Skip to content

fix: improve WAF detection for 7Cups, Airliners, and Apple Discussions#2953

Open
Naraka1337 wants to merge 1 commit into
sherlock-project:masterfrom
Naraka1337:master
Open

fix: improve WAF detection for 7Cups, Airliners, and Apple Discussions#2953
Naraka1337 wants to merge 1 commit into
sherlock-project:masterfrom
Naraka1337:master

Conversation

@Naraka1337
Copy link
Copy Markdown

Summary

Improves core WAF detection logic to resolve false positives on several major sites including 7Cups, Airliners, and Apple Discussions.

Changes

Core Engine (sherlock.py)

  • Added detection for AWS WAF / CloudFront Challenges: Added handling for 202 Accepted status codes and x-amzn-waf-action headers.
  • Added detection for Varnish Proof-of-Work Challenges: Added fingerprinting for the window.POW_CHALLENGE_DATA challenge page.
  • Added detection for Apple Shield Bot Protection: Added fingerprinting for the SecurityVerificationApp class and X-Debug headers.

Testing

  • Verified 7Cups and Airliners now correctly return a WAF verdict for non-existing users (previously reported as Claimed).
  • Verified Apple Discussions correctly fingerprints the security verification page as WAF.
  • Verified the fix for existing users on these sites to ensure accuracy when the tool is challenged.
  • Ran project linting via ruff check and all core offline tests via pytest -m "not online". All checks passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant