appsec-bot-challenge-detect-headers

1name: crowdsecurity/appsec-bot-challenge-detect-headers
2# Client hints against the user agent string.
3#
4# Ships no JavaScript. Each rule is guarded on the hint actually being present,
5# so deployments where the browser sends none (plain HTTP, or a browser that
6# does not implement client hints) score nothing rather than everything.
7inband:
8  on_challenge_submit:
9    - filter: >-
10        req.Header.Get("Sec-CH-UA-Platform") != "" &&
11        req.UserAgent() contains "Windows NT" &&
12        !(req.Header.Get("Sec-CH-UA-Platform") contains "Windows")
13      apply:
14        - AddRequestScore(0, "ch_platform_windows", "detect-experimental-headers")  # intended weight: 100
15
16    - filter: >-
17        req.Header.Get("Sec-CH-UA-Platform") != "" &&
18        req.UserAgent() contains "Android" &&
19        !(req.Header.Get("Sec-CH-UA-Platform") contains "Android")
20      apply:
21        - AddRequestScore(0, "ch_platform_android", "detect-experimental-headers")  # intended weight: 100
22
23    - filter: >-
24        req.Header.Get("Sec-CH-UA-Platform") != "" &&
25        req.UserAgent() contains "Mac OS X" &&
26        !(req.UserAgent() contains "iPhone") &&
27        !(req.Header.Get("Sec-CH-UA-Platform") contains "macOS")
28      apply:
29        - AddRequestScore(0, "ch_platform_macos", "detect-experimental-headers")  # intended weight: 100
30
31    # Every browser on iOS is WebKit and implements no client hints, wrappers
32    # (CriOS/EdgiOS/FxiOS) included.
33    - filter: 'req.UserAgent() contains "iPhone" && req.Header.Get("Sec-CH-UA") != ""'
34      apply:
35        - AddRequestScore(0, "ios_sends_client_hints", "detect-experimental-headers")  # intended weight: 100