signatures.py

#!/usr/bin/env python3
"""
WAF Signature Database
Each WAF entry contains detection vectors across multiple layers:
  - headers: header names whose presence indicates the WAF
  - header_values: {header: [value_patterns]}
  - cookies: cookie name patterns
  - server_signatures: Server header fingerprints
  - body_signatures: HTML/text snippets from block pages
  - block_codes: HTTP status codes commonly returned when blocking
"""

WAF_SIGNATURES = {

    # ── Cloudflare ──
    "Cloudflare": {
        "headers": ["cf-ray", "cf-cache-status", "cf-request-id", "cf-connecting-ip", "cf-ipcountry"],
        "header_values": {
            "server": ["cloudflare"],
            "expect-ct": ["cloudflare"],
        },
        "cookies": ["__cfduid", "__cf_bm", "cf_clearance", "cf_ob_info", "cf_use_ob"],
        "server_signatures": ["cloudflare", "cloudflare-nginx"],
        "body_signatures": [
            "attention required! | cloudflare",
            "cloudflare ray id",
            "error 1020",
            "error 1015",
            "ray id:",
            "please allow up to 5 seconds",
            "checking your browser before accessing",
            "cf-error-details",
            "performance & security by cloudflare",
        ],
        "block_codes": [403, 503, 429],
    },

    # ── AWS WAF ──
    "AWS WAF": {
        "headers": ["x-amzn-requestid", "x-amz-cf-id", "x-amz-cf-pop", "x-amz-rid"],
        "header_values": {
            "server": ["awselb", "amazons3", "amazon cloudfront", "awswaf"],
            "x-amzn-waf-action": ["block", "captcha"],
        },
        "cookies": ["awsalb", "awsalbcors", "aws-waf-token"],
        "server_signatures": ["awselb", "cloudfront", "amazons3"],
        "body_signatures": [
            "request blocked",
            "aws waf",
            "automated access to this page was denied",
        ],
        "block_codes": [403, 503],
    },

    # ── Akamai (Kona/Ghost) ──
    "Akamai": {
        "headers": ["x-akamai-transformed", "akamai-grn", "x-akamai-request-id", "x-akamai-session-info"],
        "header_values": {
            "server": ["akamaighost", "akamainetworks", "akamai"],
            "x-check-cacheable": ["yes", "no"],
        },
        "cookies": ["akamai", "ak_bmsc", "bm_sv", "bm_sz", "_abck", "akavpau"],
        "server_signatures": ["akamaighost", "akamainetworkshttp"],
        "body_signatures": [
            "access denied",
            "akamai technologies",
            "reference #",
            "akamai ghost",
        ],
        "block_codes": [403, 503],
    },

    # ── Imperva / Incapsula ──
    "Imperva / Incapsula": {
        "headers": ["x-iinfo", "x-cdn"],
        "header_values": {
            "x-cdn": ["incapsula", "imperva"],
        },
        "cookies": ["incap_ses", "visid_incap", "nlbi_", "incap_ses_", "__utm_a"],
        "server_signatures": ["imperva"],
        "body_signatures": [
            "incapsula incident id",
            "powered by incapsula",
            "incident id",
            "_incapsula_resource",
            "request unsuccessful. incapsula",
        ],
        "block_codes": [403, 503],
    },

    # ── Sucuri ──
    "Sucuri WAF": {
        "headers": ["x-sucuri-id", "x-sucuri-cache"],
        "header_values": {
            "server": ["sucuri", "sucuri/cloudproxy"],
        },
        "cookies": ["sucuri_cloudproxy"],
        "server_signatures": ["sucuri", "sucuri/cloudproxy"],
        "body_signatures": [
            "sucuri website firewall",
            "access denied - sucuri",
            "sucuri cloudproxy",
            "if you are the site owner",
            "sucuri inc",
        ],
        "block_codes": [403, 503],
    },

    # ── F5 BIG-IP ASM ──
    "F5 BIG-IP ASM": {
        "headers": ["x-wa-info", "x-cnection"],
        "header_values": {
            "server": ["big-ip", "bigip", "f5"],
        },
        "cookies": ["ts", "bigipserver", "bigipserverssl", "f5_cspm", "f5avr", "mrhuserdownleveltag", "bigipserverpool"],
        "server_signatures": ["big-ip", "bigip", "f5-trafficshield"],
        "body_signatures": [
            "the requested url was rejected",
            "please consult with your administrator",
            "your support id is",
            "f5 networks",
        ],
        "block_codes": [403, 501],
    },

    # ── ModSecurity ──
    "ModSecurity": {
        "headers": ["modsecurity"],
        "header_values": {
            "server": ["mod_security", "modsecurity"],
        },
        "cookies": [],
        "server_signatures": ["mod_security", "modsecurity"],
        "body_signatures": [
            "modsecurity",
            "mod_security",
            "this error was generated by mod_security",
            "not acceptable!",
            "method not implemented",
            "rule id",
        ],
        "block_codes": [403, 406, 501],
    },

    # ── Barracuda ──
    "Barracuda WAF": {
        "headers": ["barra_counter_session"],
        "header_values": {},
        "cookies": ["barra_counter_session", "bnn_barracuda"],
        "server_signatures": ["barracuda"],
        "body_signatures": [
            "barracuda networks",
            "barracuda web application firewall",
            "you have been blocked",
            "barra_counter_session",
        ],
        "block_codes": [403, 503],
    },

    # ── Fortinet / FortiWeb ──
    "Fortinet FortiWeb": {
        "headers": ["fortiwafsid"],
        "header_values": {},
        "cookies": ["cookiesession1", "fortiwafsid"],
        "server_signatures": ["fortiweb", "fortigate"],
        "body_signatures": [
            "fortigate",
            "fortiweb",
            ".fgd_icon",
            "the page cannot be displayed",
            "by fortinet",
        ],
        "block_codes": [403, 503],
    },

    # ── Citrix / NetScaler AppFirewall ──
    "Citrix NetScaler AppFW": {
        "headers": ["cneonction", "nncoection", "via"],
        "header_values": {
            "via": ["ns-cache"],
        },
        "cookies": ["citrix_ns_id", "nsc_", "ns_af", "ns_s"],
        "server_signatures": ["netscaler"],
        "body_signatures": [
            "netscaler",
            "ns_af=",
            "citrix",
            "application firewall",
            "appfw session",
        ],
        "block_codes": [403, 503],
    },

    # ── Wordfence (WordPress) ──
    "Wordfence": {
        "headers": ["wf-cache"],
        "header_values": {},
        "cookies": ["wfvt_", "wordfence", "wf_loginalerted"],
        "server_signatures": [],
        "body_signatures": [
            "generated by wordfence",
            "wordfence",
            "this response was generated by wordfence",
            "your access to this site has been limited",
            "a potentially unsafe operation has been detected",
        ],
        "block_codes": [403, 503],
    },

    # ── Azure Front Door / WAF ──
    "Azure Front Door WAF": {
        "headers": ["x-azure-ref", "x-fd-healthprobe", "x-ms-request-id"],
        "header_values": {
            "server": ["microsoft-azure-application-gateway"],
        },
        "cookies": [],
        "server_signatures": ["microsoft-azure-application-gateway", "microsoft-iis"],
        "body_signatures": [
            "azure front door",
            "microsoft azure web application firewall",
            "this request was blocked by azure",
        ],
        "block_codes": [403, 503],
    },

    # ── Google Cloud Armor ──
    "Google Cloud Armor": {
        "headers": ["x-goog-iap-generated-response"],
        "header_values": {
            "server": ["gws", "gfe", "google frontend"],
            "via": ["google"],
        },
        "cookies": [],
        "server_signatures": ["gws", "gfe", "google frontend"],
        "body_signatures": [
            "google cloud armor",
            "cloud armor blocked this request",
            "error: forbidden",
        ],
        "block_codes": [403, 503],
    },

    # ── StackPath (formerly MaxCDN/Highwinds) ──
    "StackPath WAF": {
        "headers": ["x-sp-url", "x-sp-wl", "x-hw"],
        "header_values": {},
        "cookies": [],
        "server_signatures": ["stackpath", "netdna", "highwinds"],
        "body_signatures": [
            "stackpath",
            "site protection is enabled",
        ],
        "block_codes": [403, 503],
    },

    # ── DDoS-Guard ──
    "DDoS-Guard": {
        "headers": ["x-ddos-protection"],
        "header_values": {
            "server": ["ddos-guard"],
        },
        "cookies": ["__ddg1_", "__ddg2_", "__ddgid_", "__ddgmark_"],
        "server_signatures": ["ddos-guard"],
        "body_signatures": [
            "ddos-guard",
            "ddos protection by",
        ],
        "block_codes": [403, 503],
    },

    # ── Wallarm ──
    "Wallarm": {
        "headers": ["x-wallarm-waf-check"],
        "header_values": {},
        "cookies": [],
        "server_signatures": ["wallarm"],
        "body_signatures": [
            "wallarm",
            "nginx-wallarm",
        ],
        "block_codes": [403],
    },

    # ── Reblaze ──
    "Reblaze": {
        "headers": ["rbzid", "x-rbz"],
        "header_values": {},
        "cookies": ["rbzid", "rbzsessionid"],
        "server_signatures": ["reblaze"],
        "body_signatures": [
            "reblaze",
            "access denied (reblaze)",
        ],
        "block_codes": [403, 503],
    },

    # ── Radware / AppWall ──
    "Radware AppWall": {
        "headers": ["x-sl-compstate"],
        "header_values": {},
        "cookies": [],
        "server_signatures": ["radware"],
        "body_signatures": [
            "radware",
            "unauthorized activity has been detected",
            "appwall",
        ],
        "block_codes": [403, 503],
    },

    # ── SiteLock ──
    "SiteLock TrueShield": {
        "headers": [],
        "header_values": {},
        "cookies": [],
        "server_signatures": ["sitelock"],
        "body_signatures": [
            "sitelock",
            "trueshield",
            "sitelock is the global leader",
        ],
        "block_codes": [403],
    },

    # ── Palo Alto Networks ──
    "Palo Alto Networks": {
        "headers": [],
        "header_values": {},
        "cookies": [],
        "server_signatures": [],
        "body_signatures": [
            "has been blocked in accordance with company policy",
            "palo alto networks",
            "this page is blocked",
        ],
        "block_codes": [403, 503],
    },

    # ── Comodo WAF ──
    "Comodo WAF": {
        "headers": [],
        "header_values": {
            "server": ["comodo"],
        },
        "cookies": [],
        "server_signatures": ["comodo"],
        "body_signatures": [
            "comodo waf",
            "protected by comodo",
        ],
        "block_codes": [403],
    },

    # ── Fastly ──
    "Fastly WAF": {
        "headers": ["x-fastly-request-id", "fastly-restarts"],
        "header_values": {
            "via": ["varnish"],
            "x-served-by": ["cache-"],
        },
        "cookies": [],
        "server_signatures": ["fastly"],
        "body_signatures": [
            "fastly error",
            "fastly cdn",
        ],
        "block_codes": [403, 503],
    },

    # ── Edgecast / Verizon ──
    "Edgecast / Verizon WAF": {
        "headers": ["x-ec-custom-error", "server-timing"],
        "header_values": {
            "server": ["ecs", "ecd"],
        },
        "cookies": [],
        "server_signatures": ["ecs", "ecd"],
        "body_signatures": [],
        "block_codes": [403],
    },

    # ── LiteSpeed / LSWS ──
    "LiteSpeed WAF": {
        "headers": [],
        "header_values": {
            "server": ["litespeed"],
        },
        "cookies": [],
        "server_signatures": ["litespeed"],
        "body_signatures": [
            "litespeed web server",
            "request blocked by litespeed web app firewall",
        ],
        "block_codes": [403],
    },

    # ── Varnish (+Security) ──
    "Varnish + Security Module": {
        "headers": ["x-varnish", "x-varnish-cache"],
        "header_values": {
            "via": ["varnish"],
        },
        "cookies": [],
        "server_signatures": ["varnish"],
        "body_signatures": [
            "varnish cache server",
            "error 403 naughty",
            "guru meditation",
        ],
        "block_codes": [403, 503],
    },

    # ── Shield Security (WordPress) ──
    "Shield Security": {
        "headers": [],
        "header_values": {},
        "cookies": [],
        "server_signatures": [],
        "body_signatures": [
            "shield security",
            "one of its security rules has been triggered",
        ],
        "block_codes": [403],
    },

    # ── Alibaba Cloud WAF ──
    "Alibaba Cloud WAF": {
        "headers": ["x-server-id"],
        "header_values": {
            "server": ["tengine"],
        },
        "cookies": ["aliyungf_tc", "ali_beacon_id"],
        "server_signatures": ["tengine"],
        "body_signatures": [
            "errors.aliyun.com",
            "alibaba cloud",
        ],
        "block_codes": [403, 405],
    },

    # ── Tencent Cloud WAF ──
    "Tencent Cloud WAF": {
        "headers": [],
        "header_values": {},
        "cookies": ["tgw_l7_route"],
        "server_signatures": [],
        "body_signatures": [
            "waf.tencent-cloud.com",
            "tencent cloud web application firewall",
        ],
        "block_codes": [403],
    },

    # ── Qrator ──
    "Qrator": {
        "headers": [],
        "header_values": {},
        "cookies": ["qrator_jsid", "qrator_ssid"],
        "server_signatures": ["qrator"],
        "body_signatures": [
            "qrator",
            "qrator labs",
        ],
        "block_codes": [403, 503],
    },
}