waf-dojo is a self-hosted training game where security engineers learn to write AWS WAF rules by blocking simulated attacks against a dummy shop inside their own lab environment.
| Tool | nishikawaakira/waf-dojo — a hands-on AWS WAF training game with tutorials, scored labs, and exams built on Terraform-provisioned AWS infrastructure |
| Category | Security training / simulation platform (Go + Terraform + AWS serverless) |
| Primary Use | Practicing Web ACL rule authoring against simulated SQLi, XSS, Log4Shell, traversal, and bot traffic, with scoring that penalizes false positives on legitimate users |
| Safe Use | For authorized training in the player's own AWS account; all attack requests are harmless reproductions of attack shapes, with external destinations using reserved domains like attacker.example |
| Telemetry Note | Purely defensive: everything runs inside the player's Terraform-built account, trafficgen sends only to the player's own ALB, and the tool teaches defenders to read WAF logs, JA4 fingerprints, and CloudWatch Logs Insights |
waf-dojo is one of the more thoughtful training platforms to appear in the defensive tooling space recently: instead of teaching attack techniques, it teaches the decidedly unglamorous but high-value skill of writing correct AWS WAF rules under pressure. The premise is simple and well-executed — a dummy online shop (targetapp, a Lambda that returns 200 to every request) sits behind an ALB whose Web ACL you, the player, edit. A traffic generator (trafficgen) then fires a mix of attack requests and legitimate-user requests at your stack, and you are scored on two axes simultaneously: how many attacks you blocked, and how many regular users you blocked by mistake. That dual scoring is the whole pedagogical trick, because the hard part of WAF operations in production is never blocking the obvious exploit — it is not blocking the customer.
The architecture, documented directly in the README, is worth reading even if you never deploy the tool. Each player gets an isolated slice of infrastructure: a Lambda Function URL serving the game UI and API (gameapi), the trafficgen Lambda invoked asynchronously, the ALB fronting the dummy app, and a DynamoDB table tracking runs, best scores, and locks. Because an ALB can only carry one Web ACL, isolation is per-player rather than shared, which is the correct design choice for a multi-user training session. Everything is provisioned through Terraform, and the admin guide (docs/ADMIN.md) plus the player handout (docs/PLAYER_GUIDE.md) cover build, distribution, and teardown — both currently in Japanese, which is worth noting before you roll this out to an English-speaking team.
Two implementation details reveal genuine engineering care. First, since JA4 fingerprints are only computed over HTTPS, the ALB listens on 443 with a self-signed certificate imported into ACM so the whole thing works without owning a domain — with the honest caveat in the README that the private key ends up in the Terraform state. Second, trafficgen uses uTLS to craft distinct TLS ClientHellos mimicking Chrome, Firefox, Safari, and attack tools, which is what makes the JA4-based scenarios pedagogically real rather than theoretical. Source IPs are simulated with RFC 5737 documentation addresses in X-Forwarded-For, correctly assuming a CDN sits in front — exactly the logging topology you see in production, and exactly the one where naive IP-set rules go wrong.
The curriculum is structured as a progression: six tutorials with step-by-step instructions, six game-mode scenarios without hints, 41 vulnerability labs, two ops drills, and three exams. The tutorials cover managed rule groups, custom body-inspection rules with text transformations, IP sets, header matching, rate-based rules with aggregation keys, and exact JA4 matching. The game stages then force composition: catching a fake Googlebot with AND/NOT logic (UA claims Googlebot AND the IP is not Google's), protecting an admin panel with URI path conditions plus an IP allow list, and stacking double URL decoding for traversal without tripping false positives. Crucially, your tutorial rules persist into game mode, so stages 4 and 5 punish you for rules you wrote earlier — a deliberately realistic frustration that mirrors how legacy WAF rules haunt real operations teams.
The 41 vulnerability labs are the densest content, organized into four levels of increasing ambiguity. Level 1 gives you exact strings and inspection points for classics like Log4Shell, Spring4Shell, Shellshock, ProxyLogon, and the Confluence Velocity issue (CVE-2023-22527). Level 2 hands you prose advisories for things like PHP-CGI (CVE-2024-4577), FortiOS SSL-VPN, Struts 2 S2-045, and TeamCity (CVE-2024-27198) and asks you to choose the component, transformation, and match type yourself. Level 3 removes mitigation guidance entirely and asks you to derive the essence of the attack from the PoC shape — obfuscated Log4Shell, SSRF against metadata endpoints, SSTI, prototype pollution. Level 4 flips the problem: managed rules are blocking legitimate traffic (large uploads, IoT devices with no User-Agent, an internal webhook tool hitting RFI rules), and you must carve exceptions using per-rule Count overrides and label matching while keeping protection intact.
What makes this defensible and safe to recommend is the explicit harmlessness posture. Attack requests are reproductions of the shape of real attacks, not working exploits; every external destination uses reserved domains like attacker.example; and traffic only ever flows to the player's own ALB as configured by Terraform. This is a defensive simulator through and through — the skill it drills is translating vendor advisories into precise, false-positive-free Web ACL rules, which is a capability gap in many security teams that rely entirely on managed rule groups they never tune.
The quality-assurance story is unusually rigorous for a training project and deserves its own paragraph. The model answers for all 46 scored challenges are verified by go test ./..., using a local evaluator in internal/wafrule that reproduces AWS WAF's matching semantics — including checks that every common-pitfall rule really does fail. The model-answer JSON has been validated against the real CheckCapacity API, and every challenge was confirmed end-to-end on real AWS: attacks pass with no rules, and the model answer scores 100. There is even awareness of platform quirks, such as ALB rejecting paths that climb above the site root after one decode, with tests ensuring no challenge depends on that behavior. The README is candid that Level 4's managed-rule reproduction is inferred from AWS's published descriptions, with rule and label names confirmed via the DescribeManagedRuleGroup API — an honest limitation, clearly labeled.
WCU budgeting is also taught as a first-class constraint: the Core Rule Set alone consumes 700 WCU, lab model answers total roughly 1,000, and the default 1,500 WCU Web ACL ceiling looms over the whole exercise — the tool nudges you to delete rules for mastered challenges to stay under budget. The CloudFront track is a nice touch: each player gets a distribution with a CloudFront-scoped Web ACL (wafdojo-<name>-cf in us-east-1) to experience the 16 KB body inspection limit live and learn to extend it to 64 KB, versus the hard 8 KB wall on ALB. Disabling it is a simple enable_cloudfront = false.
For blue-team leads evaluating this for onboarding or tabletop exercises, the ops drills may be the highest-value component. They mirror real incident workflow: run an unscored recon with Count rules, study the WAF logs, then take the scored run. One drill has you identify the legitimate traffic causing false positives from logs alone; the other has you find a credential-stuffing bot's JA4 by aggregating /login requests in CloudWatch Logs Insights. These are precisely the log-analysis habits that separate a rule-copier from an operator, and they are the skills least often taught anywhere.
The gamification — martial-arts ranks from Trainee to Black Belt, a Master certification requiring 80+ on all 52 non-tutorial challenges, 14 achievements, and a mascot named Mamorin offering contextual tips — is lightweight enough not to annoy professionals while giving training cohorts a leaderboard to compete on. The exams deserve mention for their design: they send unseen variants (Log4Shell with nesting, double encoding, and JSON escapes; traversal across path, query, cookies, and JSON in both Linux and Windows styles), so copying lab model answers fails by construction. That transfer-of-learning test is the strongest evidence that the tool teaches rule reasoning rather than memorization. At 24 stars and a Go codebase with per-player Terraform isolation, waf-dojo is a niche but genuinely well-engineered asset for any team that owns AWS WAF rules in production.
nishikawaakira/waf-dojo.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.