Cyber-Range-API-Security - This project implements a Cyber Range for API Secu

项目说明

🛡️ Cyber Range – API Security (Red Team / Blue Team)

!Cyber Range Architecture

📌 Project O

This project implements a Cyber Range for API Security, designed to simulate realistic cyber-attacks and e defensi using a defense-in-depth strategy.

The en combines offensi testing (Red Team) and defensi & response (Blue Team), focusing on from the OWASP API Security Top 10.

---

🎯 Project Objectives

🔴 Red Team Objectives

Identify and exploit in a deliberately API (crAPI)

Perform attacks such as:

- NoSQL Injection
- BOLA / BFLA
- SSRF
- Mass Assignment
- Brute-force authentication

exploit impact and bypass attempts

🔵 Blue Team Objectives

Detect malicious activity using Suricata (IDS) and Wazuh (SIEM)

Block attacks using ModSecurity (WAF + OWASP CRS)

Correlate security events and generate alerts

incidents

Automate response actions (IP blocking, alerting)

---

🧱 Architecture

Security Flow (Defense-in-Depth)

Kali Linux (Attacker)
↓
ModSecurity (WAF + OWASP CRS)
↓
crAPI ( API)
↓
Suricata (Network IDS)
↓
Wazuh (SIEM + Dashboards + Acti)

Components

| Component | Description |
|--------|------------|
| Kali Linux | Attacker machine (Red Team) |
| ModSecurity | Web Application Firewall (Reverse Proxy) |
| crAPI | REST API |
| Suricata | Network Intrusion Detection System |
| Wazuh | SIEM, correlation & response |
| AWS EC2 | Cloud infrastructure |
| Docker | Application deployment |

---

☁️ AWS Infrastructure

| Service | Instance Type | Resources |
|------|--------------|-----------|
| Wazuh Server | t3.large | 2 vCPU / 8 GB RAM / 100 GB Disk |
| Suricata | t3.medium | 2 vCPU / 4 GB RAM |
| crAPI | t3.medium | 2 vCPU / 4 GB RAM |
| ModSecurity | t3.medium | 2 vCPU / 4 GB RAM |

---

🚀 Deployment Summary

🔹 Wazuh (SIEM)

Docker-based deployment

Single-node architecture

Integrated ELK stack

Dashboards & alerts enabled

🔹 Suricata (IDS)

Emerging Threats rules

Network traffic inspection

Integrated with Wazuh

🔹 crAPI

Docker Compose deployment

Intentionally API

Used for security testing

🔹 ModSecurity (WAF)

Apache reverse proxy

OWASP Core Rule Set (CRS)

Full inspection of API traffic

---

🔍 Red Team Testing

Tools Used

Burp Suite

OWASP ZAP

Nmap

Nikto

Tested

NoSQL Injection

SSRF

Broken Object Le (BOLA)

Broken Function Le (BFLA)

Mass Assignment

Login & OTP Brute-Force

Excessive Data Exposure

Improper Assets Management

---

📊 Summary

| Se | Count |
|--------|------|
| Critical | 1 |
| High | 5 |
| Moderate | 4 |
| Low | 0 |
| Informational | 0 |

---

📈 Detection & Response

Suricata detects suspicious network traffic

ModSecurity blocks malicious requests

Wazuh correlates:

- IDS alerts
- WAF logs
- Application logs

Acti:

- Automatically blocks attacker IPs
- Generates SIEM alerts

---

🧠 Key Learnings

APIs are high-value attack surfaces

WAF alone is insufficient

IDS + SIEM correlation is critical

Automation impro response

Cyber Ranges are ideal for training and

---

🔮 Future Impro

SOAR playbooks integration

MITRE ATT&CK mapping

CI/CD security testing

Terraform-based deployment

Ad attack scenarios

---

📎 References

OWASP API Security Top 10

---

👤 Author

Anas Aouina
Master – Cyber Defense & Information Security

---

📜 License

This project is intended for educational and research purposes only.

项目信息

开发语言：未知

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This project implements a Cyber Range for API Security, designed to simulate realistic cyber-attacks and evaluate defensive mechanisms using a defense-in-depth strategy. The environment combines offensive security testing (Red Team) and defensive monitoring & response (Blue Team), focusing on vulnerabilities from the OWASP API Security Top 10.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。