common

Documentation

Index

• func DetectWaf(httpRequestResponse *wafcommon.HttpRequestResponse) *wafcommon.WafDetection
• func DetectWafFromResponses(httpRequestResponses []*wafcommon.HttpRequestResponse) *wafcommon.WafDetection
• func FingerprintApplicationFirewall(responseBody *string, responseHeaders map[string]string, statusCode *int) *wafcommon.WafFingerprint
• type WafDetectionAccumulator
  • func (a *WafDetectionAccumulator) Add(httpRequestResponse *wafcommon.HttpRequestResponse)
  • func (a *WafDetectionAccumulator) Detection() *wafcommon.WafDetection

Functions

func DetectWaf

func DetectWaf(httpRequestResponse *wafcommon.HttpRequestResponse) *wafcommon.WafDetection

func DetectWafFromResponses

func DetectWafFromResponses(httpRequestResponses []*wafcommon.HttpRequestResponse) *wafcommon.WafDetection

func FingerprintApplicationFirewall

func FingerprintApplicationFirewall(responseBody *string, responseHeaders map[string]string, statusCode *int) *wafcommon.WafFingerprint

FingerprintApplicationFirewall identifies high-confidence evidence that a response was produced or challenged by a WAF. Infrastructure-only evidence such as CDN headers is deliberately ignored.

Types

type WafDetectionAccumulator

type WafDetectionAccumulator struct {
	// contains filtered or unexported fields
}

WafDetectionAccumulator aggregates WAF evidence while retaining at most one representative response per detected provider.

func (*WafDetectionAccumulator) Add

func (a *WafDetectionAccumulator) Add(httpRequestResponse *wafcommon.HttpRequestResponse)

Add scans one response and merges any detected WAF evidence.

func (*WafDetectionAccumulator) Detection

func (a *WafDetectionAccumulator) Detection() *wafcommon.WafDetection

Detection returns the highest-confidence unambiguous provider detection.