SafeLine

SafeLine is a WAF (web application firewall) that you place in front of your own web app. Requests from users pass through SafeLine first, and the ones it judges to be attacks are stopped before they reach the app.

This review is for people who run their own web apps, or who want hands-on experience with the defending side. After reading it, you can do the following:

• Install SafeLine on a Linux lab VM and sign in to the web console
• Put OWASP Juice Shop, a deliberately vulnerable practice app, behind SafeLine
• Find blocked requests in the console logs

##What a WAF does

A WAF checks HTTP requests before they reach your app and drops the dangerous ones. It does not fix vulnerabilities in the app. Anything the WAF misses goes straight to the app, so you still need input validation and updates on the app side. SafeLine’s own documentation reports an attack-sample detection rate of 71.65% in balance mode and 76.17% in strict mode in its own tests. Treat it as an extra layer that reduces the attacks reaching your app, not as something that stops everything.

##What SafeLine can do

According to the official documentation, SafeLine is an HTTP/HTTPS reverse proxy built on nginx. Its main features are:

• Blocking web attacks: SQL injection, XSS, code injection, OS command injection, XXE, SSRF, path traversal, and more
• Rate limiting: throttles traffic above limits you set, to slow brute-force attempts and traffic surges
• Anti-bot challenge: adds checks such as a CAPTCHA, letting people through and stopping crawlers and bots
• Authentication challenge: when turned on, only visitors who enter a password can see the site
• Dynamic protection: encrypts the HTML and JavaScript each time a page is served

On detection, the official website says SafeLine uses a semantic analysis engine that parses the meaning of HTTP traffic. The pricing table lists semantic analysis detection and rule-based protection in the free edition too.

##License and editions

Both the GitHub repository label and the LICENSE file say GPL-3.0. The repository belongs to Chaitin Tech (chaitin) on GitHub, while the English website and paid editions are run under the CyberServal name. We could not confirm how the two are related. We also could not confirm whether the source for every component in the distributed Docker images is in this repository.

There are three editions:

Running on an ARM server requires a Pro license, so use x86_64 for the free edition.

##Trying it safely: put Juice Shop behind it

Use a lab VM that only you use. Connect it to a network the internet cannot reach, such as a host-only network. See Setting up a safe lab for how to build one.

1. Check the VM. The official minimum is Linux, x86_64 or arm64, 1 CPU core / 1 GB memory / 5 GB disk, a CPU with the ssse3 instruction, Docker 20.10.14 or later, and Docker Compose 2.0.0 or later.

2. Start OWASP Juice Shop with Docker on the same VM.

3. Install SafeLine with the official script. It needs root. Save the script and read it before you run it (see “Cautions” below).

   bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

4. Generate the admin password and write it down.

   docker exec safeline-mgt resetadmin

5. Open https://<VM IP>:9443/ in a browser and sign in as admin with the password from step 4.

6. On the “Applications” page, click “Add Application”. Enter the domain to listen on (the VM’s IP works), a port such as 80, and Juice Shop’s address as the upstream (for example, http://<VM IP>:3000).

7. Open Juice Shop through SafeLine and check that the page loads normally.

##Checking blocks in the logs

The official “Add Application” page has example test URLs for checking that blocking works. Try them only against your own Juice Shop.

• When a request is blocked, SafeLine returns its block page instead of Juice Shop.
• A new entry appears in the console’s attack list. Open “detail” to see the request.
• The official FAQ notes that the interception count and the number of attack log entries can differ. Requests stopped by rate limiting, bot checks, or the authentication challenge are not logged as attack events.

If a normal action shows the block page, that is a false positive. Find which action caused it in the logs before you change the settings.

##Common tasks

The console uses port 9443. SafeLine also uses 65508 (health check) and 65443 (custom pages).

##Cautions

##Read next

• cd ../juice-shopOWASP Juice Shopthe practice app to put behind SafeLine
• cd ../zapZAPa scanner for finding web app vulnerabilities
• cat ~/guides/lab-setup.mdSetting up a safe lab