Open Source Web Application Firewall on OWASP Coraza

Directives

Tue, 06 Oct 2020 08:48:57 +0000

Include

Description: Include and evaluate a file or file pattern.

Syntax: Include [PATH_TO_CONF_FILES]

Include loads a file or a list of files from the filesystem using golang Glob syntax.

Syntax

Tue, 06 Oct 2020 08:48:57 +0000

The original language for configuring the ModSecurity Apache module was a set of extension directives to the Apache config language. This extension allows you to generate your Security Policy where you take an access control decision based on a set of parameters. Directives can be used to configure the engine itself, but also to send directives to the engine for access control. Directives look like the examples below:

Actions

Tue, 06 Oct 2020 08:48:57 +0000

Package actions implements SecLang rule actions for processing and control flow.

Overview

Actions define how the system handles HTTP requests when rule conditions match. Actions are defined as part of a SecRule or as parameters for SecAction or SecDefaultAction. A rule can have no or several actions which need to be separated by a comma.

Execution flow

Tue, 06 Oct 2020 08:48:57 +0000

Phases

Phases are an abstract concept designed to fit most web servers execution flows and give it more opportunities to stop a request.

Introduction

Tue, 06 Oct 2020 08:48:57 +0000

Coraza - Web Application Firewall

Coraza is an open source, enterprise-grade, high performance Web Application Firewall (WAF) ready to protect your beloved applications. It written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.

Operators

Tue, 06 Oct 2020 08:48:57 +0000

beginsWith

Description: Matches if the parameter string appears at the beginning of the input. Supports macro expansion for dynamic string matching.

Transformations

Tue, 06 Oct 2020 08:48:57 +0000

In the following example, the request parameter values are converted to lowercase before matching:

SecRule ARGS "xp_cmdshell" "t:lowercase,id:91"

Multiple transformation actions can be used in the same rule, forming a transformation pipeline. The transformations will be performed in the order in which they appear in the rule.

Variables

Tue, 06 Oct 2020 08:48:57 +0000

ARGS

Collection of all request arguments, including both query string and request body parameters. To inspect only query string or body arguments, see ARGS_GET and ARGS_POST.

Quick Start

Mon, 16 Nov 2020 13:59:39 +0100

If you are not looking to use Coraza WAF as a library and you want a working WAF implementation or integration, check out the Connectors page for available integrations.

OWASP Core Ruleset

Tue, 13 Oct 2020 15:21:01 +0200

Using coraza-coreruleset (Recommended)

The easiest way to use CRS with Coraza is via the coraza-coreruleset Go package, which embeds the Core Rule Set and the recommended Coraza configuration so you don’t need to manage files manually.