CRSprober

CRSprober Description This tool remotely detects the version of the OWASP Core Rule Set CRS used by a ModSecurity WAF. It also identifies the configured paranoia level PL of the CRS, providing insights into the WAF's security posture without requiring local access. Prerequisities Python 3 Usage...

web-threat-mitigation

web-threat-mitigation OWASP ZAP, Burp Suite, ModSecurity WAFOWASP CRS 포함를 사용하여 웹 애플리케이션 위협을 탐지 및 완화하는 실습용 랩입니다. 사례 연구: Spring4Shell CVE-2022-22965. 로컬 Docker 기반 구성. Web Threat Mitigation Lab – OWASP ZAP, ModSecurity & CVE 익스플로잇 이 저장소는 일반적인 웹 애플리케이션 위협을 시뮬레이션, 분석 및 완화하는 실습을 문서화합니다. 취약한 타겟 설치, 스캐닝...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF Educational / defensive purpose : this lab contains a deliberately vulnerable app Log4j 2.14.1 and a JNDI exploit kit, ONLY for learning how to detect and block Log4Shell in an isolated environment. Do not deploy to the Internet, do not use to attack...

Drupal-Exploit-Lab

Drupal-Exploit-Lab WAF（Web Application Firewall）の有無による Drupal 7.57（CVE-2018-7600）の悪用デモンストレーション 説明 このプロジェクトは、Drupal 7.57 の悪用が 2 つの異なるシナリオでどのように行われるかを示しています。 1. 保護されていないサーバー → Metasploit による悪用に成功し、Meterpreter シェルを取得します。 2. 保護されたサーバー → 同じ脆弱なバージョンですが、保護（ModSecurity + OWASP CRS）が適用されています → 悪用は失敗します。...

owasp-modsecurity-crs

CRS se ha trasladado a un nuevo 🏠 ! El OWASP ModSecurity Core Rule Set CRS se ha trasladado a https://github.com/coreruleset/coreruleset. Una nota sobre este cambio: Este proyecto comenzó en Trustwave SpiderLabs hace más de diez años, fue creado con la idea de hacer un conjunto de reglas gratuito...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC Run: root@kitploit: cd springbootundertowstand or aspnetstand docker compose ...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC root@kitploit: POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0...

springwood-living.com Cross Site Scripting vulnerability OBB-3231673

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

FTW - Framework For Testing WAFs

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules...