diff --git a/modules/security/bot-analyzer.sh b/modules/security/bot-analyzer.sh index 4063138..20151cb 100755 --- a/modules/security/bot-analyzer.sh +++ b/modules/security/bot-analyzer.sh @@ -543,35 +543,31 @@ classify_bots() { } } } else if (match(ua_lower, /bot|crawler|spider|scraper|curl|wget|python-requests|python-urllib|java\/|scan|check|monitor/)) { - # FIXED: Check for bot keywords FIRST, then verify it's not a legitimate browser + # FIXED: Check for bot keywords FIRST, then verify it is not a legitimate browser # This prevents bots from bypassing detection by including browser strings - # FIRST: Check if it's actually a legitimate browser with complete UA signature + # FIRST: Check if it is actually a legitimate browser with complete UA signature # Real browsers have: Mozilla/5.0 + platform + rendering engine + browser version is_real_browser = 0 # Chrome/Chromium-based: Must have Chrome/ AND (AppleWebKit OR Mobile) if (match(ua_lower, /chrome\/[0-9]/) && (match(ua_lower, /applewebkit/) || match(ua_lower, /mobile/))) { is_real_browser = 1 - } - # Firefox: Must have Firefox/ AND Gecko/ - else if (match(ua_lower, /firefox\/[0-9]/) && match(ua_lower, /gecko\//)) { + } else if (match(ua_lower, /firefox\/[0-9]/) && match(ua_lower, /gecko\//)) { + # Firefox: Must have Firefox/ AND Gecko/ is_real_browser = 1 - } - # Safari: Must have Safari/ AND Version/ AND AppleWebKit (not Chrome) - else if (match(ua_lower, /safari\/[0-9]/) && match(ua_lower, /version\//) && match(ua_lower, /applewebkit/) && !match(ua_lower, /chrome/)) { + } else if (match(ua_lower, /safari\/[0-9]/) && match(ua_lower, /version\//) && match(ua_lower, /applewebkit/) && !match(ua_lower, /chrome/)) { + # Safari: Must have Safari/ AND Version/ AND AppleWebKit (not Chrome) is_real_browser = 1 - } - # Edge: Must have Edg/ or Edge/ - else if (match(ua_lower, /edg\/[0-9]|edge\/[0-9]/)) { + } else if (match(ua_lower, /edg\/[0-9]|edge\/[0-9]/)) { + # Edge: Must have Edg/ or Edge/ is_real_browser = 1 - } - # Mobile browsers: Samsung, UC, Opera Mobile - else if (match(ua_lower, /samsungbrowser\/[0-9]|ucbrowser\/[0-9]|opr\/[0-9]/)) { + } else if (match(ua_lower, /samsungbrowser\/[0-9]|ucbrowser\/[0-9]|opr\/[0-9]/)) { + # Mobile browsers: Samsung, UC, Opera Mobile is_real_browser = 1 } - # If it's a real browser, skip bot classification + # If it is a real browser, skip bot classification if (is_real_browser == 1) { next }