Detector system overview

​

The Detector trait

pub trait Detector: Sync + Send {
    fn name(&self) -> &'static str;
    fn detect(&self, resp: &HttpResponse) -> bool;
}

• name() - Returns the human-readable name of the WAF (e.g., “Cloudflare”, “ArvanCloud”)
• detect() - Analyzes an HttpResponse and returns true if the WAF is detected

​

How detectors work

1. Sends multiple probe requests with different payloads (plain, XSS, SQL injection, LFI)
2. Collects HTTP responses containing status codes, headers, and body content
3. Passes each response through all registered detectors via run_detectors() in src/detector.rs:6
4. Returns the names of all detectors that returned true

pub fn run_detectors(resp: &HttpResponse) -> Option<Vec<&'static str>> {
    let mut matches = Vec::new();
    for d in inventory::iter::<&'static dyn Detector> {
        if d.detect(resp) {
            matches.push(d.name());
        }
    }

    if matches.is_empty() {
        None
    } else {
        Some(matches)
    }
}

​

Pattern matching capabilities

• has_header() - Check if specific headers exist
• header_has() - Check if a header contains specific text
• header_matches() - Match headers against regex patterns

• body_has() - Check if body contains specific text
• body_matches() - Match body against regex patterns

• is_forbidden() - Returns true if status is 403
• is_not_found() - Returns true if status is 404
• is_error() - Returns true if status is 4xx or 5xx

• MatchMode::Any - At least one pattern must match
• MatchMode::All - All patterns must match

​

Extensibility

1. Create a new detector - Add a new .rs file in src/detectors/
2. Implement the trait - Define the Detector trait for your struct
3. Register with inventory - Use inventory::submit! to auto-register
4. Add the module - Declare the module in src/detectors/mod.rs

use crate::detectors::Detector;
use crate::utils::checks::MatchMode;
use crate::utils::http::HttpResponse;

pub struct MyWAF;

impl Detector for MyWAF {
    fn name(&self) -> &'static str {
        "MyWAF"
    }

    fn detect(&self, resp: &HttpResponse) -> bool {
        resp.header_has("server", &["MyWAF"], MatchMode::Any)
    }
}

inventory::submit! {
    &MyWAF as &dyn Detector
}

​

list_detectors() function

pub fn list_detectors() -> Vec<&'static str> {
    inventory::iter::<&'static dyn detectors::Detector>
        .into_iter()
        .map(|d| d.name())
        .collect()
}