🛡️ Secure Web Application Development & Hardening Lab

1️⃣ Introduction

Securing web applications requires both secure coding practices and proper server hardening. In this lab, you’ll implement security best practices to protect against common attacks such as SQL Injection, XSS, authentication bypass, and insecure configurations.

📌 What You Will Learn

✅ Secure coding to prevent SQL Injection, XSS, CSRF, and IDOR ✅ Implementing strong authentication & session security ✅ Web server hardening & security configurations ✅ Using a Web Application Firewall (WAF) for protection ✅ Best practices for secure deployment & monitoring

2️⃣ Secure Coding Practices

Preventing SQL Injection

Instead of writing raw SQL queries, use parameterized queries:

# ❌ Insecure (Vulnerable to SQL Injection)
cursor.execute(f"SELECT * FROM users WHERE username = '{user_input}'")

# ✅ Secure (Parameterized Query)
cursor.execute("SELECT * FROM users WHERE username = ?", (user_input,))
  • Why? This prevents an attacker from injecting malicious SQL statements.

Preventing Cross-Site Scripting (XSS)

Sanitize user input and encode output using HTML escaping:

from flask import escape
user_input = escape(request.form['comment'])
  • Use a Content Security Policy (CSP):
    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://trusted.cdn.com">

3️⃣ Authentication & Session Security

Enforce Strong Password Policies

✅ Require passwords to be at least 12 characters long, with a mix of letters, numbers, and symbols.
✅ Use bcrypt or Argon2 for password hashing:

from argon2 import PasswordHasher
ph = PasswordHasher()
hashed_password = ph.hash("SecureP@ssw0rd!")

Implement Multi-Factor Authentication (MFA)

✅ Use TOTP-based authentication (e.g., Google Authenticator).
✅ Enforce session timeouts and re-authentication for sensitive actions.

4️⃣ Web Server Hardening

Secure Your Web Server (Apache/Nginx)

✅ Disable directory listing:

Options -Indexes

✅ Prevent clickjacking attacks:

Header always set X-Frame-Options "DENY"

✅ Enable HTTP Strict Transport Security (HSTS):

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Disable Unnecessary HTTP Methods

Test for dangerous HTTP methods:

curl -X OPTIONS http://example.com

✅ Only allow GET, POST, and DELETE:

<LimitExcept GET POST DELETE>
    deny from all
</LimitExcept>

5️⃣ Deploying a Web Application Firewall (WAF)

A Web Application Firewall (WAF) helps protect against SQL Injection, XSS, and brute-force attacks.

Using ModSecurity (Apache/Nginx)

  1. Install ModSecurity:
    sudo apt install libapache2-mod-security2
  2. Enable core rules:
    sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
  3. Restart the web server:
    sudo systemctl restart apache2

✅ Alternative: Use Cloudflare WAF for managed security.

6️⃣ Logging & Monitoring for Security Threats

Enable Logging in Apache/Nginx

✅ Track suspicious requests in access logs:

sudo tail -f /var/log/apache2/access.log

✅ Use Fail2Ban to block brute-force attempts:

sudo apt install fail2ban

✅ Monitor web traffic using Open Source SIEM (e.g., Wazuh, ELK Stack).

📌 Conclusion

By completing this lab, you have: ✅ Applied secure coding practices to prevent common vulnerabilities
✅ Hardened a web server against attacks
✅ Deployed a Web Application Firewall (WAF) for protection
✅ Set up logging & monitoring to detect threats

📤 Submission Instructions

Submit a security hardening report with: ✅ Screenshots of implemented security measures
✅ Explanation of vulnerabilities mitigated
✅ Configurations applied to the web server

🚀 Next Steps: Test your hardened application using OWASP ZAP to ensure all security measures are effective!