I am a newbie in this field, and want to study more about Web Application Firewall. Could anyone tell me any materials or tutorials that I can refer in order to write (build) a Web Application Firewall from scratch?

I am planning to build a WAF which can prevent already-known maliciousnesses such as: SQL injection, XSS ATTACK, ect... at the same time, can study normal users over a period of time, and later prevent anomolies base on the learned data.

closed as too broad by John Deters, techraf, André Borie, Steffen Ullrich, Rory Alsop Oct 3 '16 at 7:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Have you looked at any of the existing products, to see what they do, and how they work? Look at open source projects, as they're more accessible than commercial products. – John Deters Oct 3 '16 at 1:43
  • why re-invent the wheel? why not support or upgrade previously developed very stable and powerful wafs? like mod-security, Lua resty? – Hamza Islam Oct 3 '16 at 2:28
  • This is just as broad as asking how to build a web application. – Arminius Oct 3 '16 at 2:49
  • So sorry for a broad question, I tried to edit it to make it narrower. – 匿名柴棍 Oct 3 '16 at 17:18

It's depends on your purpose of the firewall, honestly, some web application firewalls mostly offer a different solution each other.

From my own experience, I created a so called web application firewall by utilizing nginx reverse proxy to receive request first on a server, then filter them to my backend server where the real stuff located.

Nginx has a great documentation about it, you can start from it.

Then you can add your own features from your reverse proxy server. You can add a bunch of iptables rules if you prefer it, especially to provide a basic DDoS protection.

You can add mod_security also for a more advanced protection features. This guide can help you to explore it, and also some OWASP rules because (maybe) it's a common standard for people who build their firewall using mod_security.

Again, your web application firewall's feature is your own choice. It's a large field to explore, start from "hardened reverse proxy server" (cool name, eh?), you can continue to another type such as DNS based firewall, or something similar.

  • Thank you so much for your prompt and detailed answer. I really appreciate it. Your answer definitely helps me alot. – 匿名柴棍 Oct 3 '16 at 17:19

Well depends on what are you looking for and what is your scope.
As a wannabe, you can try already existing ones as:

OWASP ModSecurity Core Rule Set (CRS) or

or whatever you like.


Here you can find some suggestions.

  • Welcome to Security SE. When sourcing an external URL, please cite the relevant parts in your answer. Also, newbie != wannabe... – Jedi Oct 3 '16 at 5:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.