Threat Engine & Security Inspector

Built-in attack detection engine, signature rules, and firewall defense

1. Running Threat Detection (--detect)

Enable the security detection engine using the --detect / -d flag:

caddy-analyze --detect /var/log/caddy/access.log

Per-IP Suspicious Request Details

The security report shows the actual suspicious requests per offending IP, including detection type, description, HTTP method, and path:

  - 192.168.1.100     15 malicious requests
       [sql_injection] SQL injection attempt GET /search?id=1' OR '1'='1
       [scanner] Scanner / automated tool detected GET /admin

This information is available in all output formats (table, JSON, CSV, HTML).

2. URL Unescaping & Evasion Prevention

Before evaluating detection rules, caddy-analyze automatically unescapes URL percent-encodings (e.g., converting %2e%2e%2f to ../ and %3Cscript%3E to <script>) to prevent attackers from bypassing security rules using URL encoding tricks. Additionally, a second pass matches against the raw (non-unescaped) URI to catch multibyte-encoded traversal sequences (%c0%ae%c0%ae%c0%af, %252e%252e%252f) and internal host probe attempts that would be lost after unescaping.

3. Threat Rule Specification (22 Categories)

Category	Example Patterns
SQL Injection	`UNION SELECT`, `OR 1=1`, `pg_sleep`, `INTO OUTFILE`, `@@version`
NoSQL Injection	`$ne`, `$gt`, `$regex`, `$where`, `$nin`, `%24ne`
XSS	`<script`, `onerror=`, `onfocus=`, `alert(`, `document.cookie`, `data:text/html`
SSTI	`__class__`, `__mro__`, `freemarker`, `nunjucks`, `{{7*7}}`, `os.popen`
SSRF	`169.254.169.254`, `0x7f000001`, `gopher://`, `dict://`, `redis://`
RCE	`/bin/sh`, `whoami`, `/dev/tcp/`, `powershell`, `certutil`, `eval()`
Path Traversal / LFI	`../`, `..%00`, `/etc/passwd`, `/proc/self/*`, `php://input`
GraphQL Introspection	`__schema`, `__type`, `IntrospectionQuery`
Log4j / JNDI	`${jndi:ldap://`, `${env:`, `${lower:jndi`, `${::-j}`
XXE / XInclude	`<!ENTITY`, `SYSTEM`, `PUBLIC`, `xi:include`, `xpointer`
Open Redirect	`?url=http://`, `?redirect=//`, `//evil.com`
LDAP Injection	`(&(`, `(\|(`, `)(\|(`, URL-encoded operators
XPath Injection	`]\|//`, `.//`
CRLF / Log Injection	`%0d%0aSet-Cookie:`, `%0d%0aLocation:`, literal CRLF
Prototype Pollution	`__proto__`, `constructor.prototype`, JSON payloads
SSI Injection	`<!--#exec cmd=`, `#include virtual=`, `#echo var=`
LFI Wrapper Abuse	`phar://`, `data://`, `expect://`, `compress.zlib`
Sensitive File Probes	`.env`, `.git/config`, `id_rsa`, `dump.sql`, `phpinfo.php`
Admin Probes	`/phpmyadmin`, `/actuator/*`, `/h2-console`, `/swagger-ui`
WordPress Probes	`/wp-content/plugins/`, `/xmlrpc.php`, `/wp-json/wp/v2/`
CGI Probes	`/cgi-bin/`, `.cgi`, `.fcgi`
Scanner Tools	`sqlmap`, `nuclei`, `gobuster`, `ffuf`, `wpscan`, `masscan`, `hydra`, `metasploit`, `shodan`

4. Real-time Firewall Guard Daemon (guard)

The guard subcommand monitors log streams and automatically adds offending IPs to Linux iptables DROP rules when attack thresholds are exceeded:

sudo caddy-analyze guard --limit 50 --window 1m docker://my-caddy