Mission Impossible like defence application project

Question

I have a Attack and Defence security project for school and I dont know how to protect it since all classic ways are forbidden by rules ,so

Assume the following project :

A web application with the following functionality:

1. account registration.

2. Database connection where all information is stored.

3. Presentation of this information according to input from user.

4. The web app will be pentested on LAN level

Rules:

1. No firewalls allowed.

2. No fail2ban like applications.

3. No WAF.

4. No xss library can be used.

5. No mitm to inject javascript to add defence layers. (The project will be pentested from within the network.)

6. No https

Any help is appreciated.

Answer 1

I‘m not sure, why you think you might need any of those things that are forbidden.

What you need is protection against the OWASP Top10, especially

• input validation,
• prepared statements to counter SQLi,
• output encoding,
• CSRF-Token,
• proper header settings.

All of those things can be learned from the owasp project.