Hands-on AWS WAF training game with tutorials, scored labs, and exams where players write Web ACL rules to block real attack shapes while avoiding false positives.
A hands-on training game for learning AWS WAF by defending against real attacks.
English | 日本語
For administrators: how to build the environment, hand it out to participants, run it, and clean up is covered in the Admin guide (docs/ADMIN.md), and the handout for participants is Getting started for players (docs/PLAYER_GUIDE.md). Both guides are currently in Japanese.
A hands-on environment for learning AWS WAF while under attack.
Play solo or compete with others.
The flow from reading a tutorial's attack and steps, to designing a rule in a vulnerability lab, launching the attack, reviewing the score and model answer, and finally opening a contest from the admin page (about 70 seconds). A higher-quality version is at docs/demo-en.mp4.
Recorded in development mode (
make dev), which scores with the model answer instead of a real AWS WAF.
┌───────────────────── per player ──────────────────┐
Browser ── Lambda Function URL (gameapi: UI + API) │
│ async invoke │
▼ │
Lambda (trafficgen) ── HTTPS ─▶ ALB ◀── Web ACL (edited by the player)
│ │ │
│ ▼ │
│ Lambda (targetapp: dummy online shop) │
▼ └────────────────────────────────────┘
DynamoDB (runs, best scores, locks)
wafdojo-<name>-cf, us-east-1). CloudFront fronts the dummy app's Lambda Function URL directly rather than the ALB, so the ALB's Web ACL rules do not apply there. Set enable_cloudfront = false to skip it.X-Forwarded-For (the site is assumed to sit behind a CDN).| ID | Topic | What you learn |
|---|---|---|
| tutorial-1-sqli | SQL injection | Managed rule groups |
| tutorial-2-xss | XSS in the review form | Custom rules (Rule builder), body inspection, text transformations |
| tutorial-3-ipset | IPs on a threat list | IP sets, CIDR, X-Forwarded-For |
| tutorial-4-useragent | Vulnerability scanners | String match on headers, OR statements, lowercase transformation |
| tutorial-5-ratelimit | Floods from a single IP | Rate-based rules, aggregation keys |
| tutorial-6-ja4 | A scraper posing as a browser | How JA4 fingerprints work and how to read them (a_b_c), exact JA4 match, WAF log analysis |
| ID | Topic | What you learn |
|---|---|---|
| game-1-fakebot | A scraper posing as Googlebot | Combining AND / NOT (UA says Googlebot AND the IP is not Google's) |
| game-2-admin | External access to the admin panel | URI path conditions + IP allow list, case sensitivity |
| game-3-traversal | Path traversal | Stacking text transformations (double decoding), avoiding false positives |
| game-4-cms | An XSS rule that blocks your editors | Building exceptions, rule priority, revisiting existing rules |
| game-5-bruteforce | Login brute force + corporate NAT | Scope-down statements, threshold design |
| game-6-ja4regex | A bot army that keeps tweaking its JA4 + a partner using the same library | JA4 regular expressions (catching the shared b part), preparing for unseen variants, exceptions with AND NOT |
Rules you created in the tutorials stay in place, so in game mode they sometimes cause false positives (stages 4 and 5). You need to revisit existing rules, not just stop new attacks.
Each challenge reads: "A new vulnerability is out. It can be blocked under these conditions. Write the rule." The goal is to be able to write your own rules whenever a new vulnerability appears. After one attempt you can see the model-answer rule JSON (ready to paste into the console's Rule JSON editor) and an explanation. Many Level 2 and 3 challenges also include a "common pitfall" rule and why it fails.