CAIN-42 CAIN StudioAttack families
| Families | Generated from |
|---|---|
| traversal, encoded_traversal, double_encoded_traversal, backslash_traversal, fullwidth_traversal | path allow rules |
| userinfo_host, suffix_host, encoded_at, metadata_ssrf, path_escape | URL allow rules |
| chain_semicolon, chain_and, pipe, subshell, backtick, newline | command allow rules |
| case, zero_width, fullwidth, percent_encoded, sql_comment, shell_chain | deny rules (contains, equals, prefix) |
| invisible_format, quote_split, ansi_c, substitution_split, versioned_comment, proc_root (new 2026-11-02) | deny rules |
| decimal_ip, hex_ip, mapped_ipv6 (new 2026-11-02) | URL deny rules with an IP address in host_in |
| user | your own must-deny examples |
A PATCHED verdict covers these families. Anything not listed is not covered.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.