Web application firewall: ModSecurity and OWASP CRS
You put ModSecurity and the OWASP Core Rule Set in front of a web application, tune false positives, write virtual patches and read attacks from WAF logs.
Level 401 · 13 lessons · 15 practice labs
Lessons
Setup
- What a WAF can and cannot do
- Installing ModSecurity with Nginx and detection-only mode
- CRS, paranoia levels and anomaly scoring
- Reading the ModSecurity audit log
- Short task: find an SQL injection attempt in the log and extract the rule ID
Tuning
- Tuning false positives: rule exclusion methods
- Planning the switch to blocking mode
- Writing your own ModSecurity rule
- Virtual patching: closing a hole until the fix arrives
- Short task: write and test a virtual patch for a known vulnerability
Operations
- WAF bypass techniques and why it must not be the only defence
- Shipping WAF logs to the SIEM
- Capstone: protect a live application with a WAF and switch to blocking with no false positives
Practice labs
- Find the attack and the rule in the ModSecurity audit log: Find the XSS attempt in the log and note the triggered rule ID and anomaly score.
- Pick out real attackers from anomaly scores: Score a day of audit records per source and list the real attackers above the threshold.
- Split WAF events into meaningful fields for the SIEM: Parse the JSON audit log, extract the rule, URI and source fields and make them searchable in the SIEM.
- Find the rule that blocks a legitimate form: Find the rule ID from the blocked request’s record and add a targeted exclusion for that field only.
- Raise the paranoia level and fix the new false positives: Raise the level to 2, run the normal traffic test and clear the resulting false positives with narrow exclusions.
- Prove you are ready to switch to blocking mode: Review a week of detection-only records, show no false positives remain, switch to blocking and test.
- Close a flaw with a virtual patch until the fix arrives: Write a rule for the flaw in one parameter and show the attack request is blocked while normal requests pass.
- Write a custom rule that applies to one URL only: Write a rule blocking external requests to the admin panel path and confirm access from an internal address.
- Harden a virtual patch bypassed with an encoded attack: Show an attack slipping through with URL and double encoding, strengthen the rule with transformations and retest.
- Write a virtual patch for an upload flaw based on content type: Write a rule blocking script uploads on an endpoint meant for images only and test legitimate uploads.
- Link the same attacker arriving with different tools: Tie requests with changing User-Agents to the same attacker by source, timing and rule pattern.
- Derive from an advisory what a virtual patch must block: Read a fictional advisory and note the affected URL, parameter and malicious input pattern as a draft for a single rule.
- Write a rule that opens the admin panel to the office address only: Write a ModSecurity rule that rejects with 403 any request to the admin path not coming from the office address, and test it from two sources.
- Filter one client’s requests in the audit log: Extract the rules triggered by one source address and its request count from the audit log.
- Track and block an attacker who rotates addresses by fingerprint: Derive a fingerprint from header order, user agent and request pattern, write a rule with a persistent collection that scores on it and test that legitimate users are unaffected.
About this course
You put ModSecurity and the OWASP Core Rule Set in front of a web application, tune false positives, write virtual patches and read attacks from WAF logs.
What you will learn
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.