# dre4664/waf_application_security_lab architecture

> Architecture diagram of the GitHub repository dre4664/waf_application_security_lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dre4664/waf_application_security_lab
- Repository: https://github.com/dre4664/waf_application_security_lab

## Overview

This repository is a WAF and application-security lab: it combines an Nginx/ModSecurity protection stack with a standalone OWASP attack simulator. The principal demonstrated workflow runs simulated requests through pattern checks and reports allow, alert, or block outcomes. The README also documents deployment, TLS, rate limiting, geo-blocking, and broader OWASP controls. Those documented capabilities are represented, but wiring beyond the supplied simulator excerpt and file tree is not inferred.

Main entry points: [`nginx/nginx.conf`](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf) (Nginx WAF), [`src/attack_simulator.py`](https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py) (Request analyzer), [`docker-compose.yml`](https://github.com/dre4664/waf_application_security_lab/blob/main/docker-compose.yml) (Protected backend), [`nginx/waf-rules.conf`](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/waf-rules.conf) (Custom WAF rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_deployment["WAF deployment"]
  node_nginx["Nginx WAF<br/>[nginx.conf]"]
  node_modsec["ModSecurity / CRS<br/>[nginx.conf]"]
  node_backend["Protected backend<br/>[docker-compose.yml]"]
end

subgraph group_rules["Security controls"]
  node_financial_rules["Custom WAF rules<br/>[waf-rules.conf]"]
  node_rate_geo["Rate and geo controls<br/>[nginx.conf]"]
  node_tls["TLS / mTLS"]
  node_security_controls["OWASP controls<br/>[nginx.conf]"]
end

subgraph group_simulation["Attack simulation"]
  node_simulator["Attack simulator"]
  node_test_runner["Scenario runner"]
  node_analyzer["Request analyzer"]
  node_pattern_rules["Detection patterns"]
  node_findings["Action and findings"]
end

subgraph group_reference["Lab resources"]
  node_payloads["SQLi payload examples<br/>[sqli-payloads.txt]"]
  node_rule_guide["Rule guide"]
end

node_internet(("Internet client"))

node_internet -->|"sends requests"| node_nginx
node_nginx -->|"uses rules"| node_modsec
node_nginx -->|"forwards traffic"| node_backend
node_modsec -->|"applies controls"| node_financial_rules
node_nginx -->|"enforces"| node_rate_geo
node_nginx -.->|"secures traffic"| node_tls
node_nginx -->|"mitigates risks"| node_security_controls
node_simulator -->|"runs scenarios"| node_test_runner
node_test_runner -->|"analyzes request"| node_analyzer
node_analyzer -->|"checks patterns"| node_pattern_rules
node_analyzer -->|"returns decision"| node_findings

click node_nginx "https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf"
click node_modsec "https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf"
click node_backend "https://github.com/dre4664/waf_application_security_lab/blob/main/docker-compose.yml"
click node_financial_rules "https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/waf-rules.conf"
click node_rate_geo "https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf"
click node_security_controls "https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf"
click node_simulator "https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py"
click node_test_runner "https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py"
click node_analyzer "https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py"
click node_pattern_rules "https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py"
click node_findings "https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py"
click node_payloads "https://github.com/dre4664/waf_application_security_lab/blob/main/sample-attacks/sqli-payloads.txt"
click node_rule_guide "https://github.com/dre4664/waf_application_security_lab/blob/main/docs/waf-rules-explained.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_nginx,node_modsec,node_backend,node_internet toneBlue
class node_financial_rules,node_rate_geo,node_tls,node_security_controls toneAmber
class node_simulator,node_test_runner,node_analyzer,node_pattern_rules,node_findings toneMint
class node_payloads,node_rule_guide toneRose
```

## Components

### WAF deployment

- [Nginx WAF](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf): `nginx/nginx.conf`
- [ModSecurity / CRS](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf): `nginx/nginx.conf`
- [Protected backend](https://github.com/dre4664/waf_application_security_lab/blob/main/docker-compose.yml): `docker-compose.yml`

### Security controls

- [Custom WAF rules](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/waf-rules.conf): `nginx/waf-rules.conf`
- [Rate and geo controls](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf): `nginx/nginx.conf`
- **TLS / mTLS**
- [OWASP controls](https://github.com/dre4664/waf_application_security_lab/blob/main/nginx/nginx.conf): `nginx/nginx.conf`

### Attack simulation

- [Attack simulator](https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py): `src/attack_simulator.py`
- [Scenario runner](https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py): `src/attack_simulator.py`
- [Request analyzer](https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py): `src/attack_simulator.py`
- [Detection patterns](https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py): `src/attack_simulator.py`
- [Action and findings](https://github.com/dre4664/waf_application_security_lab/blob/main/src/attack_simulator.py): `src/attack_simulator.py`

### Lab resources

- [SQLi payload examples](https://github.com/dre4664/waf_application_security_lab/blob/main/sample-attacks/sqli-payloads.txt): `sample-attacks/sqli-payloads.txt`
- [Rule guide](https://github.com/dre4664/waf_application_security_lab/blob/main/docs/waf-rules-explained.md): `docs/waf-rules-explained.md`

### Other components

- **Internet client**

## Connections

- Internet client → Nginx WAF: sends requests (evidence: `README.md`)
- Nginx WAF → ModSecurity / CRS: uses rules (evidence: `README.md`)
- Nginx WAF → Protected backend: forwards traffic (evidence: `README.md`)
- ModSecurity / CRS → Custom WAF rules: applies controls (evidence: `README.md`)
- Nginx WAF → Rate and geo controls: enforces (evidence: `README.md`)
- Nginx WAF → TLS / mTLS: secures traffic (evidence: `README.md`)
- Nginx WAF → OWASP controls: mitigates risks (evidence: `README.md`)
- Attack simulator → Scenario runner: runs scenarios (evidence: `src/attack_simulator.py`)
- Scenario runner → Request analyzer: analyzes request (evidence: `src/attack_simulator.py`)
- Request analyzer → Detection patterns: checks patterns (evidence: `src/attack_simulator.py`)
- Request analyzer → Action and findings: returns decision (evidence: `src/attack_simulator.py`)