Published on January 28th, 2019 📆 | 6203 Views ⚑0
FTW – Framework For Testing WAFs
- Find regressions in WAF deployments by using continuous integration and issuing repeatable attacks to a WAF
- Provide a testing framework for new rules into ModSecurity, if a rule is submitted it MUST have corresponding positive & negative tests
- Evaluate WAFs against a common, agreeable baseline ruleset (OWASP)
- Test and verify custom rules for WAFs that are not part of the core rule set
git clone https://github.com/CRS-support/ftw.git
virtualenv env && source ./env/bin/activate
pip install -r requirements.txt
py.test -s -v test/test_default.py --ruledir=test/yaml
Writing your first tests
The core of FTW is it’s extensible
yamlbased tests. This section lists a few resources on how they are formatted, how to write them and how you can use them.
OWASP CRS wrote a great blog post describing how FTW tests are written and executed.
YAMLFormat.md is ground truth of all
yamlfields that are currently understood by FTW.
After reading these two resources, you should be able to get started in writing tests. You will most likely be checking against status code responses, or web request responses using the
log_containsdirective. For integrating FTW to test regexes within your WAF logs, refer to ExtendingFTW.md
Provisioning Apache+Modsecurity+OWASP CRS
If you require an environment for testing WAF rules, there has been one created with Apache, Modsecurity and version 3.0.0 of the OWASP core ruleset. This can be deployed by:
- Checking out the repository:
git clone https://github.com/fastly/waf_testbed.git