web-threat-mitigation

web-threat-mitigation Hands-on lab on detecting and mitigating web app threats using OWASP ZAP, Burp Suite, and ModSecurity WAF with OWASP CRS. Case study: Spring4Shell CVE-2022-22965. Local Docker-based setup. Web Threat Mitigation Lab – OWASP ZAP, ModSecurity & CVE Exploitation This repository...

CRSprober

CRSprober Description This tool remotely detects the version of the OWASP Core Rule Set CRS used by a ModSecurity WAF. It also identifies the configured paranoia level PL of the CRS, providing insights into the WAF's security posture without requiring local access. Prerequisities Python 3 Usage...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC Run: root@kitploit: cd springbootundertowstand or aspnetstand docker compose ...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC root@kitploit: POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF Educational / defensive purpose : this lab contains a deliberately vulnerable app Log4j 2.14.1 and a JNDI exploit kit, ONLY for learning how to detect and block Log4Shell in an isolated environment. Do not deploy to the Internet, do not use to attack...

Drupal-Exploit-Lab

Drupal-Exploit-Lab Demonstration on exploitation on Drupal 7.57 CVE-2018-7600 with and without WAFWeb Application Firewall Description The project shows how the exploitation of Drupal 7.57 looks like in two different scenarios: 1. Unprotected server → successful exploitation with Metasploit and...

owasp-modsecurity-crs

CRS se ha trasladado a un nuevo 🏠 ! El OWASP ModSecurity Core Rule Set CRS se ha trasladado a https://github.com/coreruleset/coreruleset. Una nota sobre este cambio: Este proyecto comenzó en Trustwave SpiderLabs hace más de diez años, fue creado con la idea de hacer un conjunto de reglas gratuito...

springwood-living.com Cross Site Scripting vulnerability OBB-3231673

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

FTW - Framework For Testing WAFs

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules...