appsec-bot-challenge-scoring

1name: crowdsecurity/appsec-bot-challenge-scoring
2inband:
3  on_challenge_submit:
4    - filter: EvaluateMismatches().Has("cdp")
5      apply:
6        - AddRequestScore(100, "cdp")
7    - filter: EvaluateMismatches().Has("webdriver")
8      apply:
9        - AddRequestScore(100, "webdriver")
10    - filter: EvaluateMismatches().Has("webdriver_writable")
11      apply:
12        - AddRequestScore(100, "webdriver_writable")
13    - filter: EvaluateMismatches().Has("selenium")
14      apply:
15        - AddRequestScore(100, "selenium")
16    - filter: EvaluateMismatches().Has("playwright")
17      apply:
18        - AddRequestScore(100, "playwright")
19    - filter: EvaluateMismatches().Has("webdriver_iframe")
20      apply:
21        - AddRequestScore(100, "webdriver_iframe")
22    - filter: EvaluateMismatches().Has("webdriver_worker")
23      apply:
24        - AddRequestScore(100, "webdriver_worker")
25    - filter: EvaluateMismatches().Has("bot_user_agent")
26      apply:
27        - AddRequestScore(100, "bot_user_agent")
28
29    # --- Strong: headless environments and cross-context inconsistencies that are
30    # hard to fake away, but each has a thin tail of legitimate clients. ---
31    - filter: EvaluateMismatches().Has("headless_screen_resolution")
32      apply:
33        - AddRequestScore(50, "headless_screen_resolution")
34    - filter: EvaluateMismatches().Has("missing_chrome_object")
35      apply:
36        - AddRequestScore(50, "missing_chrome_object")
37    - filter: EvaluateMismatches().Has("impossible_memory")
38      apply:
39        - AddRequestScore(50, "impossible_memory")
40    - filter: EvaluateMismatches().Has("inconsistent_etsl")