DEV Community: 5n4vc4smh8-pixel

How I Built a WAF-Bypassing Engine in Rust (v9.2.1 Release)

5n4vc4smh8-pixel — Fri, 21 Aug 2026 13:10:09 +0000

Building a web vulnerability scanner is easy. Building one that actually works against modern infrastructure protected by WAFs (Web Application Firewalls) is where the real engineering starts.

Last week, I released vuln-scanner v9.0.0 and the feedback was incredible. But one thing stood out: hardened targets were blocking basic payloads. So, for v9.2.1, I went back to the drawing board to implement advanced stealth and obfuscation techniques.

Here’s how I approached it using Rust.

The Problem: Deterministic Pattern Matching

Most WAFs look for specific strings like ' OR 1=1-- or . If your scanner sends these raw, you get a 403 Forbidden faster than you can say "SQLi". The Solution: Dynamic Obfuscation In vuln-scanner v9.2.1, I implemented a dedicated waf_bypass module in Rust that transforms every payload before it hits the wire. <ol> <li>Double-Encoding (%252F)</li> </ol> Some filters decode the URL once and check for malicious characters. By double-encoding, the WAF sees a harmless string, but the back-end application (which often decodes twice) receives the actual payload. // Snippet of our encoding logic pub fn double_encode(input: &str) -> String { let first = utf8_percent_encode(input, NON_ALPHANUMERIC).to_string(); utf8_percent_encode(&first, NON_ALPHANUMERIC).to_string() } <ol> <li>Comment Injection & Case Mixing</li> </ol> WAFs often miss payloads if they are interrupted by SQL comments or if the casing is randomized (e.g., sElEcT instead of SELECT). The scanner now automatically injects /**/ in SQLi payloads and <? ?> or random casing in LFI paths. <ol> <li>Global Response Caching</li> </ol> To avoid rate-limiting (another form of WAF blocking), I implemented a global cache. If the scanner sees the same response structure multiple times, it skips redundant requests, keeping the traffic profile "human-like". Why Rust? Performance is obvious, but memory safety and concurrency (via Tokio) are the real winners here. We can run 18 different scanner "motors" simultaneously without worrying about race conditions or crashing the engine mid-scan. Check out the Source Code The project is 100% open-source. I’d love to get your thoughts on the src/scanner/waf_bypass.rs implementation. 🔗 GitHub Repository: <a href="https://github.com/5n4vc4smh8-pixel/vuln-scanner">https://github.com/5n4vc4smh8-pixel/vuln-scanner</a> Happy Hacking (Responsibly)!

I built a web vulnerability scanner in Rust — here's what the Threat Intelligence module does

5n4vc4smh8-pixel — Thu, 20 Aug 2026 13:27:19 +0000

A few weeks ago I decided to build something I'd always dreamed of: a web vulnerability scanner. Not a toy — a real tool with behavioral detection, an enterprise dashboard, and a Threat Intelligence module that tells you which of your findings are being actively exploited in the wild.

It's written in Rust, it's open source (MIT/Apache-2.0), and today I want to share how one specific part of it works: the CTI correlation engine.

The problem with flat vulnerability lists

Most scanners give you a list: "you have 373 vulnerabilities". But a security team doesn't fix all 373 at once. They need to know: which ones are hackers actually using right now?

That's the gap my scanner tries to fill.

How the CTI module works

The scanner ships with a curated knowledge base of emerging ransomware groups (DireWolf, Devman, MintEye, and others) and their known exploitation patterns, plus a live pull of the CISA KEV catalog (Known Exploited Vulnerabilities) — CVEs that CISA confirmed are being exploited in the wild.

After each scan, the correlation engine matches detected vulnerabilities against both sources:

CWE-level matching against CISA KEV entries
Pattern matching against exploitation techniques attributed to specific ransomware groups
Priority scoring so the report puts the most dangerous findings first

The result is a report section like this:

12 of your findings match actively exploited CVEs (CISA KEV). 3 match exploitation patterns of the Devman ransomware group, commonly used against exposed admin panels.

The stack

Rust with reqwest, tokio, clap, rayon for parallel scanning
Axum for the Enterprise web dashboard (JWT auth, scan history)
Reports in Markdown and PDF with executive summaries

What I learned building it

As someone without a formal CS background who learned Rust from scratch for this project:

The borrow checker is strict but fair — it caught real bugs before runtime.
Deterministic detection beats heuristic guessing for scan results; AI-assisted triage is where LLMs shine.
The Rust ecosystem (crates.io) made PDF generation, HTML sanitization, and parallelism almost painless.

Try it

Only scan systems you own or have permission to test.

Feedback welcome — especially on the detection engines and the CTI correlation logic. What would you add?