Free WAF rule lab: Write ModSecurity rules that block every attack and no customer.

A web application firewall lab in your browser using ModSecurity's rule language (SecLang). Tune a demo bank's WAF rules against recorded traffic: real customers whose input trips naive rules (a payee called O'Brien, a search for "select savings plan") and attacks in the forms WAFs must handle (SQL injection, XSS that is encoded, double encoded or in capitals, path traversal, command injection, Log4Shell, Shellshock, SSRF, scanners and probes). A live scoreboard shows attacks blocked, attacks missed and customers wrongly blocked; every request has an audit trace of which rule matched which variable, before and after transformations. Supports operators, transformations, chains, anomaly scoring, exclusions and DetectionOnly mode, plus a request tester.

Free, no login, nothing to install. Your work stays in this browser.

What you can do

• Write SecRule rules with operators, transformations and chains
• See why each request was blocked or let through, variable by variable
• Tune false positives with exclusions instead of weaker rules
• Use anomaly scoring and DetectionOnly the way production WAFs do

Graded, AI-assisted versions live in web application security and secure coding courses.