Rule builder

Build a YARA rule for Krawl, check it against Krawl's rule contract, and try it on a request before you upload it in the dashboard's Rules tab. Fill in the form, or paste or edit the rule source directly. Everything runs in your browser.

The checks emulate YARA in JavaScript. They match the real engine on every bundled rule and test request, but the dashboard upload still compiles with real YARA and has the final word. How rules work is covered in Attack detection.

Rule

Name your own prefix, e.g. acme_ or krawl_custom_ attack_type what the dashboard groups by classification attacksuspicious severity

7

confidence (none)highmediumlow description mitre_attack T1190, T1552.001 response_type fake reply from the manifest (none: normal page) author cve CVE-YYYY-NNNN reference

Strings

Add string

Condition

Fields to scan path query body user agent header

Match any of the stringsall of the strings Method any methodGETPOSTPUTDELETEPATCH

Test a request

Raw HTTP request Load a sample… wp-config backup Path traversal SQL injection Log4Shell header Command injection

GET /wp-config.php.bak HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 zgrab/0.x

Request line, headers, a blank line, then the body. Krawl scans the path, query, body, user agent and each header on its own, raw and URL-decoded.