I have some HTML that was detected by one of my scripts firewall detections, it looks like this:
<!---
HTTP 1.1
Status Code: 403
HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', 'Server': 'Microsoft-IIS/8.0', 'X-403-status-by': 'dw.inj.check', 'Date': 'Thu, 30 Nov 2017 22:20:17 GMT', 'Content-Type': 'text/html'}
--->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>403 - Forbidden: Access is denied.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>403 - Forbidden: Access is denied.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
</fieldset></div>
</div>
</body>
</html>
As you can see the really only discriminating identifiers for this is 'X-403-status-by': 'dw.inj.check' header. So my question being, what firewall could this be? I've searched the header on Google and found nothing, I've also search through Wikipedia's list of HTTP headers and could not find it there. Both of those failed, so I decided to give a shot with wafw00f:
The site https://<REDACTED> seems to be behind a WAF or some sort of security solution
Reason: The server header is different when an attack is detected.
The server header for a normal response is "Microsoft-IIS/8.0", while the server header a response to an attack is "Microsoft-HTTPAPI/2.0.",
Number of requests: 12
Does anybody have any idea what firewall could be producing this header, if any?
