Feature/lab11

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Goal
+
+<! What this PR delivers in one sentence. >
+
+## Changes
+
+<! List the files/artifacts added or modified. >
+
+- 
+
+## Testing
+
+<! Describe how you verified the work. Include commands and observed output. >
+
+- 
+
+## Artifacts & Screenshots
+
+<! Link to files in this PR or embed screenshots where useful. >
+
+- 
+
+## Checklist
+
+- [ ] Title is clear (`feat(labN): <topic>` style)
+- [ ] No secrets/large temp files committed
+- [ ] Submission file at `submissions/labN.md` exists

.github/workflows/lab1-smoke.yml

@@ -0,0 +1,45 @@
+name: Lab 1 Smoke Test
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  smoke-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run OWASP Juice Shop
+        run: |
+          docker run -d --name juice-shop \
+            -p 127.0.0.1:3000:3000 \
+            bkimminich/juice-shop:v20.0.0
+
+      - name: Wait for Juice Shop to become healthy
+        run: |
+          for i in $(seq 1 30); do
+            if curl --silent --fail http://127.0.0.1:3000/rest/admin/application-version; then
+              echo
+              echo "Juice Shop version endpoint is healthy"
+              exit 0
+            fi
+
+            echo "Waiting for Juice Shop... attempt $i/30"
+            sleep 2
+          done
+
+          echo "Juice Shop did not become healthy within 60 seconds"
+          docker logs juice-shop
+          exit 1
+
+      - name: Verify homepage returns HTTP 200
+        run: |
+          curl --silent --fail --show-error http://127.0.0.1:3000 > /dev/null
+          echo "Homepage returned HTTP 200"

.gitignore

@@ -20,7 +20,7 @@ labs/lab10/imports/import-*.json
 labs/lab11/logs/
 labs/lab11/reverse-proxy/certs/
 labs/lab12/results/
-
+labs/lab11/results/
 # Standard
 __pycache__/
 *.pyc

.pre-commit-config.yaml

@@ -0,0 +1,13 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.21.0
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: detect-private-key
+
+      - id: check-added-large-files
+        exclude: ^labs/lab4/(juice-shop\.cdx\.json|juice-shop\.spdx\.json|juice-shop-attestation\.json)$

labs/lab11/reverse-proxy/nginx.conf

@@ -31,7 +31,12 @@ http {
   limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
   limit_req_status 429;
 
-  map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+  # Concurrent connections per client address
+  limit_conn_zone $binary_remote_addr zone=perip:10m;
+  limit_conn_status 429;
+
+  # Empty Connection header for plain requests keeps the upstream keepalive pool usable
+  map $http_upgrade $connection_upgrade { default upgrade; '' ''; }
 
   # Common proxy settings
   proxy_set_header Host $host;
@@ -95,6 +100,9 @@ http {
     # "no cipher match" because -cipher is also TLS 1.2 only. Use -ciphersuites.
     ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256";
     ssl_prefer_server_ciphers on;
+    # TLS 1.3: AES-GCM suites only (CHACHA20 is refused)
+    ssl_conf_command Ciphersuites TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256;
+    ssl_session_tickets off;
     ssl_stapling off;
     # If using a publicly-trusted certificate, you may enable OCSP stapling:
     # ssl_stapling on;
@@ -109,6 +117,8 @@ http {
     keepalive_timeout 10s;
     send_timeout 10s;
 
+    limit_conn perip 20;
+
     # Security headers (include HSTS here only)
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
     add_header X-Frame-Options "DENY" always;

labs/lab11/waf/docker-compose.override.yml

@@ -0,0 +1,20 @@
+services:
+  waf:
+    image: owasp/modsecurity-crs:nginx@sha256:133267aa811e1a57a23b52ef04b3c30e802bcbe5454588f6d6af1f69f4b2b667
+    restart: unless-stopped
+    depends_on:
+      - juice
+    environment:
+      BACKEND: "http://juice:3000"
+      PORT: "8080"
+      MODSEC_RULE_ENGINE: "On"
+      BLOCKING_PARANOIA: "1"
+      ANOMALY_INBOUND: "5"
+      ANOMALY_OUTBOUND: "4"
+      MODSEC_AUDIT_LOG_FORMAT: "JSON"
+      MODSEC_AUDIT_LOG_TYPE: "Serial"
+      MODSEC_AUDIT_LOG: "/dev/stdout"
+      MODSEC_AUDIT_ENGINE: "RelevantOnly"
+      SERVER_TOKENS: "off"
+    ports:
+      - "127.0.0.1:8090:8080"