Product · Coverage
Rules you can read, for the attacks that actually arrive.
DBshieldX checks every request for the common web attack classes, recognises scanners and bad bots, and watches clients over time for abusive behaviour. Every finding names its rule and the field it was found in.
What it detects
SQL injection
Unions, stacked queries, blind and time-based
Backed by the database-layer query check, which catches a changed query shape even when the request looked harmless.
Cross-site scripting
Script, event-handler and URL vectors
Checked in query strings, form fields, JSON bodies and headers.
Command injection
Including shell evasion tricks
Shell tricks are normalised before scoring, so disguised commands score like plain ones.
Path traversal
Encoded, doubled and Unicode forms
Path encodings are decoded first, so a doubly encoded path is judged on what it really asks for.
Server-side request forgery
Internal and cloud-metadata addresses
Flags requests that try to make your app call internal services or cloud metadata endpoints.
Template injection
Common server template engines
Looks for template expressions where your app expects plain text.
NoSQL and LDAP injection
Operator and filter abuse
Catches query operators and directory filters smuggled into ordinary fields.
Bad bots and scanners
Tool fingerprints and probe paths
Known scanner fingerprints and probes for files that should never be public, such as configuration and backup files.
Abusive behaviour
Credential stuffing, enumeration, error bursts
Rules that look at a client over time, not one request: repeated sign-in failures, walking through paths, and bursts of errors.
DBshieldX protects the application and database layers. Keep your CDN for volumetric DDoS; the two work together.
How detection works
Decode first, then score
URL encoding, base64, shell tricks and path encodings are unwrapped before scoring, so a disguised attack is judged on what it really is.
Every part of the request
Query strings, form fields, JSON bodies and headers are inspected. Authorization headers are never inspected or logged.
Explainable findings
Each finding names its rule and the field it was found in, so you always know why something was flagged and can write a precise exclusion if it's expected.
Behaviour over time
Some attacks are only visible across many requests: repeated sign-in failures, walking through paths that don't exist, bursts of errors. Behaviour rules look at the client, not just the request.
Repeat offenders banned
Clients that keep sending high-risk requests are banned through CrowdSec for 4 hours, then 24 hours, then 7 days, across all your servers.
Rules first, ML in evaluation
Blocking decisions come from rules and from your app's learned query shapes. A machine-learning scorer is in evaluation and only observes for now.
What it doesn't do
DBshieldX protects the application and database layers. It isn't a volumetric DDoS network and doesn't replace your CDN; keep your CDN for that, and the two work together. No firewall catches every attack, which is why we publish how we measure and keep a second check at the database.
See it on your own traffic.
We'll set up DBshieldX in monitor mode on one of your sites and walk you through what it finds after a week. Nothing is blocked until you say so.