← All projects
WAF with ModSecurity and the OWASP CRS on Docker
A Web Application Firewall sitting between the client and a farm of web servers, with OWASP CRS rules and a measurement of what it costs in performance.
Demo
What it does
- Nginx + ModSecurity v3 + OWASP Core Rule Set in a dedicated container
- Mitigation of SQLi, XSS and LFI/RFI verified through functional tests
- A 1 WAF + 2 Apache backends architecture on an internal Docker network
- Custom rule exclusions for WebSocket/Socket.IO traffic
- Cost measured with Apache Benchmark: 2,586 → 1,663 req/s and +2.1 ms per request, without a single failed request
- CRS rules that fire: 942100/942110 (SQLi through libinjection), 941100/941110/941160/941320 (XSS), 930100/930120 (path traversal), 932160 (remote execution)