EnableSecurity / wafw00f

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
https://www.enablesecurity.com/
BSD 3-Clause "New" or "Revised" License
5.17k stars 924 forks source link

update f5bigipasm detect pattern #161

Closed hewen-lotus closed 2 years ago

hewen-lotus commented 2 years ago

Some people use custom page on BIG-IP ASM, then the original schemes will not compare. BIG-IP ASM system sets cookies begin with TS, the number of subsequent digits varies with the version, so I append the schema2 pattern.

ref: https://support.f5.com/csp/article/K6850#main

Which category is this pull request?

Where has this been tested?

Does this close any currently open issues?

[Mention any issue which this PR closes] NO

Does this add any new dependency?

[Mention if this PR includes any new library] NO

Does this add any new command line switch/argument?

[Mention if the changes add any new arguments like --arg] NO

Any other comments you would like to make?

[Anything more you'd want the reviewer to know] NO

0xInfection commented 2 years ago

Tested this and looks good. Also didn't notice a lot of sites using the TS* cookie, so most prolly not subject to false positives. Merging this for now, we'll revisit this if an issue gets pulled up in future. :)