Proof of Concept
The Proof of Concept is made up of three types of containers: traffic sources, traffic targets, and proxies. The initial PoC will be:
- Servers hosting traffic sources sending traffic to
- Servers with IPU or DPU cards, with traffic targets on the servers
- Proxies running on IPU or DPU cards
The source, target and proxies are all containers so then can all run on a laptop.
Evaluate using iperf first
Since we're using OWASP CRS (see below), we will first evaluate Zed Attack Proxy.
The proxy will be open source NGINX with the SpiderLabs Modsecurity module running with the open source OWASP Core Rule Set (CRS).
No specific target has been chosen, the plan was to evaluate members of this list. Entries under consideration will be open source and fully runnable locally, and relatively simple to containerize if needed.
Each of the above will be running in a container. The long term plan is to have multiple types of each container, so more than one way to generate healthy traffic, many types of malicious traffic, multiple sites to automate against, etc.