Feature/lab11

[Lisoon22]

Lab 11

cd ~/DevSecOps-Intro
git switch main
git pull
git switch -c feature/lab11

unzip -o ~/Downloads/lab11_submit_bundle_v1.zip -d .

mkdir -p scripts labs/lab11/reverse-proxy labs/lab11/waf
cp -a lab11_submit_bundle/scripts/. scripts/
cp -a lab11_submit_bundle/labs/lab11/reverse-proxy/. labs/lab11/reverse-proxy/
cp -a lab11_submit_bundle/labs/lab11/waf/. labs/lab11/waf/
cp lab11_submit_bundle/LAB11_PR_DESCRIPTION.md .
chmod +x scripts/lab11_*

./scripts/lab11_install_arch.sh
sudo systemctl start docker
./scripts/lab11_run_all.sh

Commit:

git add labs/lab11/reverse-proxy/nginx.conf
git add labs/lab11/waf/docker-compose.override.yml
git add submissions/lab11.md

PRE_COMMIT_ALLOW_NO_CONFIG=1
git commit -S -m "feat(lab11): hardened nginx + OWASP CRS WAF"

git push -u origin feature/lab11
[lisoon@archlisoon lab11_submit_bundle]$ ls
LAB11_PR_DESCRIPTION.md labs README_SUBMIT.md scripts
[lisoon@archlisoon lab11_submit_bundle]$ cat LAB11_PR_DESCRIPTION.md

Goal

Complete bonus Lab 11 by deploying a TLS 1.3-only Nginx reverse proxy in front
of Juice Shop, adding production traffic controls, and placing OWASP CRS v4 in
blocking mode.

Changes

• Hardened labs/lab11/reverse-proxy/nginx.conf.
• Added HTTP-to-HTTPS redirect and TLS 1.3-only negotiation.
• Added all six required response headers with always.
• Added login throttling, connection limiting, and fail-closed timeouts.
• Added TLS 1.3 AEAD suite configuration, X25519, session caching, and disabled tickets.
• Added labs/lab11/waf/docker-compose.override.yml.
• Deployed official ModSecurity v3 + OWASP CRS 4.25 LTS at paranoia level 1.
• Captured HTTP 403 and audit-rule evidence for a SQL-injection probe.
• Added submissions/lab11.md.
• Excluded generated certificates, private keys, logs, and results.

Testing

./scripts/lab11_install_arch.sh
sudo systemctl start docker
./scripts/lab11_run_all.sh

Verified:

• HTTP 301/308 redirect;
• TLS 1.3;
• six security headers;
• HTTP 429 under concurrent login load;
• slow/incomplete-header timeout;
• TLS 1.3 cipher and X25519;
• the same SQLi request without and with WAF;
• OWASP CRS audit evidence.

Checklist

• Task 1 — TLS 1.3 and six headers
• Task 2 — rate/connection limits and timeouts
• Task 2 — cipher hardening and certificate runbook
• Task 2 — accurate OCSP explanation
• Bonus — CRS v4 WAF in blocking mode
• Bonus — SQLi probe returns HTTP 403
• Bonus — matching audit rule captured
• No key material or generated logs committed
• Signed commit