CodeSnips

plaintext

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

SecRule ARGS|REQUEST_HEADERS|XML:/* "@detectSQLi" \
  "id:1001,phase:2,deny,status:403,log,msg:'Potential SQLi detected'"

ModSecurity WAF rules for common web attack patterns

waf modsecurity web-security

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
sqlmap \
  -r login-request.txt \
  --risk=2 \
  --level=3 \
  --batch \

sqlmap workflow for approved injection testing

sqlmap pentesting sql-injection

by Kai Nakamura 1 tab

javascript

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;

Front-end security - XSS and CSRF prevention

security xss csrf

by Alex Chang 1 tab

bash

#!/usr/bin/env bash
docker run --rm -t owasp/zap2docker-stable zap-baseline.py \
  -t https://preview.example.com \
  -r zap-report.html \
  -I

Web application DAST automation with OWASP ZAP baseline scans

dast zap ci

by Kai Nakamura 1 tab