feat(scanner): WAF evasion engine v1.5.0 by Bulletdev · Pull Request #13 · effront/anarcry

Bulletdev · 2026-10-29T19:46:43Z

Summary

WAF evasion engine: WafState + WafEvasion in scanner/util/ with 5 bypass strategies -- DOUBLE_ENCODE, CASE_MUTATION, UNICODE_NORMALIZE, CHARSET_EBCDIC, HPP
ScanRunner Phase 1.5: automatic WAF probe between Crawler recon and scanner modules -- detects effective bypass strategy and stores in shared WafState
6 payload modules integrated: SQLi, XSS, LFI, SSTI, CmdInjection, XXE apply evasionPayload() transparently when WAF detected
HeadersModule WAF state: marks shared WafState on HTTP 403 + WAF signature (Cloudflare, Akamai, Incapsula, etc.)
XXE EBCDIC support: sendXml() uses charset=ibm500 encoding when CHARSET_EBCDIC is the effective strategy
Version bump to 1.5.0, README changelog with collapsible previous releases

Test plan

18 unit tests (WafEvasionTest) -- strategy implementations, WAF detection, request builders, evasionPayload integration
8 integration tests (WafHarnessTest) -- mock WAF server, probe strategies, full evasion flow, HeadersModule WAF detection, SQLi bypass with evasion
151 total tests passing (existing + new)
Spotless + compile clean
Manual test against real WAF target (e.g. Cloudflare-protected site with authorization)

WafState + WafEvasion with 5 bypass strategies (DOUBLE_ENCODE, CASE_MUTATION, UNICODE_NORMALIZE, CHARSET_EBCDIC, HPP). ScanRunner Phase 1.5 auto-probes effective bypass after WAF detection. HeadersModule marks shared WafState on 403 + WAF signature. SQLi, XSS, LFI, SSTI, CmdInjection, XXE modules integrated with evasionPayload() for transparent WAF bypass during scans. 26 WAF tests (18 unit + 8 integration with mock WAF server).

github-actions · 2026-10-29T19:47:16Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-10-29T19:47:45Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-10-29T19:47:55Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

github-actions · 2026-10-29T19:48:17Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-10-29T19:48:29Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-10-29T19:48:38Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

Version.java reads version.properties (expanded by Gradle processResources) and exposes get(), label(), userAgent(). Replaces all hardcoded version strings in AnarCryGui, AnarCryTui, HeadersModule, HSTSModule, RepeaterView and the anarchrypto launcher.

github-actions · 2026-10-29T19:53:33Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-10-29T19:53:43Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-10-29T19:53:52Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

codacy-production · 2026-10-30T15:41:16Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 278 complexity · 96 duplication

Metric Results

Complexity 278

Duplication 96

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

⚠️ Resolve issues before merging

Several blocking issues remain. WAF detection currently occurs after the phase that probes and launches payload scanners, so normal scans may never share a detected WAF strategy. Payload encoding can also be applied more than once, changing the intended wire representation, while some advertised strategies are not applied through the generic evasion path.

The scanner opens target-controlled URLs without centralized scope and private-network protection, creating SSRF risk. Strategy probing also treats non-blocked responses as successful without verifying an application-level signal. Missing integration and ordering tests leave these high-risk paths insufficiently validated.

About this PR

Important scanner integrations and orchestration paths remain unverified by focused tests, and the available results do not establish production line coverage.

2 comments outside of the diff

src/main/java/gg/effront/anarcry/scanner/crypto/headers/HeadersModule.java

_{line 39 🔴 HIGH RISK}
Route requests through centralized target validation and validate both the initial URI and every redirect against scope and disallowed IP ranges.

src/main/java/gg/effront/anarcry/scanner/crypto/hsts/HSTSModule.java

_{line 41 🔴 HIGH RISK}
Validate scheme, scan scope, resolved IP ranges, and redirect destinations before connecting. Reject loopback, private, link-local, multicast, and metadata-service addresses unless explicitly allowed, using a centralized request validator.

Test suggestions

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Test XSS, LFI, SSTI, command-injection, and XXE integrations independently
2. Test ScanRunner ordering and automatic WAF probing before scanner modules execute
3. Test that transformed payloads are encoded exactly once and produce the intended double-encoding semantics
4. Test version.properties expansion and runtime fallback behavior

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-10-30T15:41:40Z

                            return local;
                        }
-                        String encoded = URLEncoder.encode(payload, "UTF-8");
+                        String encoded = URLEncoder.encode(WafEvasion.evasionPayload(ctx, payload), "UTF-8");


_{🔴 HIGH RISK}

Separate raw transformations from request-boundary encoding, or provide an explicitly encoded API and stop re-encoding its result. Add an assertion for the exact wire representation.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-10-30T15:41:40Z

+        // Phase 1.5: WAF detection probe
+        if (ctx.wafState().isWafDetected()) {
+            safeLog.accept(
+                    "[*] Phase 1.5: WAF detectado (" + ctx.wafState().wafProduct() + ") -- probing bypass strategies");
+            try {
+                WafEvasion.Strategy effective = WafEvasion.probeStrategies(ctx, HttpClientFactory.http2(),
+                        ctx.targetUrl(), "WafProbe", safeLog);
+                if (effective != null) {
+                    ctx.wafState().markEffectiveStrategy(effective);
+                    safeLog.accept("[+] WAF bypass: usando " + effective + " para modulos de payload");
+                }
+            } catch (Exception e) {
+                safeLog.accept("[!] WAF probe falhou: " + e.getMessage());
+            }
+        }


_{🔴 HIGH RISK}

WAF detection runs too late: HeadersModule executes as a scanner after Phase 1.5, so the state is unset when probing and payload scanners begin. Move detection into reconnaissance or perform a dedicated preliminary request before Phase 1.5.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-10-30T15:41:40Z

+                HttpResponse<String> resp = Http.send(ctx, hc, req, HttpResponse.BodyHandlers.ofString(), moduleId);
+                String server = resp.headers().firstValue("Server").orElse("");
+                String body = resp.body() != null ? resp.body() : "";
+                if (!isWafBlocked(resp.statusCode(), server, body)) {


_{🟡 MEDIUM RISK}

Require a baseline comparison and an application-level success signal, such as canary reflection or an expected response, before marking a strategy effective; otherwise continue probing or leave it unset.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

codacy-production · 2026-10-30T15:41:40Z

+    public static String evasionPayload(ScanContext ctx, String payload) {
+        if (!ctx.wafState().isWafDetected()) {
+            return payload;
+        }
+        Strategy s = ctx.wafState().effectiveStrategy();
+        if (s == null) {
+            return payload;
+        }
+        return applyGetStrategy(s, payload);


_{🟡 MEDIUM RISK}

The generic evasion path does not apply HPP or EBCDIC transformations, so the advertised strategy support is incomplete across integrated modules. Add strategy-specific request construction or constrain the integration behavior explicitly.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

- Fix doubleEncode triple-encoding bug: return single-encoded so caller's URLEncoder.encode completes the double on wire - Skip HPP/EBCDIC as effective strategy in probeStrategies (not GET-compatible) - Add JS challenge detection (isJsChallenge, detectChallengeType) - Skip time-based blind phase in CmdInjection and SQLi when BrowserTransport is active (latency makes timing unreliable) - Group report Details section by module+title to collapse duplicate findings that differ only by endpoint - PQC positive findings (TLS 1.3/X25519MLKEM768 supported) now correctly report as INFO instead of LOW - Add BrowserTransport, ChallengeSolver, StealthHttpClient - Add CommandInjectionModuleTest (9 tests), SQLi BT tests (2), WafEvasion JS challenge tests (19), doubleEncode wire-form test

github-actions · 2026-10-30T18:26:20Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-10-30T18:26:43Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-10-30T18:26:50Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

Add BrowserTransport.stub(targetHost) factory method for tests, replacing reflection-based constructor access flagged by Codacy.

github-actions · 2026-10-30T18:59:25Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-10-30T18:59:55Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-10-30T19:00:05Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

github-actions · 2026-10-30T21:19:08Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-10-30T21:19:32Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-10-30T21:19:40Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

chore: bump anarchrypto launcher to v1.5.0

2094063

codacy-production Bot reviewed Oct 30, 2026

View reviewed changes

fix: replace setAccessible reflection with public stub factory

1870413

Add BrowserTransport.stub(targetHost) factory method for tests, replacing reflection-based constructor access flagged by Codacy.

chore: retrigger Codacy analysis

814067f

Bulletdev merged commit f9dd6d9 into main Oct 30, 2026
9 checks passed

Conversation

Bulletdev commented Oct 29, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented Oct 29, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Oct 29, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Oct 29, 2026

Security Scan Summary

Uh oh!

github-actions Bot commented Oct 29, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Oct 29, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Oct 29, 2026

Security Scan Summary

Uh oh!

github-actions Bot commented Oct 29, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Oct 29, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Oct 29, 2026

Security Scan Summary

Uh oh!

codacy-production Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 30, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Oct 30, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Oct 30, 2026

Security Scan Summary

Uh oh!

github-actions Bot commented Oct 30, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Oct 30, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Oct 30, 2026

Security Scan Summary

Uh oh!

github-actions Bot commented Oct 30, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Oct 30, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Oct 30, 2026

Security Scan Summary

codacy-production Bot commented Oct 30, 2026 •

edited

Loading