package detectors

func ModSecurity() *Detector {
	d := &Detector{
		WAFName: "ModSecurity",
		Vendor:  "OWASP",
	}

	d.Check = Or(
		Or(
			CheckHeader("Server", "(mod_security|Mod_Security|NOYB)", false),
			CheckContent("This error was generated by Mod.?Security", true),
			CheckContent("rules of the mod.security.module", true),
			CheckContent("mod.security.rules triggered", true),
			CheckContent("Protected by Mod.?Security", true),
			CheckContent(`/modsecurity[\-_]errorpage/`, true),
			CheckContent("modsecurity iis", true),
		),
		And(
			CheckReason("ModSecurity Action", true),
			CheckStatusCode(403, true),
		),
		And(
			CheckReason("ModSecurity Action", true),
			CheckStatusCode(406, true),
		),
	)

	return d
}
