Naxsi, A Web Application Firewall for NGINX
summary
Naxsi is a ruleset‑light WAF for NGINX that scores small tokens (quotes, brackets, dashes) instead of huge regex signatures, integrates libinjection for SQL/XSS detection, and uses Elasticsearch + Kibana for logging and visualization. A Python tool generates whitelists from logs and drives a learning vs blocking cycle. Project starts 2011, core is <4000 lines of C; deployed on thousands of sites and scaled through peaks of terabytes of traffic.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:35Why naxsi
- 6:18Workflow
- 7:47Strengths & Weaknesses
- 10:03What does it actually looks like
- 12:05Learning process
- 14:57More into learning
- 23:21More into reporting visualisation
- 27:57Tweaks around leaming
- 32:24Feedback from real life
- 33:23Achievements
related talks
39mHow to Reconcile Security and Agility for the Good of Your Applications
14mWeb Application Firewalls: A False Sense of Security?
27mNAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications
37mWeb Application Firewall Bypassing
40mWeb Application Firewalls: Analysis of Detection Logic
34mOWASP Nettacker
35mAutoSpear: Towards Automatically Bypassing and Inspecting Web Application Firewalls
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection