web-threat-mitigation

web-threat-mitigation OWASP ZAP, Burp Suite, ModSecurity WAFOWASP CRS 포함를 사용하여 웹 애플리케이션 위협을 탐지 및 완화하는 실습용 랩입니다. 사례 연구: Spring4Shell CVE-2022-22965. 로컬 Docker 기반 구성. Web Threat Mitigation Lab – OWASP ZAP, ModSecurity & CVE 익스플로잇 이 저장소는 일반적인 웹 애플리케이션 위협을 시뮬레이션, 분석 및 완화하는 실습을 문서화합니다. 취약한 타겟 설치, 스캐닝...

gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

owasp-modsecurity-crs

CRS가 새 🏠 로 이전했습니다! OWASP ModSecurity Core Rule SetCRS이 https://github.com/coreruleset/coreruleset 으로 이동했습니다. 이 변경에 대한 참고 사항: 이 프로젝트는 10여 년 전 Trustwave SpiderLabs에서 시작되었으며, 누구나 ModSecurity를 시작할 수 있는 무료 규칙을 제공하려는 목적으로 만들어졌습니다. 시간이 지나면서 더 이상 저희의 직접적인 지원이 필요하지 않은 커뮤니티 유지 프로젝트로 성장했습니다. 이는 그러한 프로젝트에 바랄...

CVE-2026-21876

CVE-2026-21876（OWASP CRS WAF 绕过） CVE-2026-21876 docker 容器 + 最小化 PoC。 我分别感谢 @airween 和 @fzipi 的快速响应！漏洞修复在很短的时间内就准备好了。 PoC POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0 Accept: / Origin: https://example.com Content-Length: 367 Content-Type: multipart/form-data;...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF 우회 CVE-2026-21876 도커 컨테이너 + 최소 PoC. @airween과 @fzipi님께 각각 빠른 응대에 감사드립니다! 취약점 수정이 매우 짧은 시간 안에 준비되었습니다. PoC 실행: cd springbootundertowstand or aspnetstand docker compose up --build python3 demo/send.py BASELINE - 403, BYPASS - 200 + reconstructed payload 참고 자료 Github 보안 ...

Certified Randomness with Optimal Rate

The generation of certified random bits is an emerging near-term application of quantum computers. Potential applications, such as randomness beacons and CRS generation, require nearly uniform randomness, whose rate the ratio of min-entropy to bitlength is 1. However, existing protocols for...

CRSprober

CRSprober 説明 このツールは、ModSecurity WAF が使用している OWASP Core Rule Set CRS のバージョンをリモートで検出します。また、CRS に設定されているパラノイアレベル PL も識別し、ローカルアクセスを必要とせずに WAF のセキュリティ態勢に関する洞察を提供します。 前提条件 Python 3 使い方 python crsprober.py http://example.com ライセンス Copyright c 2025 Jozef Sudolsky. All rights reserved. "THE BEER-WARE...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF 教育目的 / 防御目的 : このラボには意図的に脆弱性のあるアプリ Log4j 2.14.1 と JNDI エクスプロイトキットが含まれています。唯一 の目的は、隔離された環境で Log4Shell を検出・ブロックする方法を学ぶことです。インターネットにデプロイせず、あなたが所有していないシステムへの攻撃に使用しないでください。 Coraza WAF 動的モジュール + OWASP CRS v4 + カスタム JNDI ルールを統合した nginx を使用した Log4Shell...

Drupal-Exploit-Lab

Drupal-Exploit-Lab Drupal 7.57 CVE-2018-7600을 WAFWeb Application Firewall 유무에 따라 악용하는 방법 시연 설명 이 프로젝트는 두 가지 시나리오에서 Drupal 7.57 악용이 어떻게 진행되는지 보여줍니다: 1. 보호되지 않은 서버 → Metasploit을 통한 성공적인 악용 및 Meterpreter 셸 획득. 2. 보호된 서버 → 동일한 취약한 버전이지만 보호ModSecurity + OWASP CRS가 적용됨 → 악용 실패. 기술 및 도구 운영 체제: Ubuntu...

owasp-modsecurity-crs-4.29.0-1.1 on GA media (moderate)

owasp-modsecurity-crs-4.29.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11632-1 Rating: moderate Cross-References: CVE-2026-33691 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

SUSE CVE-2026-33691

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions .php, .phar, .jsp, .jspx by inserting whitespace...

OPENSUSE-SU-2026:11632-1 owasp-modsecurity-crs-4.29.0-1.1 on GA media

These are all security issues fixed in the owasp-modsecurity-crs-4.29.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-9752: NULL Pointer Dereference

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not...

CVE-2026-33691: Improper Handling of Case Sensitivity

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions .php, .phar, .jsp, .jspx by inserting whitespace...

Debian: Security Advisory (DLA-4488-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-4488-1 modsecurity-crs - security update

Bulletin has no description...

Amazon Linux 2023 : mod_security_crs (ALAS2023-2026-1399)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1399 advisory. The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when...

Debian: Security Advisory (DSA-6105-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSA-6105-1 modsecurity-crs - security update

Bulletin has no description...

CVE-2026-21876 OWASP CRS has multipart bypass using multiple content-type parts

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a...