wafrift-detect 0.2.13

WAF detection from response headers and body, response fingerprint drift analysis.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

use wafrift_detect::detect;

type Sample = (&'static str, u16, Vec<(String, String)>);

fn main() {
    let samples: [Sample; 3] = [
        (
            "Cloudflare-like",
            403,
            vec![
                ("cf-ray".to_string(), "7f3c1234-IAD".to_string()),
                ("server".to_string(), "cloudflare".to_string()),
            ],
        ),
        (
            "Akamai-like",
            403,
            vec![
                ("x-akamai-transformed".to_string(), "9 12345".to_string()),
                ("server".to_string(), "akamaighost".to_string()),
            ],
        ),
        (
            "AWS WAF-like",
            403,
            vec![("x-amzn-waf-action".to_string(), "BLOCK".to_string())],
        ),
    ];

    for (label, status, headers) in samples {
        let detected = match detect(status, &headers, b"").first() {
            Some(waf) => format!("{} ({:.0}%)", waf.name, waf.confidence * 100.0),
            None => "Unknown".to_string(),
        };

        println!("{label:14} -> {detected}");
    }
}