This project demonstrates the deployment of SafeLine Web Application Firewall (WAF) to protect the Damn Vulnerable Web Application (DVWA) from common web attacks.

The lab simulates a real-world deployment where SafeLine operates as a reverse proxy, inspecting all incoming HTTPS requests before forwarding legitimate traffic to the backend Apache web server.

The project demonstrates how a WAF can identify, block, and log malicious web traffic while allowing legitimate users to access the protected application.

The entire environment was deployed inside VMware using Ubuntu and Kali Linux virtual machines connected through a bridged network.

• Project Overview
• Objectives
• Features
• Technologies Used
• Lab Architecture
• Repository Structure
• Installation Summary
• Security Testing
• Attack Monitoring
• Screenshots
• Skills Demonstrated
• Learning Outcomes
• Future Improvements
• Project Note

This project was developed to:

• Deploy SafeLine Web Application Firewall
• Deploy Damn Vulnerable Web Application (DVWA)
• Configure Reverse Proxy Architecture
• Configure HTTPS using SSL certificates
• Protect DVWA using SafeLine
• Demonstrate common web attacks
• Configure multiple WAF security features
• Monitor and analyze attack logs

✅ Reverse Proxy Deployment

✅ HTTPS Termination

✅ Apache Backend Configuration

✅ SQL Injection Protection

✅ Cross-Site Scripting (XSS) Protection

✅ HTTP Flood Defense

✅ Authentication Gateway

✅ Custom URL Blocking

✅ Custom Request Header Blocking

✅ Attack Logging

✅ Security Monitoring

The lab consists of two virtual machines connected using VMware Bridged Networking.

The Ubuntu virtual machine hosts:

• SafeLine WAF
• Apache Web Server
• PHP
• MariaDB
• DVWA

Apache serves DVWA on port 8080, while SafeLine exposes the application securely over HTTPS (port 443).

The Kali Linux virtual machine acts as the testing workstation.

Tools used:

• Firefox
• curl
• ApacheBench (ab)

The machine is used to generate both normal and malicious traffic for validating the WAF configuration.

SafeLine-DVWA-WAF-Lab
│
├── README.md
├── CHANGELOG.md
│
├── docs
│   ├── Installation.md
│   ├── Testing.md
│   ├── Commands.md
│   ├── Troubleshooting.md
│   └── Architecture.md
│
├── images
│
├── scripts
│
└── apache

The deployment consists of the following stages.

1. Ubuntu Installation

2. Apache, PHP and MariaDB Installation

3. DVWA Deployment

4. SafeLine WAF Installation

5. Reverse Proxy Configuration

6. HTTPS Configuration

7. Local Hostname Configuration

8. DVWA Database Initialization

9. Security Feature Configuration

10. Security Testing

The deployed lab was validated by performing multiple web application security tests against DVWA through SafeLine WAF.

The objective was to verify that SafeLine could inspect incoming requests, detect malicious payloads, enforce configured security policies, and generate security events.

The following security features were successfully tested.

Detailed testing procedures are available in docs/Testing.md.

The following screenshots demonstrate the successful deployment and testing of the SafeLine WAF lab.

The SafeLine dashboard provides an overview of requests, protected applications, blocked attacks, and system status.

SafeLine was configured as a reverse proxy that forwards legitimate HTTPS requests to the Apache backend running DVWA.

DVWA was successfully deployed and accessed securely through SafeLine using HTTPS.

The SQL Injection payload was intercepted and blocked before reaching the vulnerable application.

Example Payload

1' OR '1'='1

SafeLine detected and blocked malicious JavaScript before it could be executed by the browser.

Example Payload

<script>alert('XSS')</script>

HTTP Flood protection was validated by generating multiple concurrent requests using ApacheBench.

SafeLine successfully detected excessive requests and applied rate limiting.

Authentication Gateway was configured to require user authentication before allowing access to the protected application.

Custom access control rules were created to block specific requests.

The lab demonstrates:

• URL path blocking
• Request header filtering

SafeLine records every detected attack, allowing administrators to review security events and investigate malicious activity.

Logged information includes:

• Timestamp
• Source IP
• Destination URL
• Attack Type
• Triggered Rule
• Action Taken

SafeLine provides centralized visibility into web application attacks.

During testing, the dashboard successfully detected and logged:

• SQL Injection attempts
• Cross-Site Scripting attacks
• HTTP Flood activity
• Custom Deny Rule violations

The monitoring dashboard enables administrators to identify attack trends, investigate malicious requests, and verify that security policies are operating correctly.

The following security mechanisms were configured as part of this project.

Additional documentation is available in the docs directory.

This project provided hands-on experience with the following cybersecurity concepts and technologies.

• Web Application Firewall (WAF) Deployment
• Reverse Proxy Configuration
• HTTPS Configuration
• SSL Certificate Management
• HTTP Request Inspection
• Access Control
• Security Policy Enforcement

• SQL Injection Detection
• Cross-Site Scripting (XSS) Detection
• HTTP Flood Mitigation
• Request Header Inspection
• URL Filtering
• Attack Logging

• Ubuntu Server Administration
• Apache Web Server Configuration
• PHP Configuration
• MariaDB Administration
• Docker Container Management
• Virtual Machine Networking

• DVWA Deployment
• Web Application Security Testing
• HTTP Request Analysis
• Attack Validation
• Security Event Monitoring

Through this project, I gained practical experience in:

• Deploying a Web Application Firewall in front of a web application.
• Configuring a reverse proxy to securely expose backend services.
• Deploying and configuring DVWA for web application security testing.
• Configuring HTTPS using SSL certificates.
• Understanding how SafeLine inspects HTTP requests before forwarding them to backend services.
• Configuring multiple WAF protection mechanisms.
• Creating custom access control rules.
• Monitoring attack events using the SafeLine dashboard.
• Troubleshooting deployment and networking issues.
• Documenting and validating a complete cybersecurity lab.

Potential enhancements for this project include:

• Deploying multiple protected web applications behind a single WAF.
• Integrating a SIEM platform for centralized log analysis.
• Configuring external authentication providers such as LDAP or OAuth.
• Creating additional custom WAF rules.
• Automating security testing using scripting tools.
• Evaluating protection against additional OWASP Top 10 attack categories.

Additional documentation is available in the docs directory.

This repository documents my hands-on implementation, configuration, testing, and troubleshooting of a SafeLine Web Application Firewall protecting DVWA in a virtual lab environment.

The project demonstrates practical experience in deploying, configuring, and validating multiple web application security features in a controlled environment.

Project updates are maintained in:

CHANGELOG.md

• SafeLine Official Documentation
  https://docs.waf.chaitin.com/

• SafeLine GitHub Repository
  https://github.com/chaitin/SafeLine

• DVWA GitHub Repository
  https://github.com/digininja/DVWA

• OWASP Top 10
  https://owasp.org/www-project-top-ten/

This repository was created as a personal cybersecurity learning project.

If you have suggestions for improving the documentation or the lab setup, feel free to open an issue or submit a pull request.

This project demonstrates the deployment and configuration of a Web Application Firewall (WAF) using SafeLine to protect a vulnerable web application.

The completed lab successfully implements:

• Reverse Proxy
• HTTPS Termination
• SQL Injection Protection
• Cross-Site Scripting (XSS) Protection
• HTTP Flood Defense
• Authentication Gateway
• Custom Deny Rules
• Attack Logging and Monitoring

This repository serves as a practical demonstration of web application security concepts and provides a reproducible lab environment for learning and experimentation.

For complete deployment instructions, refer to:

📄 docs/Installation.md