#!/usr/bin/env python
__author__ = "SadLin"

from lib.match_rule import match_type


NAME = 'Trustwave ModSecurity'


def is_waf(respDict):
    # the following based on nmap's http-waf-fingerprint.nse
    if match_type.match_header(respDict,('Server', '(mod_security|Mod_Security|NOYB)')): #from sqlmap waf
        return True
    if match_type.match_status_content(respDict,(501,"Reference #[0-9A-Fa-f.]+")):  #from sqlmap waf modsecurity
        return  True
    if match_type.match_content(respDict, "This error was generated by Mod_Security"): #from sqlmap waf modsecurity
        return  True
    return False
