# DAST WAF Detection Module

> **Module**: pentest-dast-waf
> **Version**: 1.0.0
> **Source**: DAST Scanner v5 - waf_detector.py + advanced_detector.py
> **WAFs**: 21 types avec bypass hints

---

## Vue d'Ensemble

Ce module permet de detecter les WAF (Web Application Firewalls) et CDN, avec des techniques de bypass pour chaque type.

**Methodes de detection**:
- Headers HTTP
- Cookies
- Patterns dans le body
- Analyse comportementale

---

## 1. SIGNATURES WAF (21 Types)

### 1.1 Cloudflare
```yaml
type: CLOUDFLARE
confidence: 0.99

headers:
  - name: cf-ray
    pattern: ".+"
    confidence: 0.99
  - name: cf-request-id
    pattern: ".+"
    confidence: 0.95
  - name: cf-cache-status
    pattern: ".+"
    confidence: 0.90
  - name: server
    pattern: "cloudflare"
    confidence: 0.99

cookies:
  - name: __cfduid
    confidence: 0.95
  - name: __cf_bm
    confidence: 0.95
  - name: cf_clearance
    confidence: 0.90

body_patterns:
  - pattern: "cloudflare"
    confidence: 0.70
  - pattern: "error code: 1020"
    confidence: 0.99
  - pattern: "attention required! \\| cloudflare"
    confidence: 0.99
  - pattern: "ray id:"
    confidence: 0.80
  - pattern: "Cloudflare Ray ID:"
    confidence: 0.99
  - pattern: "cf\\.errors\\."
    confidence: 0.80

bypass_hints:
  - "Trouver l'IP origine via DNS history (SecurityTrails, ViewDNS)"
  - "Chercher IP leak dans emails, pages erreur, ou certificats SSL"
  - "Essayer acces via IPv6 si non proxie"
  - "Verifier les sous-domaines qui pourraient bypasser Cloudflare"
  - "Utiliser cf-connecting-ip header manipulation"
  - "Unicode normalization bypass"
  - "Chunked encoding bypass"
```

### 1.2 AWS WAF
```yaml
type: AWS_WAF
confidence: 0.95

headers:
  - name: x-amzn-waf-*
    pattern: ".+"
    confidence: 0.99
  - name: x-amzn-requestid
    pattern: ".+"
    confidence: 0.70
  - name: x-amz-cf-id
    pattern: ".+"
    confidence: 0.80
  - name: x-amz-apigw-id
    pattern: ".+"
    confidence: 0.70

body_patterns:
  - pattern: "Request blocked by AWS WAF"
    confidence: 0.99
  - pattern: "AWSWAF"
    confidence: 0.95
  - pattern: "Request blocked"
    confidence: 0.50

block_status: [403, 503]

bypass_hints:
  - "Tester les seuils de rate limiting"
  - "Essayer differentes methodes HTTP"
  - "Utiliser des variations d'URL encoding"
  - "API Gateway bypass"
  - "Lambda@Edge origin bypass"
  - "Case variation bypass"
```

### 1.3 AWS CloudFront
```yaml
type: AWS_CLOUDFRONT
confidence: 0.95

headers:
  - name: x-amz-cf-id
    pattern: ".+"
    confidence: 0.99
  - name: x-amz-cf-pop
    pattern: ".+"
    confidence: 0.95
  - name: via
    pattern: ".*CloudFront"
    confidence: 0.99
  - name: x-cache
    pattern: "(hit|miss) from cloudfront"
    confidence: 0.95

bypass_hints:
  - "Chercher le serveur origine via headers"
  - "Essayer acces IP direct si origine exposee"
  - "Origin bypass via S3"
  - "Lambda@Edge manipulation"
```

### 1.4 Akamai
```yaml
type: AKAMAI
confidence: 0.99

headers:
  - name: x-akamai-transformed
    pattern: ".+"
    confidence: 0.99
  - name: akamai-ghost-*
    pattern: ".+"
    confidence: 0.95
  - name: x-akamai-staging
    pattern: ".+"
    confidence: 0.90
  - name: server
    pattern: "AkamaiGHost|AkamaiNetStorage"
    confidence: 0.99

cookies:
  - name: _abck
    confidence: 0.80
  - name: bm_sv
    confidence: 0.80
  - name: ak_bmsc
    confidence: 0.90

body_patterns:
  - pattern: "Reference.*akamai"
    confidence: 0.90
  - pattern: "AK_REF"
    confidence: 0.95
  - pattern: "Access Denied.*Akamai"
    confidence: 0.99

bypass_hints:
  - "Chercher origine dans environnements staging/dev"
  - "Techniques de cache poisoning"
  - "Edge server origin bypass"
  - "HTTP/2 specific bypasses"
  - "Pragma header manipulation"
```

### 1.5 Imperva (Incapsula)
```yaml
type: IMPERVA
confidence: 0.99

headers:
  - name: x-iinfo
    pattern: ".+"
    confidence: 0.99
  - name: x-cdn
    pattern: "Incapsula"
    confidence: 0.99

cookies:
  - name: incap_ses_*
    confidence: 0.99
  - name: visid_incap_*
    confidence: 0.99
  - name: nlbi_*
    confidence: 0.95

body_patterns:
  - pattern: "Incapsula incident ID"
    confidence: 0.99
  - pattern: "Request blocked by Imperva"
    confidence: 0.99
  - pattern: "powered by Incapsula"
    confidence: 0.90
  - pattern: "incapsula\\.com"
    confidence: 0.80
  - pattern: "_incapsula_resource"
    confidence: 0.99

bypass_hints:
  - "Manipulation header XFF"
  - "Tester avec differents user agents"
  - "Chercher entries robots.txt"
  - "Real IP discovery via email headers"
  - "CNAME subdomain takeover check"
  - "HTTP method override"
```

### 1.6 F5 Big-IP
```yaml
type: F5_BIGIP
confidence: 0.99

headers:
  - name: server
    pattern: "BigIP|BIG-IP"
    confidence: 0.99
  - name: x-wa-info
    pattern: ".+"
    confidence: 0.90

cookies:
  - name: BIGipServer*
    confidence: 0.99
  - name: f5_cspm
    confidence: 0.95
  - name: TS[a-z0-9]+
    confidence: 0.70

body_patterns:
  - pattern: "The requested URL was rejected"
    confidence: 0.90
  - pattern: "Request rejected by.*BIG-IP"
    confidence: 0.99
  - pattern: "F5 Access Policy"
    confidence: 0.95
  - pattern: "f5 networks"
    confidence: 0.90

bypass_hints:
  - "HTTP parameter pollution"
  - "Tester avec differents content types"
  - "Cookie manipulation via BIGipServer"
  - "Backend IP extraction from cookie"
  - "Protocol level bypass"

cookie_decode: |
  Le cookie BIGipServer contient souvent l'IP du backend:
  1. Decoder le cookie: echo $COOKIE | base64 -d
  2. Ou: perl -e 'print pack("h*", reverse(split(/\./, $ARGV[0])))' $COOKIE
```

### 1.7 ModSecurity
```yaml
type: MODSECURITY
confidence: 0.95

headers:
  - name: server
    pattern: "mod_security|ModSecurity|NOYB"
    confidence: 0.99

body_patterns:
  - pattern: "ModSecurity"
    confidence: 0.95
  - pattern: "OWASP ModSecurity Core Rule Set"
    confidence: 0.99
  - pattern: "This error was generated by Mod_Security"
    confidence: 0.99
  - pattern: "mod_security.*block"
    confidence: 0.90
  - pattern: "Rule ID:"
    confidence: 0.80
  - pattern: "not acceptable"
    confidence: 0.50

block_status: [403, 406]

bypass_hints:
  - "Variations de case dans les payloads"
  - "URL encoding"
  - "Null bytes et commentaires"
  - "Payload encoding (base64, hex, unicode)"
  - "Comment injection dans SQL"
  - "Whitespace variations"
  - "HTTP parameter pollution"

common_bypasses:
  sqli:
    - "/*!50000UNION*/+/*!50000SELECT*/"
    - "UN/**/ION+SEL/**/ECT"
    - "UNION%0aSELECT"
  xss:
    - "<svg/onload=alert(1)>"
    - "<img src=x onerror=alert`1`>"
```

### 1.8 Fortinet (FortiWeb)
```yaml
type: FORTIWEB
confidence: 0.99

headers:
  - name: server
    pattern: "FortiWeb"
    confidence: 0.99

cookies:
  - name: FORTIWAFSID
    confidence: 0.99

body_patterns:
  - pattern: "FortiWeb"
    confidence: 0.95
  - pattern: "Fortinet"
    confidence: 0.70
  - pattern: "fgd_icon"
    confidence: 0.90

bypass_hints:
  - "XML-based bypass"
  - "Content-Type manipulation"
  - "Alternate encodings"
  - "Parameter pollution"
```

### 1.9 Barracuda
```yaml
type: BARRACUDA
confidence: 0.99

headers:
  - name: server
    pattern: "Barracuda"
    confidence: 0.99

cookies:
  - name: barra_counter_session
    confidence: 0.99
  - name: barracuda*
    confidence: 0.95

body_patterns:
  - pattern: "Barracuda Networks"
    confidence: 0.95
  - pattern: "You are being blocked"
    confidence: 0.60

bypass_hints:
  - "HPP bypass"
  - "Double encoding"
  - "Chunked transfer encoding"
```

### 1.10 Sucuri
```yaml
type: SUCURI
confidence: 0.99

headers:
  - name: x-sucuri-id
    pattern: ".+"
    confidence: 0.99
  - name: x-sucuri-cache
    pattern: ".+"
    confidence: 0.95
  - name: server
    pattern: "Sucuri"
    confidence: 0.99

cookies:
  - name: sucuri_cloudproxy*
    confidence: 0.99

body_patterns:
  - pattern: "Sucuri Website Firewall"
    confidence: 0.99
  - pattern: "sucuri\\.net"
    confidence: 0.90
  - pattern: "Access Denied.*Sucuri"
    confidence: 0.95
  - pattern: "CloudProxy"
    confidence: 0.80

bypass_hints:
  - "Trouver origine via DNS history"
  - "Verifier MX records pour IP origine"
  - "Subdomain enumeration bypass"
```

### 1.11 Wordfence
```yaml
type: WORDFENCE
confidence: 0.95

cookies:
  - name: wfwaf-*
    confidence: 0.99
  - name: wordfence_verifiedHuman
    confidence: 0.99

body_patterns:
  - pattern: "Generated by Wordfence"
    confidence: 0.99
  - pattern: "wordfence"
    confidence: 0.80
  - pattern: "Your access to this site has been limited"
    confidence: 0.70

bypass_hints:
  - "WordPress-specific bypasses"
  - "Plugin enumeration first"
  - "Tester avec differents user agents"
```

### 1.12 Azure WAF
```yaml
type: AZURE_WAF
confidence: 0.90

headers:
  - name: x-azure-ref
    pattern: ".+"
    confidence: 0.95
  - name: x-ms-request-id
    pattern: ".+"
    confidence: 0.70
  - name: x-fd-healthprobe
    pattern: ".+"
    confidence: 0.80

body_patterns:
  - pattern: "Azure"
    confidence: 0.40
  - pattern: "Request blocked"
    confidence: 0.50

bypass_hints:
  - "Azure Front Door origin discovery"
  - "X-Forwarded-Host manipulation"
  - "Check for exposed Azure endpoints"
```

### 1.13 Google Cloud Armor
```yaml
type: GCP_ARMOR
confidence: 0.90

headers:
  - name: x-goog-*
    pattern: ".+"
    confidence: 0.70
  - name: via
    pattern: ".*google"
    confidence: 0.60
  - name: server
    pattern: "Google Frontend"
    confidence: 0.90

body_patterns:
  - pattern: "Cloud Armor"
    confidence: 0.99
  - pattern: "Google Cloud"
    confidence: 0.50

bypass_hints:
  - "IP-based rules bypass"
  - "Geographic bypass"
  - "Look for direct GCE/GKE access"
```

### 1.14 Fastly
```yaml
type: FASTLY
confidence: 0.95

headers:
  - name: x-served-by
    pattern: ".*cache.*"
    confidence: 0.90
  - name: x-cache
    pattern: ".*"
    confidence: 0.70
  - name: x-timer
    pattern: ".+"
    confidence: 0.80
  - name: via
    pattern: ".*Fastly.*"
    confidence: 0.99
  - name: fastly-*
    pattern: ".+"
    confidence: 0.95

body_patterns:
  - pattern: "Fastly"
    confidence: 0.70
  - pattern: "fastly error"
    confidence: 0.95

bypass_hints:
  - "Varnish-based bypass techniques"
  - "Cache poisoning"
  - "Look for origin headers"
```

### 1.15 Wallarm
```yaml
type: WALLARM
confidence: 0.99

headers:
  - name: x-wallarm-*
    pattern: ".+"
    confidence: 0.99

body_patterns:
  - pattern: "wallarm"
    confidence: 0.95

bypass_hints:
  - "API-specific bypass techniques"
  - "Rate limiting threshold testing"
```

### 1.16 Citrix (NetScaler)
```yaml
type: CITRIX
confidence: 0.95

headers:
  - name: via
    pattern: "ns-cache"
    confidence: 0.95
  - name: cneonction  # Typo header specifique Citrix
    pattern: ".+"
    confidence: 0.90

cookies:
  - name: citrix_ns_id
    confidence: 0.99
  - name: nsc_*
    confidence: 0.90

body_patterns:
  - pattern: "citrix"
    confidence: 0.80
  - pattern: "netscaler"
    confidence: 0.95

bypass_hints:
  - "HTTP request smuggling"
  - "Header injection"
```

### 1.17 Radware
```yaml
type: RADWARE
confidence: 0.90

headers:
  - name: x-sl-compstate
    pattern: ".+"
    confidence: 0.95

body_patterns:
  - pattern: "radware"
    confidence: 0.90
  - pattern: "unauthorized activity"
    confidence: 0.70

bypass_hints:
  - "Obfuscated payloads"
  - "Encoding variations"
```

### 1.18 Nginx WAF
```yaml
type: NGINX_WAF
confidence: 0.70

headers:
  - name: server
    pattern: "nginx"
    confidence: 0.40  # Besoin confirmation supplementaire

body_patterns:
  - pattern: "Request Rejected"
    confidence: 0.50
  - pattern: "nginx"
    confidence: 0.30

block_status: [403, 444]  # 444 est specifique nginx

bypass_hints:
  - "Request line manipulation"
  - "HTTP/0.9 downgrade"
```

### 1.19 Apache WAF
```yaml
type: APACHE_WAF
confidence: 0.70

headers:
  - name: server
    pattern: "Apache"
    confidence: 0.40

bypass_hints:
  - "Similar to ModSecurity bypasses"
```

### 1.20 StackPath
```yaml
type: STACKPATH
confidence: 0.90

headers:
  - name: x-sp-*
    pattern: ".+"
    confidence: 0.95

bypass_hints:
  - "Edge node bypass"
  - "Origin IP discovery"
```

### 1.21 EdgeCast
```yaml
type: EDGECAST
confidence: 0.90

headers:
  - name: x-ec-*
    pattern: ".+"
    confidence: 0.95

bypass_hints:
  - "CDN cache bypass"
```

---

## 2. PAYLOADS DE DECLENCHEMENT WAF

Ces payloads sont concus pour declencher les WAFs et confirmer leur presence:

```yaml
waf_trigger_payloads:
  xss:
    - "<script>alert(1)</script>"
    - '"><img src=x onerror=alert(1)>'

  sqli:
    - "' OR '1'='1"
    - "1' UNION SELECT NULL--"
    - "1; DROP TABLE users--"

  command_injection:
    - "; cat /etc/passwd"
    - "| id"

  path_traversal:
    - "../../../etc/passwd"
    - "..\\..\\..\\windows\\system32\\config\\sam"

  xxe:
    - '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'

  ssrf:
    - "http://169.254.169.254/latest/meta-data/"

  common_attack_strings:
    - "UNION SELECT"
    - "SELECT * FROM"
    - "/bin/bash"
    - "cmd.exe"
```

---

## 3. DETECTION COMPORTEMENTALE

### Methode de Detection par Comportement
```yaml
behavior_detection:
  test_payloads:
    - payload: "?test=normal"
      type: "normal"
    - payload: "?test=<script>alert(1)</script>"
      type: "xss"
    - payload: "?test=' OR '1'='1"
      type: "sqli"
    - payload: "?test=../../../etc/passwd"
      type: "lfi"

  blocking_indicators:
    status_codes: [403, 406, 429, 503]
    body_patterns:
      - "blocked"
      - "access denied"
      - "forbidden"
      - "not acceptable"
      - "firewall"
      - "security violation"
      - "malicious"

  detection_logic: |
    1. Envoyer requete normale, noter le status
    2. Envoyer payloads malveillants
    3. Si status change vers blocking_indicators = WAF present
    4. Confiance = 0.5 + (blocked_count * 0.15), max 0.9
```

---

## 4. DETECTION STACK TECHNOLOGIQUE

En complement de la detection WAF, identifier la stack:

### Frameworks Frontend
```yaml
react:
  patterns:
    - "react\\.production\\.min\\.js"
    - "_reactRootContainer"
    - "data-reactroot"
    - "__REACT_DEVTOOLS_GLOBAL_HOOK__"

vue:
  patterns:
    - "vue\\.runtime\\.esm\\.js"
    - "data-v-[a-f0-9]{8}"
    - "__VUE__"
    - "v-bind:"

angular:
  patterns:
    - 'ng-version="(\\d+)"'
    - "\\[ngClass\\]"
    - "ng-app"

nextjs:
  patterns:
    - "_next/static"
    - "__NEXT_DATA__"
  headers:
    - "x-powered-by: Next.js"

nuxt:
  patterns:
    - "_nuxt/"
    - "__NUXT__"
```

### Frameworks Backend
```yaml
symfony:
  patterns:
    - "sf-toolbar"
    - "_profiler"
  headers:
    - "x-debug-token"
    - "x-debug-token-link"
  cookies:
    - "PHPSESSID"
    - "symfony"

laravel:
  patterns:
    - "laravel_session"
    - '<input[^>]+name="_token"'
  cookies:
    - "XSRF-TOKEN"
    - "laravel_session"

django:
  patterns:
    - "csrfmiddlewaretoken"
    - "django\\.contrib"
  cookies:
    - "csrftoken"
    - "sessionid"

spring_boot:
  patterns:
    - "Whitelabel Error Page"
    - "org\\.springframework"
    - "/actuator"
  headers:
    - "x-application-context"
  cookies:
    - "JSESSIONID"

express:
  headers:
    - "x-powered-by: Express"
  cookies:
    - "connect.sid"

nestjs:
  patterns:
    - "@nestjs"
    - "NestJS"

rails:
  patterns:
    - "csrf-token"
    - "data-turbolinks"
  headers:
    - "x-runtime"
  cookies:
    - "_session_id"

asp_net:
  patterns:
    - "__VIEWSTATE"
    - "__EVENTVALIDATION"
    - "aspnetForm"
  headers:
    - "x-powered-by: ASP.NET"
    - "x-aspnet-version"
  cookies:
    - "ASP.NET_SessionId"
    - ".ASPXAUTH"
```

### Serveurs Web
```yaml
nginx:
  headers:
    - "server: nginx/?([0-9.]+)?"

apache:
  headers:
    - "server: Apache/?([0-9.]+)?"

iis:
  headers:
    - "server: Microsoft-IIS/?([0-9.]+)?"

tomcat:
  headers:
    - "server: Apache-Coyote"
    - "server: Tomcat"
```

### CMS
```yaml
wordpress:
  patterns:
    - "/wp-content/"
    - "/wp-includes/"
    - "/wp-admin/"
    - "wp-emoji"
    - '<meta name="generator" content="WordPress'
  cookies:
    - "wordpress_"

drupal:
  patterns:
    - "Drupal\\.settings"
    - "/sites/default/files/"
  headers:
    - "x-drupal-cache"
    - "x-generator: Drupal"

joomla:
  patterns:
    - "/media/jui/"
    - "/components/com_"
    - '<meta name="generator" content="Joomla'
```

---

## 5. RECOMMANDATIONS PAR FRAMEWORK

Apres detection du framework, recommandations de pentest:

```yaml
recommendations:
  symfony:
    - "Check for /_profiler, app_dev.php exposure"
    - "Test for Symfony serialization vulnerabilities"
    - "Look for exposed _fragment route"

  laravel:
    - "Check for .env file exposure"
    - "Test for Laravel debug mode (Ignition)"
    - "Check storage/logs/laravel.log"
    - "Test CVE-2024-52301 (argv manipulation)"

  django:
    - "Check for DEBUG=True exposure"
    - "Test for Django admin brute force"
    - "Check for exposed settings"

  spring_boot:
    - "Check /actuator endpoints"
    - "Test for SpEL injection"
    - "Check for H2 console exposure"

  wordpress:
    - "Enumerate plugins and themes"
    - "Check for xmlrpc.php abuse"
    - "Test wp-admin brute force"
    - "Check for exposed wp-config.php.bak"

  nestjs:
    - "Check for @nestjs/devtools-integration"
    - "Test GraphQL introspection"
    - "Check for rate limiting"
```

---

## 6. SCORE DE SECURITE

Calcul automatique du score de securite cible:

```yaml
security_score:
  baseline: 50

  bonuses:
    waf_present: +20
    robust_waf: +10  # Cloudflare, Akamai, Imperva
    modern_framework: +10  # Django, Rails, Spring Boot, NestJS, FastAPI

  penalties:
    popular_cms: -10  # WordPress, Drupal, Joomla
    debug_visible: -20  # sf-toolbar, DEBUG=True
    old_framework: -10

  interpretation:
    "0-30": "Facile a attaquer"
    "31-50": "Securite moyenne"
    "51-70": "Bonne securite"
    "71-90": "Tres securise"
    "91-100": "Excellent"
```

---

## 7. WORKFLOW DE DETECTION

```
┌─────────────────────────────────────────────────────────────┐
│                    WORKFLOW DETECTION WAF                    │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  1. REQUETE NORMALE                                         │
│     └─ GET / HTTP/1.1                                       │
│     └─ Analyser headers, cookies, body                      │
│                                                              │
│  2. COMPARER AVEC SIGNATURES                                │
│     └─ Pour chaque WAF dans WAF_SIGNATURES                  │
│     └─ Calculer score de confiance                          │
│     └─ Collecter evidences                                  │
│                                                              │
│  3. DETECTION COMPORTEMENTALE (optionnel)                   │
│     └─ Envoyer payload normal                               │
│     └─ Envoyer payloads malveillants                        │
│     └─ Comparer reponses                                    │
│                                                              │
│  4. IDENTIFICATION STACK                                     │
│     └─ Frontend framework                                   │
│     └─ Backend framework                                    │
│     └─ Web server                                           │
│     └─ CMS                                                  │
│                                                              │
│  5. RAPPORT                                                 │
│     └─ WAF detecte (type, confiance, evidences)            │
│     └─ Bypass hints                                         │
│     └─ Stack technologique                                  │
│     └─ Recommandations pentest                              │
│     └─ Score de securite                                    │
│                                                              │
└─────────────────────────────────────────────────────────────┘
```

---

## 8. EXEMPLE DE RAPPORT

```markdown
## WAF Detection Report

### WAF Detecte
| Attribut | Valeur |
|----------|--------|
| Type | CLOUDFLARE |
| Confiance | 99% |
| Evidences | cf-ray: 123abc, server: cloudflare |

### Bypass Hints
1. Trouver l'IP origine via DNS history
2. Chercher IP leak dans emails ou SSL certs
3. Essayer acces via IPv6
4. Verifier les sous-domaines

### Stack Technologique
| Layer | Technologie |
|-------|-------------|
| Frontend | React 18.x |
| Backend | NestJS |
| Server | Nginx |
| CDN | Cloudflare |

### Recommandations
1. Tester @nestjs/devtools-integration
2. Verifier GraphQL introspection
3. Tester rate limiting avec bypass Cloudflare

### Score Securite: 85/100
- WAF present (+20)
- WAF robuste (+10)
- Framework moderne (+10)
- Baseline (+50)
- Pas de debug visible (+0)
```

---

*Module genere depuis DAST Scanner v5 - waf_detector.py + advanced_detector.py*
*21 WAFs avec bypass hints et detection stack technologique*
