Detection Rules

​

Overview

Detection Rules are the core of how vulnerabilities are identified. They simulate attacker behavior by modifying requests and analyzing responses to detect security flaws.

---

​

Rule Categories

Rules are grouped into categories for better organization:

• CRLF
• Authentication & Authorization
• Command Injection
• CORS
• Database Injection
• Error Handling & Logs
• File Inclusion
• Open Redirect
• Security Headers
• Sensitive Data Exposure
• SSRF
• XSS
• XXE

---

​

Creating a Rule

Use Create Rule to define custom detection logic. Each rule allows you to simulate real attack scenarios and detect application weaknesses.

---

​

YAML-Based Rule Engine

Rules are written in YAML and consist of:

​

Core Sections

• Transform
  • Modify headers, query params, or body
• Match Conditions
  • Status codes
  • Response content
• Report
  • Title
  • Description
  • Severity
  • CWE
  • CVSS
  • Impact
  • Mitigation
  • Reproduction Steps

---

​

Rule Execution Logic

Rules work by:

1. Modifying the original request
2. Sending the transformed request
3. Analyzing the response
4. Flagging unexpected behavior as vulnerabilities

---

​

Rule Management

Each rule provides:

• Enable / Disable toggle
• Severity classification
• Detection description
• Number of findings

---

​

Editing Rules

Rules can be modified anytime to:

• Improve detection accuracy
• Reduce false positives
• Adjust logic for application-specific behavior

---

​

Deep Rule Customization

The editor allows full control over:

• Request transformations
• Matching conditions
• Reporting output

This enables detection of:

• Business logic flaws
• Authorization bypass
• Misconfigurations
• Edge-case vulnerabilities

---

​

Why It Matters

Detection Rules turn your scanner into a customizable security engine.

​

Key Benefits

• Adapt scanning to your application logic
• Detect beyond standard vulnerability signatures
• Reduce noise with precise matching
• Align findings with real-world attack patterns
• Enable security teams to build reusable detection logic

---

​

Explore Live Demo