Add default WAF filter for lightfuzz

bbot/core/helpers/interactsh.py

@@ -234,7 +234,9 @@ async def poll(self):
 
         try:
             r = await self.parent_helper.request(
-                f"https://{self.server}/poll?id={self.correlation_id}&secret={self.secret}", headers=headers
+                f"https://{self.server}/poll?id={self.correlation_id}&secret={self.secret}",
+                headers=headers,
+                timeout=15,
             )
             if r is None:
                 raise InteractshError("Error polling interact.sh: No response from server")

bbot/modules/lightfuzz/lightfuzz.py

@@ -13,11 +13,13 @@ class lightfuzz(BaseModule):
         "force_common_headers": False,
         "enabled_submodules": ["sqli", "cmdi", "xss", "path", "ssti", "crypto", "serial"],
         "disable_post": False,
+        "avoid_wafs": True,
     }
     options_desc = {
         "force_common_headers": "Force emit commonly exploitable parameters that may be difficult to detect",
         "enabled_submodules": "A list of submodules to enable. Empty list enabled all modules.",
         "disable_post": "Disable processing of POST parameters, avoiding form submissions.",
+        "avoid_wafs": "Avoid running against confirmed WAFs, which are likely to block lightfuzz requests",
     }
 
     meta = {
@@ -38,6 +40,7 @@ async def setup(self):
         self.disable_post = self.config.get("disable_post", False)
         self.enabled_submodules = self.config.get("enabled_submodules")
         self.interactsh_disable = self.scan.config.get("interactsh_disable", False)
+        self.avoid_wafs = self.scan.config.get("avoid_wafs", True)
         self.submodules = {}
 
         if not self.enabled_submodules:
@@ -167,8 +170,13 @@ async def finish(self):
             except InteractshError as e:
                 self.debug(f"Error in interact.sh: {e}")
 
-    # If we've disabled fuzzing POST parameters, back out of POSTPARAM WEB_PARAMETER events as quickly as possible
     async def filter_event(self, event):
+        # Unless configured specifically to do so, avoid running against confirmed WAFs
+        if self.avoid_wafs and any(tag in ["cdn-cloudflare", "cdn-akamai", "cdn-incapsula"] for tag in event.tags):
+            self.debug(f"Skipping WEB_PARAMETER because it is likely to be blocked by a WAF. URL: {event.data['url']}")
+            return False
+
+        # If we've disabled fuzzing POST parameters, back out of POSTPARAM WEB_PARAMETER events as quickly as possible
         if event.type == "WEB_PARAMETER" and self.disable_post and event.data["type"] == "POSTPARAM":
             return False, "POST parameter disabled in lightfuzz module"
         return True

bbot/modules/lightfuzz/submodules/base.py

@@ -233,6 +233,7 @@ async def standard_probe(
             "",
             additional_params_populate_empty,
             skip_urlencoding,
+            timeout=timeout,
         )
         request_params.update({"allow_redirects": allow_redirects, "retries": 0, "timeout": timeout})
         self.debug(f"standard_probe requested URL: [{request_params['url']}]")

bbot/presets/web/lightfuzz-heavy.yml

@@ -1,4 +1,4 @@
-description: Discover web parameters and lightly fuzz them for vulnerabilities, with more intense discovery techniques, including POST parameters, which are more invasive. Uses all lightfuzz modules, and adds paramminer modules for parameter discovery.
+description: Discover web parameters and lightly fuzz them for vulnerabilities, with more intense discovery techniques, including POST parameters, which are more invasive. Uses all lightfuzz modules, and adds paramminer modules for parameter discovery. Avoids running against confirmed WAFs.
 
 include:
   - lightfuzz-medium

bbot/presets/web/lightfuzz-light.yml

@@ -12,6 +12,7 @@ config:
     lightfuzz:
       enabled_submodules: [path,sqli,xss] # only look for the most common vulnerabilities
       disable_post: True # don't send POST requests (less aggressive)
+      avoid_wafs: True
 
 conditions:
 - |

bbot/presets/web/lightfuzz-medium.yml

@@ -1,4 +1,4 @@
-description: Discover web parameters and lightly fuzz them for vulnerabilities. Uses all lightfuzz modules, without some of the more intense discovery techniques. Does not send POST requests. This is the default lightfuzz preset; if you're not sure which one to use, this is a good starting point.
+description: Discover web parameters and lightly fuzz them for vulnerabilities. Uses all lightfuzz modules, without some of the more intense discovery techniques. Does not send POST requests. This is the default lightfuzz preset; if you're not sure which one to use, this is a good starting point. Avoids running against confirmed WAFs.
 
 include:
   - lightfuzz-light

bbot/presets/web/lightfuzz-superheavy.yml

@@ -9,5 +9,6 @@ config:
     lightfuzz:
       force_common_headers: True # Fuzz common headers like X-Forwarded-For even if they're not observed on the target
       enabled_submodules: [cmdi,crypto,path,serial,sqli,ssti,xss]
+      avoid_wafs: False
     excavate:
       speculate_params: True # speculate potential parameters extracted from JSON/XML web responses

bbot/presets/web/lightfuzz-xss.yml

@@ -1,4 +1,4 @@
-description: Discover web parameters and lightly fuzz them, limited to just GET-based xss vulnerabilities. This is an example of a custom lightfuzz preset, selectively enabling a single lightfuzz module.
+description: Discover web parameters and lightly fuzz them, limited to just GET-based xss vulnerabilities. Avoids running against confirmed WAFs. This is an example of a custom lightfuzz preset, selectively enabling a single lightfuzz module.
 
 modules:
   - httpx