Kali Linux

OWASP Coraza WAF : A Golang Modsecurity Compatible Web Application Firewall Library

OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.

Prerequisites

  • Linux distribution (Debian and Centos are recommended, Windows is not supported yet)
  • Golang compiler v1.16+

Migrate from v1

  • Rollback SecAuditLog to the legacy syntax (serial/concurrent)
  • Attach an error log handler using waf.SetErrorLogCb(cb) (optional)
  • the function Transaction.Clean() must be used to clear transaction data, files and take them back to the sync pool.
  • If you are using low level APIs check the complete changelog as most of them were removed.
  • OWASP CRS does not require any external dependency anymore

Running the tests

Run the go tests:

go test ./…
go test -race ./…

Using pre-commit

pip install pre-commit
pre-commit run –all-files

ou can also install the pre-commit git hook by running

pre-commit install

Coraza v2 differences with v1

  • Full internal API refactor, public API has not changed
  • Full audit engine refactor with plugins support
  • New enhanced plugins interface for transformations, actions, body processors, and operators
  • We are fully compliant with Seclang from modsecurity v2
  • Many features removed and transformed into plugins: XML (Mostly), GeoIP and PCRE regex
  • Better debug logging
  • New error logging (like modsecurity)
  • Better performance

Your first Coraza WAF project

package main
import(
“fmt”
“github.com/corazawaf/coraza/v2”
“github.com/corazawaf/coraza/v2/seclang”
)
func main() {
// First we initialize our waf and our seclang parser
waf := coraza.NewWaf()
parser, _ := seclang.NewParser(waf)
// Now we parse our rules
if err := parser.FromString(SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"); err != nil {
fmt.Println(err)
}
// Then we create a transaction and assign some variables
tx := waf.NewTransaction()
defer func(){
tx.ProcessLogging()
tx.Clean()
}()
tx.ProcessConnection(“127.0.0.1”, 8080, “127.0.0.1”, 12345)
// Finally we process the request headers phase, which may return an interruption
if it := tx.ProcessRequestHeaders(); it != nil {
fmt.Printf(“Transaction was interrupted with status %d\n”, it.Status)
}
}

R K

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

2 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

2 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

2 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 weeks ago