • (Boolean) 


56
57
58
59
60
61
62
 
# File 'lib/http_mimic/waf/detector.rb', line 56

def cloudflare?(response)
  return true if response.headers['server']&.downcase&.include?('cloudflare')
  return true if response.headers['cf-ray'] || response.cookies.key?('cf_clearance')
  return true if response.body.to_s.include?('challenges.cloudflare.com')

  false
end

.datadome?(response) ⇒ Boolean

Returns:

  • (Boolean) 


64
65
66
67
68
69
 
# File 'lib/http_mimic/waf/detector.rb', line 64

def datadome?(response)
  return true if response.headers['x-datadome'] || response.cookies.key?('datadome')
  return true if response.headers['server']&.downcase&.include?('datadome')

  false
end

.detect(response) ⇒ Object 



7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
 
# File 'lib/http_mimic/waf/detector.rb', line 7

def detect(response)
  return nil unless response

  if akamai?(response)
    :akamai
  elsif google?(response)
    :google
  elsif cloudflare?(response)
    :cloudflare
  elsif datadome?(response)
    :datadome
  else
    nil
  end
end

.google?(response) ⇒ Boolean

Returns:

  • (Boolean) 


33
34
35
36
37
38
39
40
 
# File 'lib/http_mimic/waf/detector.rb', line 33

def google?(response)
  return false unless response
  body = response.body.to_s
  return true if body.include?('/httpservice/retry/enablejs')
  return true if body.include?('knitsail') && body.include?('SG_SS')
  return true if response.headers['server']&.downcase&.include?('gws') && body.include?('enablejs')
  false
end