security-gateway/middleware/threatDetection.js

A plug-and-play security gateway that detects malicious traffic and redirects it to a decoy API

// middleware/threatDetection.js

/**
 * Middleware to detect various types of attacks
 */
const threatDetection = (req, res, next, attackPatterns, suspiciousIPs, suspiciousRequests) => {
    // Get full URL including query parameters
    const fullUrl = req.originalUrl || req.url;
    // Get all parameters (from URL, query string, and body)
    const params = {
      ...req.params,
      ...req.query,
      ...(typeof req.body === 'object' ? req.body : {})
    };
    
    // Convert params to string for easier pattern matching
    const paramsString = JSON.stringify(params);
    
    // Function to check pattern in multiple places
    const checkPattern = (pattern) => {
      return pattern.test(fullUrl) || pattern.test(paramsString);
    };
    
    // Initialize flags
    let hasSqlInjection = false;
    let hasXssAttempt = false;
    let hasPathTraversal = false;
    let hasCommandInjection = false;
    
    // Check for SQL injection if enabled
    if (attackPatterns.sqlInjection) {
      hasSqlInjection = checkPattern(/(\%27)|(\')|(\-\-)|(\%23)|(#)/i) || 
                       checkPattern(/((\%3D)|(=))[^\n]*((\%27)|(\')|(\-\-)|(\%3B)|(:))/i) ||
                       checkPattern(/union\s+select/i) ||
                       checkPattern(/exec(\s|\+)+(s|x)p\w+/i) ||
                       checkPattern(/SLEEP\(/i) ||
                       checkPattern(/SELECT\s+.*\s+FROM/i);
    }
    
    // Check for XSS if enabled
    if (attackPatterns.xss) {
      hasXssAttempt = checkPattern(/<script.*>.*<\/script>/i) ||
                     checkPattern(/<.*on\w+\s*=.*>/i) ||
                     checkPattern(/javascript:/i) ||
                     checkPattern(/alert\s*\(/i) ||
                     checkPattern(/eval\s*\(/i);
    }
    
    // Check for path traversal if enabled
    if (attackPatterns.pathTraversal) {
      hasPathTraversal = checkPattern(/(\.\.\/)|(\.\.\\)/g) ||
                        checkPattern(/\/etc\/passwd/i);
    }
    
    // Check for command injection if enabled
    if (attackPatterns.commandInjection) {
      hasCommandInjection = checkPattern(/(\;|\||\`|\&|\$\()/g) ||
                           checkPattern(/(wget|curl|bash|sh|nc|netcat)\s/i);
    }
    
    // Log suspicious request details for debugging
    if (hasSqlInjection || hasXssAttempt || hasPathTraversal || hasCommandInjection) {
      console.log('--- ATTACK DETECTED ---');
      console.log(`URL: ${fullUrl}`);
      console.log(`Type: ${hasSqlInjection ? 'SQL Injection' : hasXssAttempt ? 'XSS' : 
                        hasPathTraversal ? 'Path Traversal' : 'Command Injection'}`);
      console.log(`IP: ${req.ip}`);
      console.log('------------------------');
    }
    
    // Check if IP is already suspicious
    const isKnownSuspicious = suspiciousIPs.has(req.ip);
    
    // Log suspicious activity and determine if we should redirect
    if (hasSqlInjection || hasXssAttempt || hasPathTraversal || hasCommandInjection || isKnownSuspicious) {
      console.log(`Suspicious request detected from IP: ${req.ip}`);
      
      // Add to suspicious IPs
      suspiciousIPs.add(req.ip);
      
      // Log the suspicious request
      suspiciousRequests.push({
        timestamp: new Date().toISOString(),
        ip: req.ip,
        method: req.method,
        url: fullUrl,
        headers: req.headers,
        body: req.body,
        reason: {
          sqlInjection: hasSqlInjection,
          xssAttempt: hasXssAttempt,
          pathTraversal: hasPathTraversal,
          commandInjection: hasCommandInjection,
          knownSuspicious: isKnownSuspicious
        }
      });
      
      // Set a flag to redirect to decoy
      req.useDecoy = true;
    }
    
    next();
  };
  
  module.exports = { threatDetection };