Please enable JavaScript.
Coggle requires JavaScript to display documents.
(🔐 20. Enterprise Best Practices, ⚔️ 4. Attacks Blocked by WAF, 🎓 21.…
🔐 20. Enterprise Best Practices
Principle of Least Privilege
Enable HTTPS only
Update OWASP Core Rule Set regularly
Tune false positives
Backup configuration
Version control rules
Centralized logging
Continuous monitoring
High Availability deployment
Load balancing
Regular penetration testing
Security audits
Patch operating system
Patch web server
Patch WAF
Integrate with SIEM
Alert Security Operations Center
Incident response procedures
Change management
Configuration management
Disaster recovery planning
⚔️ 4. Attacks Blocked by WAF
💉 Structured Query Language Injection (SQL Injection)
Reads database
Deletes data
Bypasses authentication
Example
'
OR 1=1
UNION SELECT
💻 Cross Site Scripting (XSS)
Stored
Reflected
Document Object Model (DOM)
📂 Local File Inclusion (LFI)
../../etc/passwd
🌍 Remote File Inclusion (RFI)
💥 Command Injection
;
&&
||
$(command)
🔑 Authentication Bypass
🍪 Cookie Manipulation
📤 File Upload Attack
PHP Shell
JSP Shell
ASPX Shell
📦 Path Traversal
🧬 XML External Entity (XXE)
📡 Server Side Request Forgery (SSRF)
🚪 Cross Site Request Forgery (CSRF)
🐚 Web Shell Upload
🚦 Brute Force Login
🤖 Bot Traffic
🚫 Denial of Service
🚫 Distributed Denial of Service
🔍 Directory Enumeration
📜 HTTP Header Manipulation
🎭 User-Agent Spoofing
🎓 21. Enterprise Skills
Apache HTTP Server administration
Nginx administration
Linux system administration
HTTP protocol
HTTPS and Transport Layer Security
OWASP Top 10
Regular Expressions
ModSecurity rules
Log analysis
SIEM integration
Reverse Proxy
Load Balancing
Web Security
Incident Response
Threat Hunting
Performance Tuning
Automation using Ansible
Infrastructure as Code
DevSecOps
🔍 5. Request Inspection
URL
URI
HTTP Method
GET
POST
PUT
DELETE
PATCH
OPTIONS
HEAD
Headers
Cookies
Query String
Request Body
JSON
XML
Multipart Form Data
File Upload
Session
Token
Authorization Header
📂 9. Important Linux Directories
/etc/modsecurity/
/etc/modsecurity/modsecurity.conf
/etc/modsecurity/crs/
/usr/share/modsecurity-crs/
/etc/nginx/
/etc/apache2/
/etc/httpd/
/var/log/apache2/
/var/log/httpd/
/var/log/nginx/
/var/log/modsec_audit.log
/var/log/modsec_debug.log
📜 13. OWASP Core Rule Set
Initialization Rules
Protocol Validation
SQL Injection Detection
Cross Site Scripting Detection
Local File Inclusion Detection
Remote File Inclusion Detection
Remote Command Execution Detection
PHP Injection Detection
Scanner Detection
Session Fixation Detection
Blocking Evaluation
📖 6. Rule Engine
Positive Security Model
Allow only trusted requests
Negative Security Model
Block known attacks
Signature Based Detection
Pattern Matching
Regular Expressions
Custom Rules
Score Based Detection
Reputation Based Detection
GeoIP Filtering
Rate Limiting
🚨 16. Monitoring
Request Count
Blocked Requests
Allowed Requests
Rule Hits
Attack Trends
Top Attackers
Source IP Addresses
Countries
User Agents
Response Codes
💻 18. Useful Commands
apachectl configtest
apachectl -M
nginx -t
systemctl status apache2
systemctl status httpd
systemctl status nginx
journalctl -u apache2
journalctl -u nginx
tail -f /var/log/modsec_audit.log
grep ModSecurity /var/log/apache2/error.log
🏗️ 2. WAF Position in Enterprise Network
🌍 Internet
🌐 Domain Name System (DNS)
⚖️ Load Balancer
🛡️ Web Application Firewall
🔄 Reverse Proxy
🌍 Web Server
Apache HTTP Server
Nginx
⚙️ Application Server
PHP
Java
Python
Node.js
.NET
🗄️ Database Server
MySQL
MariaDB
PostgreSQL
Oracle Database
🔎 14. Logging
Audit Log
Error Log
Access Log
Debug Log
JSON Logging
Syslog
Remote Syslog
SIEM Integration
🧪 17. Testing
curl
wget
Burp Suite
OWASP Zed Attack Proxy
Nikto
SQLMap
Nmap
WhatWeb
📡 3. Open Systems Interconnection (OSI) Layer
Layer 1 Physical
Layer 2 Data Link
Layer 3 Network
Layer 4 Transport
Layer 5 Session
Layer 6 Presentation
🛡️ Layer 7 Application
HTTP
HTTPS
REST API
GraphQL
SOAP
🔧 12. Main Configuration
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off
SecAuditEngine RelevantOnly
SecAuditLog /var/log/modsec_audit.log
SecDebugLog /var/log/modsec_debug.log
SecDebugLogLevel 3
🔄 19. Request Processing Flow
Client sends HTTP request
DNS resolves hostname
Load Balancer receives traffic
WAF inspects request
Rules evaluated
Attack detected
Block request
Return HTTP 403 Forbidden
Log event
No attack detected
Forward request
Web Server
Application Server
Database
Response returned
WAF inspects response if enabled
Client receives response
🐧 8. Linux Deployment
Ubuntu
Debian
Red Hat Enterprise Linux
Rocky Linux
AlmaLinux
SUSE Linux Enterprise
📄 11. Configuration Files
modsecurity.conf
crs-setup.conf
REQUEST-901-INITIALIZATION.conf
REQUEST-942-APPLICATION-ATTACK-SQLI.conf
REQUEST-941-APPLICATION-ATTACK-XSS.conf
RESPONSE-999-EXCLUSION-RULES.conf
📊 15. SIEM Integration
Elastic Stack
Wazuh
Splunk
IBM QRadar
Microsoft Sentinel
Graylog
🌐 1. What is a Web Application Firewall (WAF)
📖 Definition
Protects web applications from attacks targeting HyperText Transfer Protocol (HTTP) and HyperText Transfer Protocol Secure (HTTPS)
Inspects application-layer traffic (OSI Layer 7)
Filters, monitors, logs, and blocks malicious requests
Protects websites, APIs (Application Programming Interfaces), and web services
Works before requests reach Apache HTTP Server, Nginx, or application servers
🎯 Goals
Prevent web attacks
Protect confidential information
Reduce attack surface
Meet compliance requirements
Improve application availability
🏢 Enterprise Use Cases
Banking
Healthcare
Government
Cloud services
E-commerce
Software as a Service (SaaS)
Internal enterprise portals
⚙️ 10. Installation
Ubuntu
sudo apt update
sudo apt install libapache2-mod-security2
sudo apt install modsecurity-crs
Red Hat Enterprise Linux
sudo dnf install mod_security
sudo dnf install mod_security_crs
Verify
apachectl -M
nginx -V
🛠️ 7. Enterprise WAF Solutions
Open Source
ModSecurity
NAXSI
Coraza
Commercial
F5 Advanced WAF
Imperva
Barracuda
Fortinet FortiWeb
Cloudflare WAF
Amazon Web Services WAF
Microsoft Azure Web Application Firewall