Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ 1. Apache + ModSecurity WAF Engineer Roadmap (Enterprise Level) -…
🛡️ 1. Apache + ModSecurity WAF Engineer Roadmap (Enterprise Level)
🛡️ 1. Apache + ModSecurity WAF Engineer Roadmap (Enterprise Level)
🌐 1.1 Target Roles
👨💻 1.1.1 Application Security Engineer
🔹 Web Application Protection
🔹 OWASP Top 10 Mitigation
🔹 WAF Rule Management
🛡️ 1.1.2 Web Application Security Engineer
🔹 Apache Hardening
🔹 ModSecurity Deployment
🔹 Attack Detection
🔥 1.1.3 Cybersecurity Engineer (WAF)
🔹 WAF Architecture
🔹 Security Policy Management
🔹 Incident Response
📊 1.1.4 SOC Analyst L2 Web Security
🔹 WAF Alert Investigation
🔹 Attack Analysis
🔹 Log Monitoring
🐧 1.1.5 Linux Security Engineer
🔹 Apache Administration
🔹 Linux Hardening
🔹 Service Security
⚙️ 1.1.6 DevSecOps Security Engineer
🔹 CI/CD WAF Integration
🔹 Security Automation
🔹 Secure Deployment
🌐 2. Apache HTTP Server Fundamentals
📌 2.1 Apache Architecture
🏗️ 2.1.1 Apache Core Components
🔹 HTTPD Service (Apache Engine , start, stop, systemctl)
🔹 Modules (Functionality Extensions)
🔹 Configuration Files (Server Behavior)
🔹 Virtual Hosts (Multiple Websites / Applications)
⚙️ 2.1.2 Apache Process Model
MPM : Multi Processing Modules
🟢 Prefork MPM
🔹 Process Based
🔹 Older PHP Applications
One process per connection
🟡 Worker MPM
🔹 Thread Based
🔹 Better Performance
Multi-thread based
🔵 Event MPM
🔹 Modern Production Usage
🔹 High Concurrent Traffic
High-performance asynchronous model
📂 2.2 Apache Important Files
📄 2.2.1 Main Configuration
RHEL/CentOS:
/etc/httpd/conf/httpd.conf
Ubuntu:
/etc/apache2/apache2.conf
📁 2.2.2 Configuration Directory
Ubuntu:
/etc/apache2/
Includes:
📂 sites-available
🔹 Virtual Host Templates
📂 sites-enabled
🔹 Active Websites
📂 mods-enabled
🔹 Enabled Modules
🔧 2.3 Apache Service Management
▶️ Start Apache
systemctl start httpd
systemctl start apache2
🔄 Restart Apache
systemctl restart httpd
🔍 Check Status
systemctl status httpd
🧪 Configuration Testing
apachectl configtest
🔐 3. Apache Security Hardening
🛡️ 3.1 Information Disclosure Protection
Remove Server Version
ServerTokens Prod
ServerSignature Off
Disable Directory Listing
Options -Indexes
Hide Error Details
ErrorDocument 403 /403.html
🔑 3.2 Access Control
Allow/Deny Based Access
Example:
Require ip 10.10.10.0/24
Block Specific IP:
Require not ip 192.168.1.50
🔒 3.3 SSL/TLS Security
SSL/TLS security is a technology used to encrypt communication between two systems so attackers cannot read or modify the data being transmitted.
Tools:
🔹 OpenSSL
🔹 testssl.sh
🔹 SSL Labs
Commands:
openssl s_client -connect domain.com:443
Apache SSL Configuration:
SSLEngine On
SSLCertificateFile
SSLCertificateKeyFile
🚫 3.4 Disable Dangerous HTTP Methods
Block:
TRACE
PUT
DELETE
Configuration:
TraceEnable Off
📊 3.5 Apache Logging
Access Log:
/var/log/httpd/access_log
Error Log:
/var/log/httpd/error_log
Log Analysis Tools:
🔹 grep
🔹 awk
🔹 sed
🔹 ELK Stack
🛡️ 4. ModSecurity WAF Fundamentals
🔥 4.1 What is ModSecurity?
Apache Security Module
Provides:
🔹 Request Inspection
🔹 Attack Detection
🔹 Blocking Malicious Traffic
🔹 Security Logging
🏗️ 4.2 ModSecurity Architecture
Client
↓
Apache Web Server
↓
ModSecurity Engine
↓
Rules Engine
↓
Allow / Block Decision
⚙️ 5. Installing ModSecurity on Linux
🐧 5.1 RHEL Installation
Install Packages:
yum install mod_security mod_security_crs
Restart:
systemctl restart httpd
🐧 5.2 Ubuntu Installation
Install:
apt install libapache2-mod-security2
Enable Module:
a2enmod security2
Restart:
systemctl restart apache2
📁 6. ModSecurity Configuration
📂 6.1 Main Configuration
Location:
/etc/modsecurity/
Main File:
modsecurity.conf
⚙️ 6.2 Enable Detection Engine
Detection Only Mode:
SecRuleEngine DetectionOnly
Blocking Mode:
SecRuleEngine On
Disable:
SecRuleEngine Off
📜 7. ModSecurity Rules Development
🧩 7.1 Rule Structure
SecRule
VARIABLE
OPERATOR
ACTIONS
Example:
SecRule ARGS
"@contains
select"
"id:1001,deny,status:403"
Explanation:
🔹 ARGS
Request Parameters
🔹 Operator
contains
String Matching
🔹 Action
deny
Block Request
🔥 8. OWASP Core Rule Set (CRS)
🛡️ 8.1 What is CRS?
Community Managed Security Rules
Protects Against:
💉 SQL Injection
📜 XSS
🖥️ RCE
📂 File Inclusion
🔑 Authentication Attacks
📁 CRS Location
/usr/share/modsecurity-crs/
Enable CRS:
Include rules/*.conf
🚨 9. Attack Detection Practical Labs
💉 9.1 SQL Injection Detection
Attack Example:
' OR 1=1 --
Detection:
SQL Injection Rules
Logs:
/var/log/apache2/modsec_audit.log
🖥️ 9.2 Remote Code Execution
Example:
; cat /etc/passwd
Detection:
Command Injection Rules
📜 9.3 Cross Site Scripting
Example:
<script>alert(1)</script>
Detection:
XSS Rules
📊 10. ModSecurity Logging
📁 10.1 Audit Logs
Location:
/var/log/modsec_audit.log
🔍 Analyze Logs
Commands:
cat modsec_audit.log
grep "403" modsec_audit.log
📈 Enterprise Integration
Send Logs To:
🔹 ELK Stack
🔹 Splunk
🔹 QRadar
🔹 Sentinel
🧪 11. Security Testing Tools
🔍 11.1 Web Testing
🕷️ Burp Suite
HTTP Request Testing
🐍 OWASP ZAP
Automated Scanning
🔥 Nikto
Web Server Scanner
💉 11.2 Attack Simulation
SQLMap
SQL Injection Testing
Nmap
Service Discovery
Curl
HTTP Testing
🏢 12. Enterprise WAF Operations
📋 12.1 Daily Tasks
🔍 Review WAF Alerts
📝 Analyze Attack Logs
🔧 Tune False Positives
📊 Generate Security Reports
🚨 12.2 Incident Response
Detection
↓
Investigation
↓
Rule Tuning
↓
Blocking
↓
Report
⚖️ 13. ModSecurity Rule Tuning
❌ False Positive Example
Legitimate Request Blocked
Solution:
Create Exception Rule
Example:
SecRuleRemoveById 942100
🚀 14. Enterprise Deployment Architecture
🌐 Internet
↓
🔥 Firewall
↓
🛡️ Apache + ModSecurity WAF
↓
🖥️ Application Server
↓
🗄️ Database
📚 15. Hands-On Enterprise Labs
🧪 Lab 1
Install Apache
Configure Virtual Host
Enable SSL
🧪 Lab 2
Install ModSecurity
Enable CRS
Detect SQL Injection
🧪 Lab 3
Create Custom Rules
Block Attacks
🧪 Lab 4
Send WAF Logs To ELK
🧪 Lab 5
Perform Incident Investigation
🎯 16. Job Interview Preparation
❓ Explain ModSecurity Architecture
❓ Difference Between WAF and Firewall
❓ How CRS Detects Attacks
❓ How To Tune False Positives
❓ How To Write Custom Rules
❓ How To Investigate WAF Alerts
❓ How Apache Security Hardening Works
🏆 17. Final Enterprise Skill Set
🐧 Linux Administration
🌐 Apache Administration
🛡️ ModSecurity WAF
📜 OWASP CRS
🔥 Web Attack Detection
📊 WAF Log Analysis
🧪 Security Testing
🚨 Incident Response
⚙️ Security Automation