Lion Cipher Lab
Put a Web Application Firewall in front of your web app
- AppSec / DevSecOps
- Beginner
- ~60 min
- Free · no account required
Why it matters
Hardening the server closes the doors you know about; a Web Application Firewall watches the traffic that comes through the doors you left open. It sits between the internet and your app, reads each HTTP request, and blocks the shapes of attack that have been seen a thousand times before — SQL injection strings, cross-site-scripting payloads, path traversal, scanner probes — without you having to fix every one in your application code first. It is not a substitute for writing safe code, but it is a fast, high-leverage layer of defense, and standing one up in front of your own app teaches you…
What you'll learn
- understanding what a WAF does
- deploying ModSecurity with nginx or the OWASP CRS Docker image
- installing and wiring in the OWASP Core Rule Set
- running a WAF in detection mode before blocking
- reading a ModSecurity audit log
- understanding anomaly scoring
- switching from detection to blocking mode
- tuning false positives with paranoia levels
Steps in this lab
- What a WAF is, and the rule of the lab
- Pick a deployment: the CRS Docker image (fast) or the nginx connector
- Install the OWASP Core Rule Set and wire it in
- Start in detection mode — never block first
- Trip a rule on purpose — a benign test against your OWN app
- Read the audit log — see exactly what the WAF saw
- Switch to blocking mode
- Tune false positives with paranoia levels — and what you've built