systemprompt_security/services/
scanner.rs

1use std::path::Path;
2
3const SCANNER_EXTENSIONS: &[&str] = &[
4    "php", "env", "git", "sql", "bak", "old", "zip", "gz", "db", "config", "cgi", "htm",
5];
6
7const SCANNER_PATHS: &[&str] = &[
8    "/admin",
9    "/wp-admin",
10    "/wp-content",
11    "/uploads",
12    "/cgi-bin",
13    "/phpmyadmin",
14    "/xmlrpc",
15    "/luci",
16    "/ssi.cgi",
17    "internal_forms_authentication",
18    "/identity",
19    "/login.htm",
20    "/manager/html",
21    "/config/",
22    "/setup.cgi",
23    "/eval-stdin.php",
24    "/shell.php",
25    "/c99.php",
26];
27
28const MIN_USER_AGENT_LENGTH: usize = 10;
29const MIN_CHROME_VERSION: i32 = 120;
30const MIN_FIREFOX_VERSION: i32 = 120;
31const MAX_REQUESTS_PER_MINUTE: f64 = 30.0;
32const MAX_CURL_UA_LENGTH: usize = 20;
33const MAX_WGET_UA_LENGTH: usize = 20;
34const MAX_PYTHON_REQUESTS_UA_LENGTH: usize = 30;
35const MAX_GO_HTTP_CLIENT_UA_LENGTH: usize = 30;
36const MAX_RUBY_UA_LENGTH: usize = 25;
37
38const SCANNER_NEEDLES: &[&str] = &[
39    "masscan",
40    "nmap",
41    "nikto",
42    "sqlmap",
43    "havij",
44    "acunetix",
45    "nessus",
46    "openvas",
47    "w3af",
48    "metasploit",
49    "burpsuite",
50    "zap",
51    "zgrab",
52    "censys",
53    "shodan",
54    "palo alto",
55    "cortex",
56    "xpanse",
57    "probe-image-size",
58    "libredtail",
59    "httpclient",
60    "httpunit",
61    "java/",
62    "wp-http",
63    "wp-cron",
64];
65
66const SHORT_UA_NEEDLES: &[(&str, usize)] = &[
67    ("curl", MAX_CURL_UA_LENGTH),
68    ("wget", MAX_WGET_UA_LENGTH),
69    ("python-requests", MAX_PYTHON_REQUESTS_UA_LENGTH),
70    ("go-http-client", MAX_GO_HTTP_CLIENT_UA_LENGTH),
71    ("ruby", MAX_RUBY_UA_LENGTH),
72];
73
74#[derive(Debug, Clone, Copy)]
75pub struct ScannerDetector;
76
77impl ScannerDetector {
78    pub fn is_scanner_path(path: &str) -> bool {
79        Self::has_scanner_extension(path) || Self::has_scanner_directory(path)
80    }
81
82    fn has_scanner_extension(path: &str) -> bool {
83        Path::new(path)
84            .extension()
85            .and_then(|ext| ext.to_str())
86            .is_some_and(|ext| {
87                SCANNER_EXTENSIONS
88                    .iter()
89                    .any(|scanner_ext| ext.eq_ignore_ascii_case(scanner_ext))
90            })
91    }
92
93    fn has_scanner_directory(path: &str) -> bool {
94        let path_lower = path.to_lowercase();
95        SCANNER_PATHS.iter().any(|p| path_lower.contains(p))
96    }
97
98    pub fn is_scanner_agent(user_agent: &str) -> bool {
99        let ua_lower = user_agent.to_lowercase();
100
101        if user_agent.is_empty() || user_agent.len() < MIN_USER_AGENT_LENGTH {
102            return true;
103        }
104
105        if user_agent == "Mozilla/5.0" || user_agent.trim() == "Mozilla/5.0" {
106            return true;
107        }
108
109        SCANNER_NEEDLES.iter().any(|n| ua_lower.contains(n))
110            || ua_lower.starts_with("wordpress/")
111            || SHORT_UA_NEEDLES
112                .iter()
113                .any(|(needle, max_len)| ua_lower.contains(needle) && ua_lower.len() < *max_len)
114            || Self::is_outdated_browser(&ua_lower)
115    }
116
117    fn is_outdated_browser(ua_lower: &str) -> bool {
118        if let Some(pos) = ua_lower.find("chrome/")
119            && let Some(dot_pos) = ua_lower[pos + 7..].find('.')
120            && let Ok(major) = ua_lower[pos + 7..][..dot_pos].parse::<i32>()
121            && major < MIN_CHROME_VERSION
122        {
123            return true;
124        }
125
126        if let Some(pos) = ua_lower.find("firefox/")
127            && let Some(space_pos) = ua_lower[pos + 8..].find(|c: char| !c.is_numeric() && c != '.')
128            && let Ok(major) = ua_lower[pos + 8..][..space_pos].parse::<i32>()
129            && major < MIN_FIREFOX_VERSION
130        {
131            return true;
132        }
133
134        false
135    }
136
137    pub fn is_high_velocity(request_count: i64, duration_seconds: i64) -> bool {
138        if duration_seconds < 1 {
139            return false;
140        }
141
142        let requests_per_minute = (request_count as f64 / duration_seconds as f64) * 60.0;
143        requests_per_minute > MAX_REQUESTS_PER_MINUTE
144    }
145
146    pub fn is_scanner(
147        path: Option<&str>,
148        user_agent: Option<&str>,
149        request_count: Option<i64>,
150        duration_seconds: Option<i64>,
151    ) -> bool {
152        if let Some(p) = path {
153            if Self::is_scanner_path(p) {
154                return true;
155            }
156        }
157
158        match user_agent {
159            Some(ua) => {
160                if Self::is_scanner_agent(ua) {
161                    return true;
162                }
163            },
164            None => {
165                return true;
166            },
167        }
168
169        if let (Some(count), Some(duration)) = (request_count, duration_seconds) {
170            if Self::is_high_velocity(count, duration) {
171                return true;
172            }
173        }
174
175        false
176    }
177}
systemprompt_security/services/scanner.rs

systemprompt_security/services/
scanner.rs
