plaintext 9 lines · 1 tab

ModSecurity WAF rules for common web attack patterns

Kai Nakamura Apr 2026

1 tab

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

SecRule ARGS|REQUEST_HEADERS|XML:/* "@detectSQLi" \
  "id:1001,phase:2,deny,status:403,log,msg:'Potential SQLi detected'"

SecRule ARGS|REQUEST_HEADERS|XML:/* "@detectXSS" \
  "id:1002,phase:2,deny,status:403,log,msg:'Potential XSS detected'"

1 file · plaintext Explain with highlit

A WAF is not a license to ignore secure coding, but it can still buy useful time and visibility. I tune rules for known attack classes and watch false positives aggressively during rollout. Managed poorly, a WAF becomes operational pain; managed well, it becomes a meaningful friction layer.

Related snips

ruby

# Vulnerable: user input is concatenated directly into SQL.
email = params[:email]
password = params[:password]

sql = "SELECT * FROM users WHERE email = '#{email}' AND password_hash = '#{password}'"
user = ActiveRecord::Base.connection.execute(sql).first

SQL injection prevention with unsafe and safe query patterns

sql-injection owasp database

by Kai Nakamura 3 tabs

typescript

import express from 'express';
import cookieParser from 'cookie-parser';
import { issueCsrfToken, csrfProtection } from './csrf';
import { transfersRouter } from './routes/transfers';

const app = express();

CSRF protection with double-submit cookie

security express csrf

by codesnips 3 tabs

erb

<h1><%= @post.title %></h1>
<p><%= @post.author_name %></p>

<%# Only sanitized rich text should be rendered as HTML %>
<div class="prose"><%= sanitize(@post.body_html, tags: %w[p a ul ol li strong em code], attributes: %w[href]) %></div>

Cross site scripting defense with output encoding and CSP

xss content-security-policy owasp

by Kai Nakamura 3 tabs

ruby

require 'ipaddr'
require 'resolv'

uri = URI.parse(params[:url])
allowed_hosts = %w[images.example-cdn.com api.partner.com]

SSRF mitigation with URL allowlists and egress controls

ssrf network-security secure-coding

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
sqlmap \
  -r login-request.txt \
  --risk=2 \
  --level=3 \
  --batch \

sqlmap workflow for approved injection testing

sqlmap pentesting sql-injection

by Kai Nakamura 1 tab

javascript

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;

Front-end security - XSS and CSRF prevention

security xss csrf

by Alex Chang 1 tab

Share this code

Here's the card — post it anywhere.

ModSecurity WAF rules for common web attack patterns — share card

Link copied