Writing and tuning WAF rules: ModSecurity and OWASP CRS
You put a web application firewall in front of your own app, tune the OWASP CRS by weeding out false positives, write virtual patches and rate-limit rules, verify rules with tests and move safely to blocking mode.
Level 301 · 18 lessons · 16 practice labs
Lessons
Where the WAF fits
- What a WAF can and cannot do: no substitute for secure code
- Deployment modes: embedded, reverse proxy and cloud
- The ModSecurity and Coraza engines
- A safe start with detection-only mode
- Short task: put a WAF in detection-only mode in front of the lab app
The OWASP CRS
- Anomaly scoring and thresholds
- Paranoia levels: balancing protection and noise
- Reading the audit log: which rule fired and why
- Handling false positives: rule exclusion methods
- Short task: enable the CRS and tune it without breaking legitimate traffic
Writing rules
- The SecRule language: variables, operators, transformations and actions
- Virtual patching: covering a specific flaw until the fix arrives
- Rate-limit and brute-force rules
- Testing rules: regression tests with go-ftw
- Short task: write and test a virtual patch for a known flaw in the lab app
Operating
- A plan for switching to blocking mode
- Managing rule changes as code
- Capstone: deliver a tuned, tested WAF running in blocking mode for an application
Practice labs
- Set up a WAF in detection mode: Put a WAF in front of the lab app in detection-only mode and show legitimate traffic is unaffected.
- Read the audit log: which rule fired: From the audit log entry of a blocked request, pull out the rules that fired, the matched data and the anomaly score.
- Tune the anomaly threshold: Try different thresholds against recorded legitimate and attack traffic and choose the value that separates them best, with reasons.
- Raise the paranoia level and measure the noise: Raise the paranoia level one step, count the new false positives and list which endpoints need tuning.
- A false positive on a rich-text field: Find the rule that blocks the blog editor's legitimate HTML content and exclude it for that parameter only.
- An exclusion without disabling the whole rule: Change a configuration that disabled a rule site-wide into an exclusion limited to the affected path and variable.
- A false positive storm on a JSON API: Group the rules firing on JSON API requests, set the body processor correctly and solve the rest with narrow exclusions.
- CRS without breaking legitimate traffic: Replay a day of recorded traffic to weed out every false positive and prove the attack samples are still caught.
- A first SecRule: a forbidden path: Write a rule that refuses and logs outside requests to the /internal path.
- Catch encoded input with transformations: Add the right transformations to a rule that misses encoded input and show it now catches it.
- Catch the request this WAF rule misses: Find the request variant a virtual patch misses in recorded traffic and widen the rule without creating false positives.
- A brute-force rule for login: Write a rule that counts failed logins per IP and blocks temporarily past a threshold.
- A virtual patch: until the fix lands: Write and test a virtual patch for a known path traversal flaw in the lab app that targets that endpoint only.
- Put a rule change through code review: Find the faulty exclusion in a WAF rule pull request and write a reasoned review comment.
- A regression test with go-ftw: Add positive and negative go-ftw tests for your rule and show a change that breaks the rule fails the tests.
- A plan for switching to blocking mode: Draw up an endpoint-by-endpoint plan to move to blocking from detection-mode data, apply the first step and test the rollback path.
About this course
You put a web application firewall in front of your own app, tune the OWASP CRS by weeding out false positives, write virtual patches and rate-limit rules, verify rules with tests and move safely to blocking mode.
What you will learn
- Where the WAF fits
- The OWASP CRS
- Writing rules
- Operating
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.