wafrift-grammar 0.2.2

Grammar-aware payload mutation engine — SQL, XSS, CMD, LDAP, SSRF, path traversal, SSTI.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

# SQL Operator Alternatives
# Logical and equality operator variations across SQL dialects for WAF bypass
# Loaded at compile-time via include_str! — adding entries here = zero Rust changes

# ═══════════════════════════════════════════
#  Logical OR alternatives
# ═══════════════════════════════════════════

[[or_alternative]]
pattern = "OR"
description = "Standard SQL OR operator"

[[or_alternative]]
pattern = "||"
description = "SQLite/Oracle concatenation and logical OR"

[[or_alternative]]
pattern = "oR"
description = "Mixed case OR (bypass case-sensitive filters)"

[[or_alternative]]
pattern = "Or"
description = "Mixed case Or (bypass case-sensitive filters)"

[[or_alternative]]
pattern = "OR/*bypass*/"
description = "Comment-appended OR (breaks regex boundary)"

[[or_alternative]]
pattern = "/*!OR*/"
description = "MySQL conditional comment OR"

[[or_alternative]]
pattern = "OR%0a"
description = "OR with URL-encoded newline suffix"

# ═══════════════════════════════════════════
#  Logical AND alternatives
# ═══════════════════════════════════════════

[[and_alternative]]
pattern = "AND"
description = "Standard SQL AND operator"

[[and_alternative]]
pattern = "&&"
description = "MySQL logical AND"

[[and_alternative]]
pattern = "aNd"
description = "Mixed case AND (bypass case-sensitive filters)"

[[and_alternative]]
pattern = "AnD"
description = "Mixed case AnD (bypass case-sensitive filters)"

[[and_alternative]]
pattern = "AND/*bypass*/"
description = "Comment-appended AND (breaks regex boundary)"

[[and_alternative]]
pattern = "/*!AND*/"
description = "MySQL conditional comment AND"

[[and_alternative]]
pattern = "%26%26"
description = "URL-encoded double-ampersand (bypass filter)"

# ═══════════════════════════════════════════
#  Equality alternatives
# ═══════════════════════════════════════════

[[equality_alternative]]
pattern = "="
description = "Standard equality operator"

[[equality_alternative]]
pattern = " LIKE "
description = "LIKE operator with spaces (string comparison)"

[[equality_alternative]]
pattern = " REGEXP "
description = "REGEXP operator (MySQL/PostgreSQL)"

[[equality_alternative]]
pattern = " RLIKE "
description = "RLIKE operator (MySQL)"

[[equality_alternative]]
pattern = " IS "
description = "IS operator (NULL comparison, boolean)"

[[equality_alternative]]
pattern = " NOT IN ("
description = "Double-negative NOT IN for equality (requires closing paren)"

[[equality_alternative]]
pattern = " BETWEEN "
description = "BETWEEN range (use with matching value pair)"

[[equality_alternative]]
pattern = " GLOB "
description = "SQLite GLOB operator"

[[equality_alternative]]
pattern = " SOUNDS LIKE "
description = "MySQL phonetic comparison (bypasses string match filters)"

[[equality_alternative]]
pattern = " DIV "
description = "MySQL integer division (1 DIV 1 = 1, truthy)"

[[equality_alternative]]
pattern = " XOR "
description = "MySQL XOR operator (0 XOR 1 = 1, truthy)"