CloFix CADRE Script Engine

# ============================================
# MODULE: SQL Injection Detection
# RULE ID: SQL-001
# VERSION: 1.0.0
# CREATOR-NAME: Security Team
# CREATOR-EMAIL: security@clofix.com
# CREATOR-ORGANIZATION: CloFix Security Inc.
# CREATOR-PARTNER-ID: PARTNER-001
# CREATOR-TIER: platinum
# CREATOR-WEBSITE: https://clofix.com
# REGISTRATION-ID: REG-2024-00123
# REGISTRATION-HASH: sha256:abc123...
# REGISTRATION-DATE: 2024-12-01T10:00:00Z
# LICENSE-TYPE: enterprise
# LICENSE-KEY: XXXX-XXXX-XXXX-XXXX
# LICENSE-VALID-FROM: 2024-12-01T10:00:00Z
# LICENSE-VALID-TO: 2025-12-01T10:00:00Z
# SEVERITY: critical
# SCORE: 95
# ANOMALY-SCORE: 85
# PARANOIA-LEVEL: 2
# CONFIDENCE: 0.98
# DESCRIPTION: Detects UNION and Boolean SQL injection
# CREATED: 2024-12-01T10:00:00Z
# UPDATED: 2024-12-15T14:30:00Z
# EXPIRES: 2025-12-01T10:00:00Z
# EXPIRY-DAYS: 365
# EXPIRY-WARNING: 30
# GRACE-PERIOD: 7
# AUTO-RENEW: true
# RENEWAL-PRICE: $99/month
# DOMAINS: example.com, api.example.com
# DOMAIN-PATTERNS: *.example.org
# EXCLUDE-DOMAINS: test.example.com
# ALLOWED-IPS: 192.168.1.0/24, 10.0.0.0/8
# BLOCKED-IPS: 1.2.3.4, 5.6.7.8
# ALLOWED-ASN: AS15169, AS16509
# ALLOWED-COUNTRIES: US, GB, CA
# BLOCKED-COUNTRIES: RU, CN, KP
# ALLOWED-CONTINENTS: NA, EU
# BLOCKED-CONTINENTS: AS, AF
# TIME-WINDOW: 09:00-17:00
# TIME-ZONE: America/New_York
# DAYS: Monday,Tuesday,Wednesday,Thursday,Friday
# DATE-RANGE-START: 2024-01-01
# DATE-RANGE-END: 2024-12-31
# BUSINESS-HOURS-ONLY: true
# RATE-LIMIT: 100
# RATE-WINDOW: 60s
# RATE-ACTION: block
# RATE-BLOCK-DURATION: 300s
# RATE-BURST: 20
# ACTION: block
# BLOCK-STATUS: 403
# BLOCK-MESSAGE: Access denied by security policy
# BLOCK-URL: https://clofix.com/blocked
# REDIRECT-URL: https://captcha.example.com
# LOG-LEVEL: INFO
# LOG-SAMPLE: 10
# ALERT-ENABLED: true
# ALERT-WEBHOOK: https://hooks.slack.com/xxx
# ALERT-EMAIL: security@clofix.com
# ALERT-SEVERITY: critical
# AUDIT-LOG: true
# REQUIRES-MODULES: core, base_sqli
# REQUIRES-ALL: false
# CONFLICTS-WITH: legacy_sqli
# PRIORITY: 1
# STAGE: main
# TAGS: owasp, sqli, critical, injection
# CATEGORY: SQL Injection
# SUB-CATEGORY: Union-based
# CVE: CVE-2024-12345
# OWASP: A03:2021-Injection
# PCI: 6.5.1
# HIPAA: 164.306
# GDPR: Article 32
# REFERENCE: https://owasp.org/sqli
# EXAMPLES: ' OR '1'='1 | UNION SELECT 1,2,3
# FIX: Use parameterized queries
# FALSE-POSITIVE-RATE: low
# TESTED-ENVIRONMENTS: nginx, apache, cloudflare
# BRAND-NAME: CloFix Security
# BRAND-LOGO: https://clofix.com/logo.png
# BRAND-URL: https://clofix.com
# BRAND-SUPPORT: support@clofix.com
# BRAND-HEADER-ENABLED: true
# BRAND-LOGO-IN-BLOCK: true
# BRAND-SUPPORT-LINK: true
# BRAND-FOOTER: © 2024 CloFix Inc.
# BRAND-BLOCK-PAGE: https://clofix.com/block.html
# SIGNATURE: MEUCIQD...
# SIGNING-KEY-ID: key-12345
# HASH-ALGORITHM: sha256
# ENCRYPTION: aes-256-gcm
# INTEGRITY-CHECK: true
# TRACK-HITS: true
# TRACK-LATENCY: true
# EXPORT-METRICS: true
# METRICS-PREFIX: waf_custom
# MIN-CADRE-VERSION: 4.0.0
# MAX-CADRE-VERSION: 5.0.0
# COMPATIBLE-WITH: cloudflare, aws_waf
# DEPRECATED-IN: 4.5.0
# REMOVED-IN: 5.0.0
# ============================================

if body matches "union.*select" {
    log attack "SQLI" "union select pattern"
    block "SQL injection detected"
}

if param.id contains "or 1=1" {
    block "Boolean SQL injection"
}

allow
                

# ============================================
# MODULE: SQL Injection Detection
# RULE ID: SQL-001
# VERSION: 2.0.0
# AUTHOR: Security Team
# SEVERITY: critical
# DESCRIPTION: Detects UNION, Boolean, Time-based SQL injection
# CREATED: 2024-12-01T10:00:00Z
# EXPIRES: 2025-12-01T10:00:00Z
# DOMAINS: example.com, api.example.com
# ALLOWED-IPS: 192.168.1.0/24
# BLOCKED-COUNTRIES: RU, CN, KP
# RATE-LIMIT: 100
# RATE-WINDOW: 60s
# TAGS: owasp, sqli, critical
# OWASP: A03:2021-Injection
# ============================================

if body matches "union.*select|or.*=.*=|sleep\\(\\d+\\)" {
    log attack "SQLI" "injection pattern"
    block "SQL injection detected"
}

if param.id contains "' or '1'='1" {
    block "Boolean SQL injection"
}

let req = rate(ip, "60s")
if req > 100 {
    block "Rate limit exceeded"
}

allow

# ============================================
# MODULE: Complete Security Profile
# RULE ID: ALL-001
# VERSION: 2.0.0
# AUTHOR: Security Team
# SEVERITY: mixed
# ============================================

# SQL Injection
if body matches "union.*select|or.*=.*=" {
    log attack "SQLI" "injection"
    block "SQL injection"
}

# XSS Protection
if body contains " 60 { block "Rate limit" }

# Geo Blocking
if country == "RU" { block "Country blocked" }

# Login Protection
if path == "/login" {
    let attempts = rate("login:" + ip, "5m")
    if attempts > 5 { block "Too many login attempts" }
}

# Response Hardening
add "X-Frame-Options: DENY"
add "X-Content-Type-Options: nosniff"
remove "Server"

allow

# Add a new rule
sudo tee /etc/clofix/cadre_modules/sqli/001-sql-injection.clofix << 'EOF'
if body matches "union.*select" { block "SQL injection" }
allow
EOF

# Reload engine instantly
curl -X POST http://localhost:8080/api/cadre/reload

# Check statistics
curl http://localhost:8080/api/cadre/stats