Why We're Beating Modsecurity

#1

Post by 1rhino2 » Wed, Oct 29, 2025, 9:58 PM UTC

Why We're Beating Modsecurity
github.com

Re: Why We're Beating Modsecurity

#2

Post by 1rhino2 » Wed, Oct 29, 2025, 9:58 PM UTC

Modsec is a sloppy tool thats honestly sucky. Its config hell, rule hell and its outdated ash. Its vulnerable to just about EVERY modern attack surface. We are gonna make that change: https://github.com/1rhino2/RhinoWAF/

Just to clarify, we are not a company of any sorts, simply people willing to help.

Re: Why We're Beating Modsecurity

#3

Post by westurner » Wed, Oct 29, 2025, 11:35 PM UTC

How does RhinoWAF compare to other open WAFs like OWASP Coraza WAF, bunkerweb, and SafeLine?

Does RhinoWAF support ModSecurity SecLang rulesets like OWASP CRS? Is there a SecLang to RhinoWAF JSON converter?

Shouldn't eBPF be fast at sorting and running rules?

What are good metrics for evaluating WAFs?

coraza: https://github.com/corazawaf/coraza

bunkerweb: https://github.com/bunkerity/bunkerweb

SafeLine: https://github.com/chaitin/SafeLine

RhinoWAF: https://github.com/1rhino2/RhinoWAF

gh topic: waf: https://github.com/topics/waf

awesome-WAF: https://github.com/0xInfection/Awesome-WAF

Re: Why We're Beating Modsecurity

#4

Post by westurner » Wed, Oct 29, 2025, 11:41 PM UTC

Is there a good way to go from an OpenAPI / Swagger schema to WAF rules; and then to verify that the rules don't collide? IIUC eBPF does part of this

Re: Why We're Beating Modsecurity

#5

Post by westurner » Thu, Oct 30, 2025, 12:44 AM UTC

westurner wrote: post #3

How does RhinoWAF compare to other open WAFs like OWASP Coraza WAF, bunkerweb, and SafeLine? Does RhinoWAF support ModSecurity SecLang rulesets like OWASP CRS? Is there a SecLang to RhinoWAF JSON converter? Shouldn't eBPF be fast at sorting and running rules? What are good metrics for evaluating WAFs? coraza: https://github.com/corazawaf/coraza bunkerweb: https://github.com/bunkerity/bunkerweb SafeLine: https://githu…

> What are good metrics for evaluating WAFs?

TPR: True Positive Rate (Detection Rate), TNT: True Negative Rate, FPR: False Positive Rate ("ROC Curve")

Accuracy = TP + TN / # Requests

Latency / Detection Time as percentiles

Throughput: response time in ms given requests per second

Time to Virtual Patch, and CI/CD rule deployment integration

DDoS Response Time: How quickly does the WAF mitigate a Layer 7 (application) DDoS attack?

... Rule Management Overhead: MTTT: Mean Time To Tune, Policy Complexity; CI/CD, SIEM/SOAR integration; https://gemini.google.com/share/0d2d1c53bfb0

Re: Why We're Beating Modsecurity

#6

Post by westurner » Thu, Oct 30, 2025, 12:55 AM UTC

westurner wrote: post #4

Is there a good way to go from an OpenAPI / Swagger schema to WAF rules; and then to verify that the rules don't collide? IIUC eBPF does part of this

Re: eBPF WAF

awesome-ebpf > Kernel docs, examples, "eBPF/XDP hardware offload to SmartNICs", Go libraries: https://github.com/zoidyzoidzoid/awesome-ebpf#go-libraries

/? ebpf waf site:github.com https://www.google.com/search?q=+ebpf+waf+site%3Agithub.com

harporoeder/ebpfsnitch: "Linux Application Level Firewall based on eBPF and NFQUEUE" https://github.com/harporoeder/ebpfsnitch

ebpf-security/ebpf-https: "eBPF-https is an open source web application firewall (WAF)" https://github.com/ebpf-security/ebpf-https

cilium/cilium: https://github.com/cilium/cilium :

> Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay mode. It is L7-protocol aware and can enforce network policies on L3-L7 using an identity based security model that is decoupled from network addressing.