appsec-bot-challenge-detect-cpu-arch

1name: crowdsecurity/appsec-bot-challenge-detect-cpu-arch
2# CPU architecture against the platform claimed.
3#
4# The shipped module reports the bytes of 0.0/0.0 as computed by a small
5# WebAssembly module: the spec leaves an arithmetic NaN's bit pattern
6# implementation-defined, so the answer identifies the processor executing.
7#
8#   x86 -> "0000c0ff"      arm -> "0000c07f"
9#
10# Only iOS and Android are checked. Phones and tablets on either are ARM.
11#
12# Requires 'wasm-unsafe-eval' in the challenge CSP (crowdsec 1.8+).
13data:
14  - source_url: https://hub-data.crowdsec.net/custom-bot-detections/cpu-arch-v1.js
15    dest_file: challenge/cpu-arch.js
16    type: challenge-js
17
18inband:
19  on_challenge_submit:
20    - filter: >-
21        (req.UserAgent() contains "iPhone" || req.UserAgent() contains "iPad") &&
22        fingerprint.Custom["cfArchNan"].Str == "0000c0ff"
23      apply:
24        - AddRequestScore(0, "arm_platform_on_x86_ios", "detect-experimental-cpu")  # intended weight: 100
25
26    - filter: >-
27        req.UserAgent() contains "Android" &&
28        fingerprint.Custom["cfArchNan"].Str == "0000c0ff"
29      apply:
30        - AddRequestScore(0, "arm_platform_on_x86_android", "detect-experimental-cpu")  # intended weight: 100
31
32    # Also track skips.
33    - filter: '!fingerprint.HasCustom("cfArchNan")'
34      apply:
35        - AddRequestScore(0, "missing_cf_arch_nan", "detect-experimental-cpu")  # intended weight: 50