How dre4664/waf_application_security_lab works
This repository is a WAF and application-security lab: it combines an Nginx/ModSecurity protection stack with a standalone OWASP attack simulator. The principal demonstrated workflow runs simulated requests through pattern checks and reports allow, alert, or block outcomes. The README also documents deployment, TLS, rate limiting, geo-blocking, and broader OWASP controls. Those documented capabilities are represented, but wiring beyond the supplied simulator excerpt and file tree is not inferred.
Main entry points: nginx.conf Nginx WAF · attack_simulator.py Request analyzer · docker-compose.yml Protected backend · waf-rules.conf Custom WAF rules
Components 15
WAF deployment
- Nginx WAF
nginx/nginx.conf - ModSecurity / CRS
nginx/nginx.conf - Protected backend
docker-compose.yml
Security controls
- Custom WAF rules
nginx/waf-rules.conf - Rate and geo controls
nginx/nginx.conf - TLS / mTLS
- OWASP controls
nginx/nginx.conf
Attack simulation
- Attack simulator
src/attack_simulator.py - Scenario runner
src/attack_simulator.py - Request analyzer
src/attack_simulator.py - Detection patterns
src/attack_simulator.py - Action and findings
src/attack_simulator.py
Lab resources
- SQLi payload examples
sample-attacks/sqli-payloads.txt - Rule guide
docs/waf-rules-explained.md
Other components
- Internet client
Connections 11
- Internet client → Nginx WAF: sends requests
README.md - Nginx WAF → ModSecurity / CRS: uses rules
README.md - Nginx WAF → Protected backend: forwards traffic
README.md - ModSecurity / CRS → Custom WAF rules: applies controls
README.md - Nginx WAF → Rate and geo controls: enforces
README.md - Nginx WAF → TLS / mTLS: secures traffic
README.md - Nginx WAF → OWASP controls: mitigates risks
README.md - Attack simulator → Scenario runner: runs scenarios
src/attack_simulator.py - Scenario runner → Request analyzer: analyzes request
src/attack_simulator.py - Request analyzer → Detection patterns: checks patterns
src/attack_simulator.py - Request analyzer → Action and findings: returns decision
src/attack_simulator.py