02Personal Lab
Personal Lab · Web Security · OWASP
Vulnerable Web Application Lab
A self-hosted, segmented environment to practice realistic web attack chains end to end — from the reverse proxy and WAF down to the database.
NginxModSecurityNext.jsPostgreSQL
Overview
Instead of relying only on pre-built targets, I built a self-hosted, segmented environment to practice full OWASP-style attack chains against infrastructure I fully control — reverse proxy, WAF, application, ORM and database.
Objective
Understand how an attack actually travels through a realistic stack, and how each layer — reverse proxy, WAF, application — changes what the attacker sees and can do.
Architecture
Request path
Click a component to see what it does in the chain.
Internet / Attacker
Traffic originates from an untrusted position, as it would in the real world.
Technologies
- Ubuntu
- Nginx
- ModSecurity WAF
- Next.js
- Prisma
- PostgreSQL
What I built
- A self-hosted, segmented environment on an Ubuntu host to practice full OWASP-style attack chains rather than only pre-built targets.
- An Nginx reverse proxy fronting a ModSecurity WAF, in front of a Next.js target application.
- A Next.js / Prisma / PostgreSQL target application as the thing under test.
- A workflow to practice enumeration, exploitation and WAF-evasion in an environment I fully control.
Security concepts
- Reconnaissance & enumeration
- Web exploitation
- OWASP-style vulnerability classes
- WAF behaviour & evasion
- Attack-chain analysis
What I learned
- How attacks travel through infrastructure — each hop (proxy, WAF, app) shapes what is possible.
- The interaction between applications and security controls, and where a WAF helps or gets in the way.
- Comparing offensive activity against the defensive controls that are supposed to catch it.
- Turning an attack chain into structured documentation.