Web Application Firewall (Build) · Hacking Project

Design and implement a transparent, tunable Layer-7 web application firewall that detects and blocks the OWASP Top 10 attack classes while minimizing false positives.

**The problem**
Web applications remain the single most-attacked enterprise surface, yet most teams rely on opaque, vendor-managed WAFs whose detection logic they cannot inspect, tune, or extend. Off-the-shelf rule sets generate high false-positive rates that erode trust and get disabled, while novel injection and evasion payloads slip past signature-only engines. Engineers who cannot read or write WAF internals cannot reason about coverage gaps or bypasses.

**What you'll build**
Build a reverse-proxy WAF that terminates HTTP(S), normalizes and canonicalizes requests, and evaluates them through a layered engine combining OWASP CRS-style signatures, positive-security (allowlist) schema validation, and an anomaly-scoring model. Integrate ModSecurity-compatible rule parsing, per-endpoint rate limiting, and structured logging to a SIEM, with a tuning workflow that measures false-positive/false-negative rates against a labeled corpus.

**Objective** — Design and implement a transparent, tunable Layer-7 web application firewall that detects and blocks the OWASP Top 10 attack classes while minimizing false positives.

**Expected outcome** — A deployable WAF reverse proxy with a documented rule set, an anomaly-scoring detector, a tuning report with precision/recall metrics, and a bypass test harness.

**Difficulty** — Advanced — requires HTTP internals, request canonicalization, rule-engine design, and evasion-aware detection tuning.

**Primary category** — AppSec; Secondary = SOC, DevSecOps, Detection Engineering

**Security domains** — Primary = DevSecOps; Secondary = Blue Team, AppSec, Security Research, Cloud Security

**Technical focus** — Reverse proxying, HTTP request normalization, signature detection, positive-security modeling, anomaly scoring, rate limiting, TLS termination, ModSecurity/CRS rule syntax, false-positive tuning, structured logging

**Core technologies** — Languages: Go or Rust (proxy core), Python (tuning/analytics); Frameworks/Libraries: Envoy/NGINX Lua or Coraza (Go ModSecurity engine), FastAPI for management API; Security Tools: OWASP CRS, ModSecurity, ffuf/wfuzz for testing, Nikto; Cloud/Infra: Docker, Kubernetes, NLB/ingress; AI/Data: scikit-learn for anomaly scoring, pandas; Databases: Redis (rate-limit counters), Elasticsearch/OpenSearch (logs)

**Where it's valued** — SaaS, fintech, e-commerce, healthcare, any web-facing enterprise, managed security service providers

**Careers it builds toward** — Application Security Engineer, DevSecOps Engineer, Detection Engineer, Cloud Security Engineer, Security Software Engineer

**Framework alignment**
• MITRE ATT&CK: Exploit Public-Facing Application (T1190); mitigations align with detection of Command/SQL Injection payloads (defends against techniques under Initial Access and later web-shell delivery)
• NIST CSF 2.0: Protect (PR.PS, PR.IR), Detect (DE.CM), Respond (RS.AN)
• OWASP: A03 Injection, A01 Broken Access Control, A05 Security Misconfiguration; API Top 10 (API3 excessive data, API8 misconfiguration)
• CIS Controls v8: 13 Network Monitoring & Defense, 16 Application Software Security, 8 Audit Log Management