cybersecurityFeaturedTeam Project
February 2025Web Attack & Defense Lab
// Web App Developer & Security Analyst
Built a deliberately vulnerable real-estate web application as part of a team-based attack simulation, then worked on hardening the environment against common web attacks.
Inbound request → security controls → application
Attacker
INBOUND REQUEST↓
ACTIVE
NETWORK PERIMETER
pfSense
Network firewall that controls traffic flow and enforces network-level access policies.
INSPECT / ENFORCE↓
ACTIVE
NETWORK INSPECTION
Suricata IDS/IPS
Network-level intrusion detection and prevention that inspects traffic for known attack signatures.
INSPECT / ENFORCE↓
ACTIVE
HTTP INSPECTION / WAF
ModSecurity
Web application firewall with OWASP Core Rule Set that blocks SQLi, XSS, and malicious payloads at the HTTP layer.
INSPECT / ENFORCE↓
PROTECTED WORKLOAD
Real Estate Web App
Flask · MySQL · HTML/CSS/JS
Each control is positioned before the application: traffic is filtered, inspected, and then allowed to reach the workload.
// Vulnerabilities
Part of HCIA-Security training, NTI, February 2025
