fingerprint-mcp 0.1.0

package/dist/waf/index.js

@@ -0,0 +1,767 @@
+import { z } from "zod";
+import { resolve4, resolveCname } from "node:dns/promises";
+import { json } from "../types/index.js";
+import { RateLimiter } from "../utils/rate-limiter.js";
+import { TTLCache } from "../utils/cache.js";
+// ─── Rate Limiter & Cache ───
+const limiter = new RateLimiter(500); // slower for WAF — avoid triggering blocks
+const cache = new TTLCache(300_000);
+const WAF_HEADER_SIGNATURES = {
+    "cf-ray": { name: "Cloudflare", vendor: "Cloudflare, Inc." },
+    "x-sucuri-id": { name: "Sucuri WAF", vendor: "Sucuri (GoDaddy)" },
+    "x-amzn-requestid": { name: "AWS WAF", vendor: "Amazon Web Services" },
+    "x-akamai-transformed": { name: "Akamai", vendor: "Akamai Technologies" },
+    "x-sigsci-tags": { name: "Signal Sciences", vendor: "Signal Sciences (Fastly)" },
+    "x-sigsci-decisionscore": { name: "Signal Sciences", vendor: "Signal Sciences (Fastly)" },
+    "x-sigsci-requestid": { name: "Signal Sciences", vendor: "Signal Sciences (Fastly)" },
+    "x-wallarm-waf-check": { name: "Wallarm", vendor: "Wallarm" },
+};
+const WAF_SERVER_SIGNATURES = {
+    cloudflare: { name: "Cloudflare", vendor: "Cloudflare, Inc." },
+    akamaighost: { name: "Akamai", vendor: "Akamai Technologies" },
+    "ddos-guard": { name: "DDoS-Guard", vendor: "DDoS-Guard" },
+    "nginx-wallarm": { name: "Wallarm", vendor: "Wallarm" },
+};
+const WAF_COOKIE_SIGNATURES = {
+    "cf-chl-bypass": { name: "Cloudflare", vendor: "Cloudflare, Inc." },
+    ___utmvc: { name: "Imperva Incapsula", vendor: "Imperva" },
+    fortiwafsid: { name: "FortiWeb", vendor: "Fortinet" },
+    barra_counter_session: { name: "Barracuda WAF", vendor: "Barracuda Networks" },
+};
+const WAF_BODY_SIGNATURES = [
+    { pattern: /Attention Required.*Cloudflare|cf-error-details|Ray ID:/i, name: "Cloudflare", vendor: "Cloudflare, Inc." },
+    { pattern: /Request blocked|automated access.*denied.*AWS/i, name: "AWS WAF", vendor: "Amazon Web Services" },
+    { pattern: /ModSecurity|Mod_Security|mod_security module/i, name: "ModSecurity", vendor: "Trustwave / OWASP" },
+    { pattern: /Incapsula incident|Powered By Incapsula|_Incapsula_Resource/i, name: "Imperva Incapsula", vendor: "Imperva" },
+    { pattern: /Reference #18\.[0-9a-f]+|AkamaiGHost/i, name: "Akamai", vendor: "Akamai Technologies" },
+    { pattern: /The requested URL was rejected|Your support ID is:/i, name: "F5 BIG-IP ASM", vendor: "F5 Networks" },
+    { pattern: /Sucuri Website Firewall|Access Denied.*Sucuri/i, name: "Sucuri WAF", vendor: "Sucuri (GoDaddy)" },
+    { pattern: /Barracuda Networks|You have been blocked.*barracuda/i, name: "Barracuda WAF", vendor: "Barracuda Networks" },
+    { pattern: /DDoS-Guard|ddos-guard\.net/i, name: "DDoS-Guard", vendor: "DDoS-Guard" },
+    { pattern: /Generated by Wordfence|wordfence\.com|wfwaf-authcookie-/i, name: "Wordfence", vendor: "Defiant Inc." },
+    { pattern: /FortiWeb|fortigate|\.fgd_icon/i, name: "FortiWeb", vendor: "Fortinet" },
+    { pattern: /wallarm|nginx-wallarm/i, name: "Wallarm", vendor: "Wallarm" },
+    { pattern: /Signal Sciences/i, name: "Signal Sciences", vendor: "Signal Sciences (Fastly)" },
+];
+// ─── CDN Signature Maps ───
+const CDN_HEADER_SIGNATURES = {
+    "cf-ray": "Cloudflare",
+    "x-amz-cf-id": "Amazon CloudFront",
+    "x-akamai-transformed": "Akamai",
+    "x-fastly-request-id": "Fastly",
+};
+const CDN_SERVER_SIGNATURES = {
+    cloudflare: "Cloudflare",
+    amazons3: "Amazon S3",
+    akamaihost: "Akamai",
+    akamainetworkhttpmonitor: "Akamai",
+    varnish: "Varnish (generic CDN cache)",
+};
+const CDN_CNAME_PATTERNS = {
+    "cloudfront.net": "Amazon CloudFront",
+    "edgekey.net": "Akamai",
+    "edgesuite.net": "Akamai",
+    "akamaiedge.net": "Akamai",
+    "fastly.net": "Fastly",
+    "cloudflare.net": "Cloudflare",
+    "azureedge.net": "Azure CDN",
+    "stackpathdns.com": "StackPath",
+    "impervadns.net": "Imperva",
+    "sucuri.net": "Sucuri",
+};
+// ─── Helpers ───
+function parseCookies(headers) {
+    const cookies = new Map();
+    const setCookie = headers.getSetCookie?.() ?? [];
+    for (const raw of setCookie) {
+        const name = raw.split("=")[0]?.trim();
+        if (name)
+            cookies.set(name.toLowerCase(), raw);
+    }
+    return cookies;
+}
+function extractHostname(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return url;
+    }
+}
+async function safeFetch(url, options) {
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 10_000);
+        const res = await fetch(url, {
+            ...options,
+            signal: controller.signal,
+            redirect: "follow",
+        });
+        clearTimeout(timeout);
+        return res;
+    }
+    catch {
+        return null;
+    }
+}
+async function safeDnsResolve4(hostname) {
+    try {
+        return await resolve4(hostname);
+    }
+    catch {
+        return [];
+    }
+}
+async function safeDnsResolveCname(hostname) {
+    try {
+        return await resolveCname(hostname);
+    }
+    catch {
+        return [];
+    }
+}
+const ATTACK_PAYLOADS = [
+    {
+        type: "xss",
+        label: "XSS (reflected)",
+        build: (base) => ({
+            url: `${base}?q=${encodeURIComponent("<script>alert(1)</script>")}`,
+        }),
+    },
+    {
+        type: "sqli",
+        label: "SQL Injection",
+        build: (base) => ({
+            url: `${base}?id=${encodeURIComponent("' OR '1'='1")}`,
+        }),
+    },
+    {
+        type: "path_traversal",
+        label: "Path Traversal",
+        build: (base) => {
+            const u = new URL(base);
+            u.pathname = "/../../../etc/passwd";
+            return { url: u.toString() };
+        },
+    },
+    {
+        type: "scanner_ua",
+        label: "Scanner User-Agent",
+        build: (base) => ({
+            url: base,
+            headers: { "User-Agent": "sqlmap/1.0" },
+        }),
+    },
+    {
+        type: "cmdi",
+        label: "Command Injection",
+        build: (base) => ({
+            url: `${base}?cmd=${encodeURIComponent("; cat /etc/passwd")}`,
+        }),
+    },
+];
+// ─── Tool 1: waf_detect ───
+const wafDetect = {
+    name: "waf_detect",
+    description: "Identify Web Application Firewalls by probing with common attack payloads (XSS, SQLi, path traversal, scanner UA, command injection) " +
+        "and matching block responses against known WAF signatures. Detects Cloudflare, AWS WAF, ModSecurity, Imperva, Akamai, F5 ASM, Fortinet, " +
+        "Sucuri, Barracuda, Wallarm, Signal Sciences, DDoS-Guard, Wordfence, and more.",
+    schema: {
+        url: z.string().url().describe("URL to probe for WAF detection"),
+    },
+    async execute(args) {
+        const url = args.url;
+        const cacheKey = `waf_detect:${url}`;
+        const cached = cache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        await limiter.acquire();
+        const detections = new Map();
+        // Send each attack payload and analyze responses
+        for (const payload of ATTACK_PAYLOADS) {
+            const { url: probeUrl, headers: extraHeaders } = payload.build(url);
+            const res = await safeFetch(probeUrl, {
+                headers: {
+                    "User-Agent": extraHeaders?.["User-Agent"] ??
+                        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+                    Accept: "text/html,application/xhtml+xml,*/*",
+                    ...extraHeaders,
+                },
+            });
+            if (!res)
+                continue;
+            const status = res.status;
+            const body = await res.text().catch(() => "");
+            const cookies = parseCookies(res.headers);
+            // Check response headers
+            for (const [header, sig] of Object.entries(WAF_HEADER_SIGNATURES)) {
+                if (res.headers.has(header)) {
+                    if (!detections.has(sig.name)) {
+                        detections.set(sig.name, {
+                            name: sig.name,
+                            vendor: sig.vendor,
+                            confidence: 0.8,
+                            indicators: [],
+                        });
+                    }
+                    detections.get(sig.name).indicators.push(`Header '${header}' present (${payload.type})`);
+                }
+            }
+            // Check Server header
+            const server = res.headers.get("server")?.toLowerCase() ?? "";
+            for (const [pattern, sig] of Object.entries(WAF_SERVER_SIGNATURES)) {
+                if (server.includes(pattern)) {
+                    if (!detections.has(sig.name)) {
+                        detections.set(sig.name, {
+                            name: sig.name,
+                            vendor: sig.vendor,
+                            confidence: 0.85,
+                            indicators: [],
+                        });
+                    }
+                    detections.get(sig.name).indicators.push(`Server header matches '${pattern}' (${payload.type})`);
+                }
+            }
+            // Check cookies
+            for (const [cookiePattern, sig] of Object.entries(WAF_COOKIE_SIGNATURES)) {
+                for (const [cookieName] of cookies) {
+                    if (cookieName.includes(cookiePattern.toLowerCase())) {
+                        if (!detections.has(sig.name)) {
+                            detections.set(sig.name, {
+                                name: sig.name,
+                                vendor: sig.vendor,
+                                confidence: 0.85,
+                                indicators: [],
+                            });
+                        }
+                        detections.get(sig.name).indicators.push(`Cookie '${cookieName}' matches '${cookiePattern}' (${payload.type})`);
+                    }
+                }
+            }
+            // Check for incap_ses_* cookie pattern (Imperva)
+            for (const [cookieName] of cookies) {
+                if (/^incap_ses_/i.test(cookieName)) {
+                    if (!detections.has("Imperva Incapsula")) {
+                        detections.set("Imperva Incapsula", {
+                            name: "Imperva Incapsula",
+                            vendor: "Imperva",
+                            confidence: 0.9,
+                            indicators: [],
+                        });
+                    }
+                    detections.get("Imperva Incapsula").indicators.push(`Cookie '${cookieName}' matches Imperva pattern (${payload.type})`);
+                }
+            }
+            // Check for TS* cookie prefix (F5 ASM)
+            for (const [cookieName] of cookies) {
+                if (/^TS[0-9a-f]{6,8}$/i.test(cookieName)) {
+                    if (!detections.has("F5 BIG-IP ASM")) {
+                        detections.set("F5 BIG-IP ASM", {
+                            name: "F5 BIG-IP ASM",
+                            vendor: "F5 Networks",
+                            confidence: 0.85,
+                            indicators: [],
+                        });
+                    }
+                    detections.get("F5 BIG-IP ASM").indicators.push(`Cookie '${cookieName}' matches F5 TS* pattern (${payload.type})`);
+                }
+            }
+            // Check for wfwaf-authcookie pattern (Wordfence)
+            for (const [cookieName] of cookies) {
+                if (/wfwaf-authcookie/i.test(cookieName)) {
+                    if (!detections.has("Wordfence")) {
+                        detections.set("Wordfence", {
+                            name: "Wordfence",
+                            vendor: "Defiant Inc.",
+                            confidence: 0.9,
+                            indicators: [],
+                        });
+                    }
+                    detections.get("Wordfence").indicators.push(`Cookie '${cookieName}' matches Wordfence pattern (${payload.type})`);
+                }
+            }
+            // Check body content
+            if (body && (status === 403 || status === 406 || status === 503)) {
+                for (const sig of WAF_BODY_SIGNATURES) {
+                    if (sig.pattern.test(body)) {
+                        if (!detections.has(sig.name)) {
+                            detections.set(sig.name, {
+                                name: sig.name,
+                                vendor: sig.vendor,
+                                confidence: 0.9,
+                                indicators: [],
+                            });
+                        }
+                        detections.get(sig.name).indicators.push(`Body matches '${sig.name}' pattern (status ${status}, ${payload.type})`);
+                    }
+                }
+            }
+            await limiter.acquire();
+        }
+        // Deduplicate indicators per detection
+        for (const [, det] of detections) {
+            det.indicators = [...new Set(det.indicators)];
+            // Increase confidence based on number of indicators
+            det.confidence = Math.min(1.0, det.confidence + det.indicators.length * 0.02);
+        }
+        const result = {
+            url,
+            wafs_detected: Array.from(detections.values()),
+            total_detections: detections.size,
+            payloads_tested: ATTACK_PAYLOADS.length,
+        };
+        cache.set(cacheKey, result);
+        return json(result);
+    },
+};
+// ─── Tool 2: waf_cdn_detect ───
+const wafCdnDetect = {
+    name: "waf_cdn_detect",
+    description: "Detect CDN provider for a given URL by analyzing response headers (cf-ray, x-amz-cf-id, x-akamai-transformed, x-fastly-request-id), " +
+        "Server header, Via header, DNS resolution (anycast detection via multiple IPs), and CNAME chain analysis " +
+        "(cloudfront.net, edgekey.net, fastly.net, cloudflare.net).",
+    schema: {
+        url: z.string().url().describe("URL to detect CDN provider"),
+    },
+    async execute(args) {
+        const url = args.url;
+        const cacheKey = `waf_cdn_detect:${url}`;
+        const cached = cache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        await limiter.acquire();
+        const hostname = extractHostname(url);
+        const cdnIndicators = [];
+        // 1. HTTP response header analysis
+        const res = await safeFetch(url, {
+            headers: {
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+                Accept: "text/html,application/xhtml+xml,*/*",
+            },
+        });
+        if (res) {
+            // Check CDN-specific headers
+            for (const [header, provider] of Object.entries(CDN_HEADER_SIGNATURES)) {
+                if (res.headers.has(header)) {
+                    cdnIndicators.push({ provider, source: `Header: ${header}` });
+                }
+            }
+            // Check x-cache header
+            const xCache = res.headers.get("x-cache");
+            if (xCache && /HIT|MISS/i.test(xCache)) {
+                cdnIndicators.push({ provider: "CDN (generic)", source: `x-cache: ${xCache}` });
+            }
+            // Check Server header
+            const server = res.headers.get("server")?.toLowerCase() ?? "";
+            for (const [pattern, provider] of Object.entries(CDN_SERVER_SIGNATURES)) {
+                if (server.includes(pattern)) {
+                    cdnIndicators.push({ provider, source: `Server: ${server}` });
+                }
+            }
+            // Check Via header
+            const via = res.headers.get("via");
+            if (via) {
+                cdnIndicators.push({ provider: "CDN (via header)", source: `Via: ${via}` });
+                if (/cloudfront/i.test(via))
+                    cdnIndicators.push({ provider: "Amazon CloudFront", source: `Via contains cloudfront` });
+                if (/varnish/i.test(via))
+                    cdnIndicators.push({ provider: "Varnish CDN", source: `Via contains varnish` });
+                if (/akamai/i.test(via))
+                    cdnIndicators.push({ provider: "Akamai", source: `Via contains akamai` });
+            }
+        }
+        // 2. DNS resolution — multiple IPs = anycast = likely CDN
+        const ips = await safeDnsResolve4(hostname);
+        const isAnycast = ips.length > 2;
+        // 3. CNAME chain analysis
+        const cnames = await safeDnsResolveCname(hostname);
+        for (const cname of cnames) {
+            const cnameLower = cname.toLowerCase();
+            for (const [pattern, provider] of Object.entries(CDN_CNAME_PATTERNS)) {
+                if (cnameLower.includes(pattern)) {
+                    cdnIndicators.push({ provider, source: `CNAME: ${cname}` });
+                }
+            }
+        }
+        // Deduplicate by provider
+        const providerMap = new Map();
+        for (const ind of cdnIndicators) {
+            if (!providerMap.has(ind.provider))
+                providerMap.set(ind.provider, []);
+            providerMap.get(ind.provider).push(ind.source);
+        }
+        const detectedCdns = Array.from(providerMap.entries()).map(([provider, sources]) => ({
+            provider,
+            sources: [...new Set(sources)],
+            confidence: Math.min(1.0, 0.6 + sources.length * 0.1),
+        }));
+        const result = {
+            url,
+            hostname,
+            cdns_detected: detectedCdns,
+            dns: {
+                a_records: ips,
+                cname_records: cnames,
+                is_anycast: isAnycast,
+                ip_count: ips.length,
+            },
+            behind_cdn: detectedCdns.length > 0 || isAnycast,
+        };
+        cache.set(cacheKey, result);
+        return json(result);
+    },
+};
+// ─── Tool 3: waf_origin ───
+const wafOrigin = {
+    name: "waf_origin",
+    description: "Attempt to discover the origin IP behind a CDN-protected domain. Techniques: subdomain DNS enumeration " +
+        "(mail, ftp, direct, origin, cpanel, webmail, smtp subdomains), certificate SAN cross-reference via crt.sh, " +
+        "HTML/JS source analysis for hardcoded IPs, and content comparison to verify discovered IPs serve the same site.",
+    schema: {
+        domain: z.string().describe("Domain to find origin IP behind CDN"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const cacheKey = `waf_origin:${domain}`;
+        const cached = cache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        await limiter.acquire();
+        const candidateIps = [];
+        // 1. Subdomain DNS enumeration — these often bypass CDN
+        const subdomains = [
+            "mail",
+            "ftp",
+            "direct",
+            "origin",
+            "cpanel",
+            "webmail",
+            "smtp",
+            "admin",
+            "dev",
+            "staging",
+            "api",
+        ];
+        for (const sub of subdomains) {
+            const fqdn = `${sub}.${domain}`;
+            const ips = await safeDnsResolve4(fqdn);
+            for (const ip of ips) {
+                candidateIps.push({ ip, source: `DNS A record: ${fqdn}` });
+            }
+        }
+        // Resolve the main domain IPs for comparison
+        const mainIps = await safeDnsResolve4(domain);
+        // 2. Certificate SAN cross-reference via crt.sh
+        const certIps = [];
+        try {
+            await limiter.acquire();
+            const crtRes = await safeFetch(`https://crt.sh/?q=${encodeURIComponent(domain)}&output=json`, {
+                headers: { Accept: "application/json" },
+            });
+            if (crtRes && crtRes.ok) {
+                const crtData = (await crtRes.json());
+                // Collect unique hostnames from certificate SANs
+                const certHostnames = new Set();
+                for (const entry of crtData.slice(0, 50)) {
+                    const names = entry.name_value?.split("\n") ?? [];
+                    for (const name of names) {
+                        const trimmed = name.trim().replace(/^\*\./, "");
+                        if (trimmed &&
+                            trimmed !== domain &&
+                            !trimmed.startsWith("*") &&
+                            trimmed.endsWith(domain)) {
+                            certHostnames.add(trimmed);
+                        }
+                    }
+                }
+                // Resolve a subset of discovered hostnames
+                let resolved = 0;
+                for (const certHost of certHostnames) {
+                    if (resolved >= 10)
+                        break;
+                    const ips = await safeDnsResolve4(certHost);
+                    for (const ip of ips) {
+                        candidateIps.push({ ip, source: `crt.sh SAN: ${certHost}` });
+                    }
+                    resolved++;
+                }
+            }
+        }
+        catch {
+            // crt.sh may be unavailable
+        }
+        // 3. HTML/JS source analysis — look for hardcoded IPs
+        try {
+            await limiter.acquire();
+            const pageRes = await safeFetch(`https://${domain}`, {
+                headers: {
+                    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+                    Accept: "text/html,*/*",
+                },
+            });
+            if (pageRes && pageRes.ok) {
+                const html = await pageRes.text();
+                // Match IPv4 addresses in HTML/JS content
+                const ipv4Regex = /\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/g;
+                let match;
+                const foundInSource = new Set();
+                while ((match = ipv4Regex.exec(html)) !== null) {
+                    const ip = match[1];
+                    // Filter out common non-routable and version-like patterns
+                    if (!ip.startsWith("0.") &&
+                        !ip.startsWith("127.") &&
+                        !ip.startsWith("255.") &&
+                        !ip.startsWith("10.") &&
+                        !ip.startsWith("192.168.") &&
+                        !/^172\.(1[6-9]|2\d|3[01])\./.test(ip) &&
+                        // Skip version-like patterns (e.g., 1.0.0.0, 2.3.1.4)
+                        !/^\d+\.\d+\.\d+\.\d+$/.test(ip) === false) {
+                        foundInSource.add(ip);
+                    }
+                }
+                for (const ip of foundInSource) {
+                    candidateIps.push({ ip, source: "Hardcoded IP in HTML/JS source" });
+                }
+            }
+        }
+        catch {
+            // Page fetch may fail
+        }
+        // 4. Filter candidates — remove IPs that match the CDN-fronted IPs
+        const mainIpSet = new Set(mainIps);
+        const uniqueCandidates = new Map();
+        for (const { ip, source } of candidateIps) {
+            if (!mainIpSet.has(ip)) {
+                if (!uniqueCandidates.has(ip))
+                    uniqueCandidates.set(ip, []);
+                uniqueCandidates.get(ip).push(source);
+            }
+        }
+        // 5. Content verification — check if candidate IPs serve the same content
+        const verified = [];
+        let checked = 0;
+        for (const [ip, sources] of uniqueCandidates) {
+            if (checked >= 5)
+                break; // Limit verification requests
+            let servesSameContent = false;
+            try {
+                await limiter.acquire();
+                const verifyRes = await safeFetch(`http://${ip}`, {
+                    headers: {
+                        Host: domain,
+                        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+                    },
+                });
+                if (verifyRes && (verifyRes.ok || verifyRes.status === 301 || verifyRes.status === 302)) {
+                    const body = await verifyRes.text().catch(() => "");
+                    // Simple heuristic: check if the domain name appears in the response
+                    servesSameContent = body.toLowerCase().includes(domain.toLowerCase());
+                }
+            }
+            catch {
+                // Connection to IP may fail
+            }
+            verified.push({
+                ip,
+                sources: [...new Set(sources)],
+                serves_same_content: servesSameContent,
+            });
+            checked++;
+        }
+        // Remaining unverified candidates
+        for (const [ip, sources] of uniqueCandidates) {
+            if (!verified.some((v) => v.ip === ip)) {
+                verified.push({
+                    ip,
+                    sources: [...new Set(sources)],
+                    serves_same_content: false,
+                });
+            }
+        }
+        const result = {
+            domain,
+            main_domain_ips: mainIps,
+            origin_candidates: verified.sort((a, b) => a.serves_same_content === b.serves_same_content ? 0 : a.serves_same_content ? -1 : 1),
+            total_candidates: verified.length,
+            likely_origins: verified.filter((v) => v.serves_same_content).map((v) => v.ip),
+        };
+        cache.set(cacheKey, result);
+        return json(result);
+    },
+};
+// ─── Tool 4: waf_fingerprint ───
+const wafFingerprint = {
+    name: "waf_fingerprint",
+    description: "Deep WAF technology fingerprinting from block page analysis. Sends requests that trigger WAF blocks (XSS, SQLi, path traversal, " +
+        "command injection), parses block page HTML for vendor indicators (support IDs, reference numbers, custom error pages), " +
+        "determines WAF mode (block, detect-only, or CAPTCHA challenge), and maps WAF rule coverage across payload types.",
+    schema: {
+        url: z.string().url().describe("URL to fingerprint WAF technology"),
+    },
+    async execute(args) {
+        const url = args.url;
+        const cacheKey = `waf_fingerprint:${url}`;
+        const cached = cache.get(cacheKey);
+        if (cached)
+            return json(cached);
+        await limiter.acquire();
+        // First, get a baseline response
+        const baselineRes = await safeFetch(url, {
+            headers: {
+                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+                Accept: "text/html,*/*",
+            },
+        });
+        const baselineStatus = baselineRes?.status ?? 0;
+        const baselineBody = baselineRes ? await baselineRes.text().catch(() => "") : "";
+        // Test each payload type
+        const payloadResults = [];
+        for (const payload of ATTACK_PAYLOADS) {
+            await limiter.acquire();
+            const { url: probeUrl, headers: extraHeaders } = payload.build(url);
+            const res = await safeFetch(probeUrl, {
+                headers: {
+                    "User-Agent": extraHeaders?.["User-Agent"] ??
+                        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+                    Accept: "text/html,*/*",
+                    ...extraHeaders,
+                },
+            });
+            if (!res) {
+                payloadResults.push({
+                    type: payload.type,
+                    label: payload.label,
+                    status: 0,
+                    blocked: false,
+                    mode: "passthrough",
+                    waf_indicators: ["Connection failed"],
+                });
+                continue;
+            }
+            const status = res.status;
+            const body = await res.text().catch(() => "");
+            const indicators = [];
+            // Detect WAF indicators in block page
+            for (const sig of WAF_BODY_SIGNATURES) {
+                if (sig.pattern.test(body)) {
+                    indicators.push(`Body: ${sig.name}`);
+                }
+            }
+            // Check for support/reference IDs in block page
+            const supportIdPatterns = [
+                { pattern: /Ray ID:\s*([0-9a-f]+)/i, label: "Cloudflare Ray ID" },
+                { pattern: /Reference #(\S+)/i, label: "Akamai Reference" },
+                { pattern: /Your support ID is:\s*(\S+)/i, label: "F5 Support ID" },
+                { pattern: /Incident ID:\s*(\S+)/i, label: "Incapsula Incident ID" },
+                { pattern: /Block ID:\s*(\S+)/i, label: "Block ID" },
+                { pattern: /Request ID:\s*(\S+)/i, label: "Request ID" },
+                { pattern: /Event ID:\s*(\S+)/i, label: "Event ID" },
+            ];
+            for (const { pattern, label } of supportIdPatterns) {
+                const m = body.match(pattern);
+                if (m) {
+                    indicators.push(`${label}: ${m[1]}`);
+                }
+            }
+            // Check for custom error page elements
+            if (/<title>/i.test(body)) {
+                const titleMatch = body.match(/<title[^>]*>([^<]*)<\/title>/i);
+                if (titleMatch && titleMatch[1]) {
+                    indicators.push(`Block page title: ${titleMatch[1].trim()}`);
+                }
+            }
+            // Determine WAF mode
+            let mode;
+            if (status === 403 || status === 406 || status === 503) {
+                // Check for CAPTCHA challenge
+                if (/captcha|challenge|hcaptcha|recaptcha|turnstile|cf-chl-widget/i.test(body)) {
+                    mode = "challenge";
+                }
+                else {
+                    mode = "block";
+                }
+            }
+            else if (status === 200) {
+                // Check for warning headers (detect-only mode)
+                const wafWarningHeaders = [
+                    "x-sigsci-tags",
+                    "x-wallarm-waf-check",
+                    "x-waf-status",
+                ];
+                const hasWarning = wafWarningHeaders.some((h) => res.headers.has(h));
+                if (hasWarning || indicators.length > 0) {
+                    mode = "detect_only";
+                }
+                else {
+                    mode = "passthrough";
+                }
+            }
+            else {
+                mode = status >= 400 ? "block" : "passthrough";
+            }
+            const blocked = mode === "block" || mode === "challenge";
+            payloadResults.push({
+                type: payload.type,
+                label: payload.label,
+                status,
+                blocked,
+                mode,
+                waf_indicators: indicators,
+            });
+        }
+        // Aggregate WAF identification from all probe results
+        const allIndicators = payloadResults.flatMap((r) => r.waf_indicators);
+        const wafNames = new Set();
+        for (const ind of allIndicators) {
+            for (const sig of WAF_BODY_SIGNATURES) {
+                if (ind.includes(sig.name)) {
+                    wafNames.add(sig.name);
+                }
+            }
+        }
+        // Calculate coverage rating
+        const blockedCount = payloadResults.filter((r) => r.blocked).length;
+        const totalPayloads = payloadResults.length;
+        const coveragePercent = Math.round((blockedCount / totalPayloads) * 100);
+        let coverageRating;
+        if (coveragePercent >= 80)
+            coverageRating = "comprehensive";
+        else if (coveragePercent >= 60)
+            coverageRating = "good";
+        else if (coveragePercent >= 40)
+            coverageRating = "moderate";
+        else if (coveragePercent > 0)
+            coverageRating = "weak";
+        else
+            coverageRating = "none";
+        const result = {
+            url,
+            baseline_status: baselineStatus,
+            waf_identified: Array.from(wafNames),
+            waf_mode: payloadResults.some((r) => r.mode === "challenge")
+                ? "challenge"
+                : payloadResults.some((r) => r.mode === "block")
+                    ? "block"
+                    : payloadResults.some((r) => r.mode === "detect_only")
+                        ? "detect_only"
+                        : "none",
+            coverage: {
+                payloads_tested: totalPayloads,
+                payloads_blocked: blockedCount,
+                coverage_percent: coveragePercent,
+                rating: coverageRating,
+            },
+            payload_results: payloadResults,
+        };
+        cache.set(cacheKey, result);
+        return json(result);
+    },
+};
+// ─── Export All WAF Tools ───
+export const wafTools = [
+    wafDetect,
+    wafCdnDetect,
+    wafOrigin,
+    wafFingerprint,
+];
+//# sourceMappingURL=index.js.map