Repository: sherlock-project/sherlock

Issue:
Fiverr false positive
<!--

######################################################################
  WARNING!
  IGNORING THE FOLLOWING TEMPLATE WILL RESULT IN ISSUE CLOSED AS INCOMPLETE
######################################################################

-->

## Checklist
<!--
Put x into all boxes (like this [x]) once you have completed what they say.
Make sure complete everything in the checklist.
-->
- [ x] I'm reporting a website that is returning **false positive** results
- [ x] I've checked for similar site support requests including closed ones
- [ x] I've checked for pull requests attempting to fix this false positive
- [ x] I'm only reporting **one** site (create a separate issue for each site)

## Description
<!--
Provide the username that is causing Sherlock to return a false positive, along with any other information that might help us fix this false positive.
-->

https://www.fiverr.com/fincali1979 is not a real fiverr account I checked for closed issues and fiverr is marked as fixed, but it doesn't work now



Discussion:
Hey I want to work on this issue, is it still open?

Resolving patch:
diff --git a/sherlock/notify.py b/sherlock/notify.py
--- a/sherlock/notify.py
+++ b/sherlock/notify.py
@@ -238,6 +238,15 @@ def update(self, result):
                       Fore.WHITE + "]" +
                       Fore.GREEN + f" {self.result.site_name}:" +
                       Fore.YELLOW + f" {msg}")
+                
+        elif result.status == QueryStatus.WAF:
+            if self.print_all:
+                print(Style.BRIGHT + Fore.WHITE + "[" +
+                      Fore.RED + "-" +
+                      Fore.WHITE + "]" +
+                      Fore.GREEN + f" {self.result.site_name}:" +
+                      Fore.RED + " Blocked by bot detection" +
+                      Fore.YELLOW + " (proxy may help)")
 
         else:
             # It should be impossible to ever get here...
diff --git a/sherlock/result.py b/sherlock/result.py
--- a/sherlock/result.py
+++ b/sherlock/result.py
@@ -14,6 +14,7 @@ class QueryStatus(Enum):
     AVAILABLE = "Available" # Username Not Detected
     UNKNOWN   = "Unknown"   # Error Occurred While Trying To Detect Username
     ILLEGAL   = "Illegal"   # Username Not Allowable For This Site
+    WAF       = "WAF"       # Request blocked by WAF (i.e. Cloudflare)
 
     def __str__(self):
         """Convert Object To String.
diff --git a/sherlock/sherlock.py b/sherlock/sherlock.py
--- a/sherlock/sherlock.py
+++ b/sherlock/sherlock.py
@@ -378,9 +378,20 @@ def sherlock(
         query_status = QueryStatus.UNKNOWN
         error_context = None
 
+        # As WAFs advance and evolve, they will occasionally block Sherlock and lead to false positives
+        # and negatives. Fingerprints should be added here to filter results that fail to bypass WAFs.
+        # Fingerprints should be highly targetted. Comment at the end of each fingerprint to indicate target and date.
+        WAFHitMsgs = [
+            '.loading-spinner{visibility:hidden}body.no-js .challenge-running{display:none}body.dark{background-color:#222;color:#d9d9d9}body.dark a{color:#fff}body.dark a:hover{color:#ee730a;text-decoration:underline}body.dark .lds-ring div{border-color:#999 transparent transparent}body.dark .font-red{color:#b20f03}body.dark .big-button,body.dark .pow-button{background-color:#4693ff;color:#1d1d1d}body.dark #challenge-success-text{background-image:url(data:image/svg+xml;base64,', # 2024-04-08 Cloudflare
+            '{return l.onPageView}}),Object.defineProperty(r,"perimeterxIdentifiers",{enumerable:' # 2024-04-09 PerimeterX / Human Security
+        ]
+
         if error_text is not None:
             error_context = error_text
 
+        elif any(hitMsg in r.text for hitMsg in WAFHitMsgs):
+            query_status = QueryStatus.WAF
+
         elif error_type == "message":
             # error_flag True denotes no error found in the HTML
             # error_flag False denotes error found in the HTML


Test patch: