Reduce false positives of Sonicwall NX sniffer

Simply returning a 4xx response to a weird request shouldn't be sufficient to get a server classified as Sonicwall NX.
dlenski · Apr 16, 2024 · e35de85 · e35de85
1 parent bcda71a
commit e35de85
Showing 1 changed file with 3 additions and 4 deletions.
diff --git a/what_vpn/sniffers.py b/what_vpn/sniffers.py
@@ -355,10 +355,9 @@ def sonicwall_nx(sess, server):
             serverh = r.headers.get('server')
             if 'EXTRAWEB_STATE' in sess.cookies:
                 confidence = 0.8
-            else:
-                confidence = 0.3
-                if 'SonicWall' in r.text:
-                    confidence += 0.2
+            elif 'SonicWall' in r.text:
+                confidence += 0.2
+
             return Hit(name='SonixWall NX', confidence=confidence, version=serverh)