case study
Project Zero: WebApp Lab (Part 4)
I built and deployed a Web Threat Intelligence Dashboard, integrating automated threat intelligence feeds into a centralized web application accessible at projectzerointel.com. The application extends the cloud infrastructure and threat intelligence pipeline developed in my previous Cloud Lab into a production facing web platform.
Alongside the production application, I deployed an intentionally vulnerable version in an isolated Docker environment to perform controlled web application security testing. Using Burp Suite, I identified and exploited common web vulnerabilities, analyzed their impact and root causes, and implemented defensive controls to remediate the identified weaknesses. I then strengthened the environment with ModSecurity and the OWASP Core Rule Set (CRS) and integrated WAF security events with Wazuh for centralized detection and monitoring.
Live Application: projectzerointel.com
#Lab Overview
-Environment: Local Docker stack running an Astro/Node.js application, NGINX reverse proxy, and PostgreSQL database.
-Goal: Understand how web application vulnerabilities are discovered and exploited, validate their real world impact, and later implement and verify defensive controls.
-Testing: Burp Suite was used to inspect HTTP traffic, manipulate requests, test application inputs, and validate exploitation.
#What I Built
-Deployed an intentionally vulnerable threat intelligence web application in an isolated Docker environment for controlled security testing.
-Used Burp Suite to analyze application behavior, manipulate HTTP requests, and identify exploitable security weaknesses.
-Tested six web application attack classes: SQL Injection, Stored XSS, IDOR, CSRF, SSRF, and OS Command Injection.
-Validated the security impact of each vulnerability and documented the attack path, root cause, and remediation.
-Implemented application-level defenses including input sanitization, authorization controls, CSRF protection, Content Security Policy (CSP), outbound request restrictions, and secure command execution.
-Deployed ModSecurity with the OWASP Core Rule Set (CRS) as an additional WAF layer to detect and block malicious web requests.
-Integrated WAF security events with Wazuh to provide centralized logging, detection, and visibility into web application attacks.
-Extended the existing cloud threat-intelligence pipeline into a production-focused Web Threat Intelligence Dashboard with automated deployment and database integration.
#Tech Stack
-Docker / Docker Compose – Local application and security testing environment
-Astro / Node.js – Web application framework and runtime
-NGINX – Reverse proxy
-PostgreSQL / Neon – Application and production database
-Burp Suite Community – Web application security testing and exploitation
-ModSecurity + OWASP CRS – Web Application Firewall and attack prevention
-Wazuh – Security monitoring and WAF alert ingestion
-AWS Lambda / S3 / EventBridge – Automated threat intelligence pipeline
-Git / GitHub Actions – Source control and CI/CD
-Fly.io – Containerized production deployment
-Cloudflare – DNS and TLS
-Linux – Development and testing environment
#Deep Dives
Web Application Architecture – Deployed the local application stack using Docker with NGINX, an Astro/Node.js application, and PostgreSQL, creating an isolated environment for controlled offensive and defensive security testing.
Web Application Attacks – Identified and exploited SQL Injection, Stored XSS, IDOR, CSRF, SSRF, and OS Command Injection vulnerabilities using Burp Suite and controlled payloads, then documented the resulting security impact and underlying root causes.
Web Application Defenses – Coming soon. Remediate the identified vulnerabilities through secure coding controls, application hardening, Content Security Policy, authorization and CSRF protections, outbound request restrictions, safe command execution, and WAF-based detection.
Project Zero Threat Intelligence Dashboardopen →Attacksopen →Defensesopen →