Most "WAF lab" walkthroughs work on the first try. Mine didn't — duplicate
Includedirectives silently loading the same rules twice, and a shell that kept re-encoding my own test payloads before they reached the server. Chasing both down taught me more than the lab itself did.
Mahar — cybersecurity student based in India, focused on offensive security across web, API, and AI systems.
- Web & API security — WAF hardening, REST/JWT auth flaws, OWASP API Top 10
- AI / LLM security — prompt injection, adversarial testing, OWASP Top 10 for LLMs
- Network & recon — scanning, sniffing, OSINT, wireless
- Mobile & malware — attack surface mapping, static/dynamic triage
Working with Kali Linux, Burp Suite, Nmap, Wireshark, Metasploit, Postman, ffuf.
Deployed and hardened a ModSecurity WAF on Kali Linux — from a bare install to a ruleset tested against real payloads, not just enabled and left alone. The two issues above were the ones that actually taught me something; most of the rest was just following documentation correctly.
Working through the CEH v13 curriculum, module by module. This is a notebook, not a highlight reel — expect it to keep changing.