Exploit for zero-copy-web-application-firewall

## https://sploitus.com/exploit?id=114E3665-001C-5804-9F9A-705B6F48906A
# Z-WAF — Zero-Copy Web Application Firewall

Z-WAF is a Windows web application firewall built around a native C++ inspection
engine, an adaptive AI control-plane that learns new attack patterns over time,
and a real-time monitoring dashboard. It detects SQL injection, XSS, command
injection, path traversal, SSTI, NoSQL injection, deserialization attacks,
prototype pollution, and more — combining a ~1,800-entry signature database with
entropy analysis, homoglyph normalization, and heuristic scoring.

Across a tiered accuracy test (81 payloads spanning easy → expert difficulty,
covering both attacks and legitimate-but-tricky traffic) the engine currently
scores **96.3%**, with zero missed attacks in that suite.

## Architecture

| Component | What it is | Port |
|---|---|---|
| `cpp.exe` | The inspection engine — parses raw HTTP, runs the detection pipeline, and answers each request itself (safe / suspicious / blocked) | 8080 |
| `api.exe` | Python control-plane — REST API for the dashboard, plus a background loop that asks an LLM to classify suspicious traffic and write new detection rules | 5000 (localhost) |
| `Z-WAF.exe` | Launcher — starts the two services above and opens the dashboard | — |
| Dashboard | Browser UI (`zwaf.html`) that polls the control-plane API every second | — |

The engine and control-plane are only coupled through the `config/` and `logs/`
folders on disk: the engine hot-reloads its config/pattern files by watching
their modification time, so changes made through the dashboard take effect
without a restart.

## Detection pipeline

Per request: IP whitelist / reputation-ban check → operation-mode short-circuit
(detect-only / block / emergency / maintenance) → bot-signature and rate-limit
detection → positive-security allowlist (optional) → for every field (method,
path, query params, headers, cookies, body): decode any nested URL/Base64/Unicode
encoding, normalize homoglyphs (Cyrillic/Greek/fullwidth/mathematical-alphanumeric
lookalikes), then check against the signature database, an entropy/keyword
heuristic scorer, and a positive "this looks like legitimate text" validator that
can never override an actual signature match.

JSON bodies are parsed by a hand-built DOM or streaming SAX parser (selectable),
each backed by custom linked-list/stack/tree data structures, with depth,
string-length, and key-count limits enforced against malformed or oversized
payloads.

## Pluggable AI backend

The zero-day learning loop isn't tied to one provider — pick any of these in
the dashboard's settings panel (backed by `config/ai_settings.json`):

- **Local — Ollama** (any model you have pulled)
- **Local — generic** (LM Studio, llama.cpp `server`, koboldcpp, or anything
  speaking the OpenAI chat-completions shape)
- **Cloud — OpenAI-compatible API**
- **Cloud — Anthropic API**

All requests are made with Python's standard library (`urllib`) — no
third-party HTTP client, keeping the control-plane's dependency footprint at
zero for a small, easy-to-freeze installer.

## Installing

Grab **[`installer/Z-WAF-Setup.exe`](installer/Z-WAF-Setup.exe)** and run it.
It's a single, self-contained installer — nothing else needs to be installed
on the target machine (the engine is a statically linked native binary; the
control-plane and launcher are frozen with their own embedded Python runtime).

It installs per-user under `%LocalAppData%\Programs\Z-WAF` (no admin rights
needed, and deliberately **not** under `Program Files`, since the engine writes
its own `config/` and `logs/` next to the executables at runtime and Windows
blocks unprivileged writes there). Launch it from the Start Menu shortcut, or
let the installer launch it for you when setup finishes.

## Building from source

| Piece | Toolchain |
|---|---|
| `cpp.exe` | C++17, MinGW-w64 g++ with AVX2 (`-std=c++17 -O2 -static -mavx2 src/Z_WAF_CPP_Code.cpp -o cpp.exe -lws2_32`) |
| `api.exe` / `Z-WAF.exe` | Python 3 + PyInstaller (`pyinstaller --onefile --noconsole`) |
| Installer | [Inno Setup 6](https://jrsoftware.org/isinfo.php) — compile `installer/Z-WAF.iss` (`ISCC.exe Z-WAF.iss`) |

The `.iss` script expects the three built executables and `Dashboard.html`
(renamed `zwaf.html`) staged in a `build/` folder alongside `config/` — see the
comments at the top of `installer/Z-WAF.iss`.

## Testing

Two test scripts are included, both posting `{"input": ""}` directly
to the engine on port 8080 and reading the HTTP status back:

- `src/Z_WAF_Tester.py` — the original quick smoke test (legit traffic + one
  payload per attack category).
- `src/Z_WAF_Tiered_Tester.py` (payload corpus in `Z_WAF_Tiered_Payloads.py`) —
  81 payloads across Easy/Medium/Hard/Expert difficulty, with per-tier
  accuracy, false-positive, and false-negative reporting. Run it against a
  running engine with `python Z_WAF_Tiered_Tester.py  `.

## Repository layout

```
src/        Source code for all components (engine, control-plane, launcher, dashboard, tests)
config/     Default signature database and configuration the engine ships with
installer/  Inno Setup script and the compiled single-file installer
docs/       Technical report
```

## Documentation

The full technical report — architecture, design rationale, and evaluation —
is in [`docs/report.pdf`](docs/report.pdf).

## License

MIT — see [LICENSE](LICENSE).

## Author

Muzaker Khan