Skip to content

Latest commit

 

History

4 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Web Application Firewall Home Lab (SafeLine WAF)

Overview

A complete cybersecurity home lab built using VirtualBox, Kali Linux, Ubuntu Server, DVWA, and SafeLine WAF. The lab demonstrates real-world web application attacks and how a WAF detects and blocks them.

Based on the guide by Royden Rebello (The Social Dork) Reference video: https://youtu.be/N0dEC1nuWCQ


Lab Architecture

Component Details
Kali Linux 192.168.1.3 (Attacker)
Ubuntu Server 192.168.1.5 (Target + WAF)
DVWA Port 8080 (Apache backend)
SafeLine WAF Port 9443 (Admin), 443 (HTTPS)
Domain dvwa.local

Tools Used

  • VirtualBox
  • Kali Linux
  • Ubuntu Server 22.04 LTS
  • DVWA (Damn Vulnerable Web Application)
  • SafeLine WAF (v9.3.6)
  • Apache2, PHP 8.5, MySQL 8.4
  • OpenSSL (self-signed certificate)
  • Docker (SafeLine runs on Docker)

What Was Set Up

  • Ubuntu Server with LAMP stack
  • DVWA installed and configured on port 8080
  • Self-signed SSL certificate
  • SafeLine WAF as HTTPS reverse proxy on port 443
  • Local DNS using /etc/hosts (dvwa.local)
  • Kali Linux SSH'd into Ubuntu for management

Attacks Demonstrated

With WAF Protection ON (blocked):

  • SQL Injection — Access Forbidden
  • XSS (Reflected) — Access Forbidden
  • Command Injection — Access Forbidden
  • File Upload (PHP shell) — Access Forbidden
  • File Inclusion (/etc/passwd) — Access Forbidden

With WAF Protection OFF (exploited):

  • SQL Injection — dumped all users from database
  • XSS — browser alert popup executed
  • Command Injection — ran whoami and cat /etc/passwd
  • File Upload — PHP web shell uploaded successfully
  • File Inclusion — /etc/passwd contents exposed

Key Problems Solved

  1. DVWA 500 error — MySQL user misconfigured + PHP allow_url_include was Off
  2. Browser bypassing WAF — fixed with Apache ServerName + UseCanonicalName directives
  3. Copy/paste between VMs — used SCP to transfer SSL certificate files
  4. Working in wrong directory — always run cd ~ first

Documentation

Full lab documentation with all steps, commands, problems and solutions is in: docs/SafeLine_WAF_Lab_Documentation.docx

Screenshots

All attack demonstrations with and without WAF protection are in the screenshots/ folder


Disclaimer

This lab is for educational purposes only. All testing was done in an isolated home lab environment. Never use these techniques on systems you don't own.

About

Home lab demonstrating web application attacks and WAF protection using SafeLine, DVWA, Kali Linux and Ubuntu

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors