Exploit for bastion-waf-simulator

## https://sploitus.com/exploit?id=F55BD786-99F0-52B3-9E66-7C016A9BF095
# BASTION — Web Application Firewall Simulator

> A real-time Web Application Firewall (WAF) simulator that detects and blocks OWASP Top 10 attack patterns — SQL injection, XSS, path traversal, command injection, XXE, SSRF, LDAP injection, and more.

---

## 🔍 The Problem

Web applications are the most targeted attack surface in modern cybersecurity. The OWASP Top 10 represents the most critical security risks — and most breaches still exploit these same well-known vulnerabilities. BASTION demonstrates how a WAF detects and blocks these attacks in real time, and teaches developers what to do about them.

---

## 💡 What It Does

BASTION is a Flask web application that simulates a Web Application Firewall. Submit any HTTP request (GET, POST, PUT, DELETE) with any payload, and BASTION's rule engine runs it through 8 WAF rule sets covering the OWASP Top 10. Results show the attack type, OWASP classification, severity, and concrete mitigation steps.

### Detection Coverage

| Rule ID | Attack Type | OWASP Category | Severity |
|---------|------------|----------------|---------|
| SQLI-001 | SQL Injection | A03:2021 — Injection | CRITICAL |
| XSS-001 | Cross-Site Scripting | A03:2021 — Injection | HIGH |
| PT-001 | Path Traversal | A01:2021 — Broken Access Control | HIGH |
| CMDI-001 | Command Injection | A03:2021 — Injection | CRITICAL |
| XXE-001 | XML External Entity | A05:2021 — Security Misconfiguration | HIGH |
| SSRF-001 | Server-Side Request Forgery | A10:2021 — SSRF | HIGH |
| LDAP-001 | LDAP Injection | A03:2021 — Injection | HIGH |
| OPEN-REDIRECT-001 | Open Redirect | A01:2021 — Broken Access Control | MEDIUM |

---

## 🧪 Real Test Results

**SQL Injection — `' OR 1=1--` on `POST /login`**
- Detected: SQL Injection — CRITICAL
- OWASP: A03:2021 — Injection
- Action: REQUEST BLOCKED
- Mitigation: Use parameterised queries / prepared statements

**Normal Login — `username=alice&password=SecurePass123`**
- Detected: No threats
- Action: REQUEST ALLOWED ✅

**Block Rate across 11 test requests: 82% (9 blocked, 2 allowed)**

---

## 🛠️ Tech Stack

| Layer | Technology |
|-------|-----------|
| Backend | Python 3, Flask |
| WAF Engine | Custom regex rule engine (8 rule sets, 40+ patterns) |
| Attack DB | OWASP Top 10 aligned rule library |
| Frontend | HTML5, CSS3, Vanilla JavaScript |
| Fonts | Google Fonts (Orbitron, Share Tech Mono) |

---

## 🚀 How to Run

**Requirements:** Python 3.8+

```bash
# 1. Install Flask
pip3 install flask

# 2. Navigate to project folder
cd bastion-waf-simulator

# 3. Launch BASTION
python3 app.py

# 4. Open browser at:
# http://127.0.0.1:5005
```

Select any pre-built attack example, or type your own payload and hit **ANALYZE REQUEST**.

---

## 📁 Project Structure

```
bastion-waf-simulator/
└── app.py    # WAF rule engine + Flask routes + full UI
```

---

## 🎯 What I Learned

Building BASTION required me to understand how each OWASP Top 10 attack actually works at a technical level — not just the name, but the exact patterns attackers use and why they're dangerous.

Key insights:

- **SQL Injection** is still #1 despite being documented since the 1990s — because developers keep concatenating user input into queries
- **SSRF** was behind the 2019 Capital One breach (100 million records) — exploiting the AWS metadata endpoint at `169.254.169.254`
- **XXE** affects document upload features — attackers hide malicious XML in DOCX, SVG, and PDF files
- **Path Traversal** is often overlooked in file download features — `../../../../etc/passwd` is one of the most successful attack strings ever

The key insight: **WAFs are not a complete solution — they're one layer. The fix for every attack in BASTION is better application code, not just better filtering.**

---

## 🔮 Future Improvements

- ModSecurity rule format support (CRS — Core Rule Set compatibility)
- Evasion technique detection (URL encoding, hex encoding, case variation)
- Rate limiting simulation
- Custom rule builder UI
- Export blocked requests as a penetration testing report

---

## 🔗 Related Projects

- [SENTINEL — Email Threat Analyzer](https://github.com/messi0087an-hub/sentinel-email-analyzer)
- [SHIELD — URL Threat Detector](https://github.com/messi0087an-hub/shield-url-detector)
- [VULCAN — Vulnerability Scanner](https://github.com/messi0087an-hub/vulcan-vuln-scanner)
- [ARGUS — Network Anomaly Detector](https://github.com/messi0087an-hub/argus-anomaly-detector)
- [VAULT — Encrypted File Transfer](https://github.com/messi0087an-hub/vault-secure-transfer)
- [NEXUS — Incident Response Simulator](https://github.com/messi0087an-hub/nexus-ir-simulator)

---

*Built as part of a cybersecurity portfolio for Ngee Ann Polytechnic — Diploma in Cybersecurity & Digital Forensics (EAE 2026)*