#!/usr/bin/env python
'''
Copyright (C) 2020, WAFW00F Developers.
See the LICENSE file for copying permission.
'''

NAME = 'PT Application Firewall (Positive Technologies)'


def is_waf(self):
    schemes = [
        self.matchContent(r'<h1.{0,10}?Forbidden'),
        self.matchContent(r'<pre>Request.ID:.{0,10}?\d{4}\-(\d{2})+.{0,15}?pre>')
    ]
    if all(i for i in schemes):
        return True
    return False
#!/usr/bin/env python
'''
Copyright (C) 2020, WAFW00F Developers.
See the LICENSE file for copying permission.
'''

NAME = 'PT Application Firewall (Positive Technologies)'


def is_waf(self):
    schemes = [
        self.matchContent(r'<h1.{0,10}?Forbidden'),
        self.matchContent(r'<pre>Request.ID:.{0,10}?\d{4}\-(\d{2})+.{0,35}?pre>')
    ]
    if all(i for i in schemes):
        return True
    return False

Fix error in Request ID regex
Fix error in Request ID regex 

Fix error in Request ID regex that breaks correct WAF identification.
Changed 15 to 35, because 15 symbols between date and 'pre>' is not enough for this signature.

Sample of WAF block response:
<h1>Forbidden</h1><pre>Request ID: 2017-07-31-13-59-56-72BCA33A11EC3784</pre>