• Stars
    star
    125
  • Rank 286,335 (Top 6 %)
  • Language
    Python
  • License
    Apache License 2.0
  • Created over 7 years ago
  • Updated 7 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Framework for Testing WAFs (FTW!)

Framework for Testing WAFs (FTW)

Build Status PyPI version

Purpose

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules. Users can verify the execution of the rule after the tests are issued to make sure the expected response is received from an attack

Goals / Use cases include:

  • Find regressions in WAF deployments by using continuous integration and issuing repeatable attacks to a WAF
  • Provide a testing framework for new rules into ModSecurity, if a rule is submitted it MUST have corresponding positive & negative tests
  • Evaluate WAFs against a common, agreeable baseline ruleset (OWASP)
  • Test and verify custom rules for WAFs that are not part of the core rule set

For our 1.0 release announcement, check out the OWASP CRS Blog

Installation

  • git clone https://github.com/coreruleset/ftw.git
  • cd ftw
  • virtualenv env && source ./env/bin/activate
  • pip install -r requirements.txt
  • py.test -s -v test/test_default.py --ruledir=test/yaml

Writing your first tests

The core of FTW is it's extensible yaml based tests. This section lists a few resources on how they are formatted, how to write them and how you can use them.

OWASP CRS wrote a great blog post describing how FTW tests are written and executed.

YAMLFormat.md is ground truth of all yaml fields that are currently understood by FTW.

After reading these two resources, you should be able to get started in writing tests. You will most likely be checking against status code responses, or web request responses using the log_contains directive. For integrating FTW to test regexes within your WAF logs, refer to ExtendingFTW.md

Provisioning Apache+Modsecurity+OWASP CRS

If you require an environment for testing WAF rules, there has been one created with Apache, Modsecurity and version 3.0.0 of the OWASP core ruleset. This can be deployed by:

  • Checking out the repository: git clone https://github.com/fastly/waf_testbed.git
  • Typing vagrant up

More Repositories

1

coreruleset

OWASP CRS (Official Repository)
Python
2,104
star
2

modsecurity-crs-docker

Official ModSecurity Docker + Core Rule Set (CRS) images
Shell
241
star
3

modsecurity-docker

The official ModSecurity Docker images
Dockerfile
136
star
4

go-ftw

Web Application Firewall Testing Framework - Go version
Go
116
star
5

plugin-registry

Registry for OWASP ModSecurity Core Rule Set plugins, official and 3rd party
19
star
6

secrules_parsing

A parser for the SecRules Langue
Python
19
star
7

nextcloud-rule-exclusions-plugin

Rule exclusion plugin for Nextcloud
10
star
8

machine-learning-integration-plugin

A CRS plugin to use machine learning together with the rule set.
Lua
8
star
9

wordpress-rule-exclusions-plugin

Rule exclusion plugin for WordPress.
8
star
10

crs-toolchain

Go
7
star
11

fake-bot-plugin

This is a plugin that brings blocking of bots faking User-Agent to CRS.
Lua
7
star
12

antivirus-plugin

This is a plugin that brings antivirus support to CRS.
Lua
6
star
13

regexp-assemble-syntax

A Visual Studio Code extension for working with RegExp-Assemble files
6
star
14

project-seaweed

Testing CVEs against CRS
Go
4
star
15

owasp-crs-documentation

Documentation for the OWASP CRS project
Python
3
star
16

documentation

CRS Documentation
JavaScript
3
star
17

coraza-crs-docker

Coraza, CRS and Caddy
Shell
2
star
18

google-oauth2-plugin

Plugin to suppress false positives with Google OAuth2 online authorization service callbacks.
2
star
19

modsecurity-ansible-role

An Ansible role which installs, and configures, ModSecurity v2 on Apache webserver.
2
star
20

auto-decoding-plugin

Automatic decoding of payload parameters in the form of a OWASP ModSecurity Core Rule Set plugin
2
star
21

dos-protection-plugin-modsecurity

Anti-automation rules plugin to detect denial of service attacks
2
star
22

rules-performance-tests

Repository for GSoC 2023 project framework for rules performance testing.
Python
1
star
23

phpmyadmin-rule-exclusions-plugin

Rule exclusion plugin for phpMyAdmin.
1
star
24

albedo

HTTP reflector and black hole
Go
1
star
25

drupal-rule-exclusions-plugin

Rule exclusion plugin for Drupal
1
star
26

phpbb-rule-exclusions-plugin

Rule exclusion plugin for phpBB.
1
star
27

seclang_parser

ANTLR based SecLang parser
ANTLR
1
star
28

crs-plugin-test-action

GitHub Action workflows to test plugins
1
star