ngoctint1lvc/waf

Web Application Firewall for thesis

Web Application Firewall

This project is a web application firewall (WAF) based on ModSecurity Core Rule Set with some Machine Learning improvements. This project is currently under development and will release soon.

How to run

Prerequisites

To build and run this project, you must install docker and docker-compose first. Refer to the official docker documentation for the installation.

• https://docs.docker.com/get-docker/
• https://docs.docker.com/compose/install/

Deployment

Clone and init submodule

git clone https://github.com/ngoctint1lvc/waf.git
cd waf/
git submodule update --init --recursive

Create .env file from .env.example

MONGODB_SERVER=log-db
MONGO_INITDB_ROOT_USERNAME=
MONGO_INITDB_ROOT_PASSWORD=
DEBUG=1
MONGO_EXPRESS_USERNAME=
MONGO_EXPRESS_PASSWORD=
COLLECTION_PREFIX=test

Add your certificate and private key in openresty/nginx/ssl folder

./openresty/nginx/ssl
├── localhost-key.pem
└── localhost.pem

Start all services

docker-compose -f docker-compose.prod.yml up -d

Redirect all traffic to http proxy server at port 80

How to develop

Clone this project and start all docker services. Two images for testing including DVWA and Nginx server.

git clone https://github.com/ngoctint1lvc/waf.git
cd waf/
git submodule update --init --recursive

Add 2 local dns record to your host files

127.0.0.1 dvwa.test
127.0.0.1 nginx.test

Start all containers

docker-compose up -d

Authors

• ngoctin - my github repo

waf's Issues

Try simple ML method with HTTP CSIC 2010 dataset

Allow log raw HTTP traffic to replay later

Allow to overwrite waf mode with custom header

We can use header like X-WAF-Mode: learning_attack to overwrite current waf mode for single request.

Discord bug

Cannot using discord

Cannot load tradahacking.vn post

The webpage at https://tradahacking.vn/điện-thoại-trung-quốc-có-thực-sự-rẻ-phần-2-5da0c8aff9b4?source=collection_home---4------1----------------------- might be temporarily down or it may have moved permanently to a new web address.

Transform public dataset to MongoDB format

Try to implement ModSecurity-Nginx as a Openresty module

Move WAF config to redis to avoid recreation of docker container (using .env file). Research how to expose openresty api into modsecurity.

Data set not available

Hey, I really like your project, I'm also a student, I want to try to make a ModSecurity module using ML but with a neural networks. I wanted to run your ipynb file but the dataset seems unavailable, I got the access code but the files are missing or removed on google drive. Could you share your datasets please?

Setup openresty proxy server instead of mitmproxy

Clean data for ML training

Translate MongoDB document format to table format

Web Portal to manage requests

Generate attack data using different tools

Update README