Feature/lab11

[sedimentt]

Goal

Put a hardened Nginx reverse proxy in front of Juice Shop with TLS, security headers and availability controls, prove each control with a command, and add a ModSecurity + OWASP CRS WAF that blocks SQL injection the plain proxy forwards.

Changes

• `labs/lab11/revers
  • per-client-address connection limit (limit_conn perip 20, answers 429)
  • TLS 1.3 limited to AES-GCM (ssl_conf_command Ciphersuites) - `ssl_session_tic
  • Connection header fix so the upstream keepalive pool actually works
• labs/lab11/waf/docker-compose.override.yml — WAF owasp/modsecurity-c by digest), blocking mode, port 127.0.0.1:8090`
• `submissions/lab11k 2 and the Bonus

Testing

• curl -sI http://ldirect; path andquery string preserved
• openssl s_client S_256_GCM_SHA384
• testssl.sh: TLS 1.0 and 1.1 not offered; only 1.2 and 1.3 - All six security h429 responses
• 14 logins in a row → 401 ×6, then 429 ×8 (10 r/m, burst=5); other paths not limi
• 25 parallel connections from one address → 5 get 429 immediately (`limiting connectio
• Timeouts firing:
  • slow request bodnt_body_timeout`)
  • docker compose pause juice → 504 after 30.03 s
    (`proxy_read_timeout
• -ciphersuites TLS_CHACHA20_POLY1305_SHA256 → alert handshake failure (alert 40)
• Certificate rotation run against the live proxy (nginx -t + nginx -s reload): 1736 re200`; fingerprintconfirmed changed
• WAF, same SQLi `?q
  • plain proxy → 500 (SQLITE_ERROR)
  • WAF → 403, rul
• False-positive check found two real cases:
  • 911100 blocks t quantity)
  • 942190 fires on ordinary text containing "union select"

Artifacts & Screenshots

• Report: submissions/lab11.md
• Proxy config: labonf
• WAF override: labs/lab11/waf/docker-compose.override.yml
• Certificates (lab), logs(labs/lab11/logs/) and check outputs (labs/lab11/results/`) are not
  committed

Checklist

• Title is clearrse proxy + WAF`)
• No secrets/large temp files committed
• Submission filxists