This project is part of my undergraduate research, focusing on optimizing website security through the implementation of a Web Application Firewall (WAF) using ModSecurity with the OWASP Core Rule Set (CRS). The system was tested against three major attack types: SQL Injection, Cross-Site Scripting (XSS), and Application Layer DDoS.
- Objective: To protect a vulnerable web application (DVWA) from common web attacks using ModSecurity WAF.
- Testing Environment: Local testbed simulating real-world attacks.
- Attacks Simulated: SQL Injection, Cross-Site Scripting (XSS), and Slow HTTP (Slowloris) DoS.
- Evaluation Focus: Effectiveness of detection and blocking capability.
| Component | Technology |
|---|---|
| Web Server | Nginx |
| WAF Engine | ModSecurity v3.x |
| Rule Set | OWASP CRS v4.x |
| Target Web App | Damn Vulnerable Web App (DVWA) |
| OS & Tools | Kali Linux, SQLMap, XSSer, Slowloris |
- Installed ModSecurity v3.x as a dynamic module for Nginx
- Configured OWASP CRS as the primary detection ruleset
- Deployed DVWA on local server
- Simulated attacks using offensive tools inside isolated testing environment
- Analyzed ModSecurity logs (
/var/log/modsec_audit.log) for detection evidence
| Attack Type | Tool Used | Result Without WAF | Result With ModSecurity WAF |
|---|---|---|---|
| SQL Injection | SQLMap | Database Extracted | 🚫 Blocked |
| XSS | XSSer | Script Executed | 🚫 Blocked |
| HTTP DoS (Slowloris) | Slowloris | Service Exhausted |
ModSecurity was effective for SQLi and XSS prevention but only partially mitigated application-layer DDoS due to architectural limitations.
.
├── modsecurity.conf # Main ModSecurity configuration file ├── crs-setup.conf # OWASP CRS customization ├── nginx.conf (partial) # WAF integration section ├── test-scripts/ │ ├── sqlmap_test.sh │ ├── xsser_test.sh │ └── slowloris_test.py └── README.md # Project documentation
- Rule tuning is crucial: False positives can affect site usability.
- Not all threats are equally handled: Application-layer DoS needs rate limiting or external services.
- Log analysis is essential: ModSecurity provides granular forensic logs.
- Integrate with Fail2Ban or Nginx rate limiting for better DoS mitigation.
- Write custom ModSecurity rules for business-specific logic.
- Deploy and test on a cloud environment (e.g., AWS EC2, DigitalOcean) for real-world simulation.
This project was developed as part of my undergraduate thesis titled:
"Optimizing Website Security through the Implementation of a ModSecurity-based Web Application Firewall"
I am currently open to freelance cybersecurity projects, especially those related to web security, threat detection, WAF configuration, and basic penetration testing. Feel free to reach out!
- LinkedIn: [https://www.linkedin.com/in/rizaldymustakim/]
- Email: [rizaldimustakim10@gmail.com]
- GitHub: [github.com/ItsMeAldy]
✅ If you found this project interesting, feel free to clone, fork, or contact me for collaboration or freelance opportunities.