OWASP CRS RuleLookup

• 

  LandingPage

• 

  SearchARule

• 

  UploadSecurityEvent

• 

  SecurityAnalysis

Inspiration

Security teams often face firewall logs that say “blocked request” but give almost no explanation. Instead of clear details, they get cryptic IDs and minimal context, forcing hours of manual searching through rule files just to understand what happened.

I wanted to change that. My goal was to build a tool that makes firewall debugging fast, visual, and developer-friendly — turning confusing logs into clear insights that help both security analysts and developers quickly see why a request was blocked and how to fix it.

What it does

CRS Rule Lookup helps security teams understand why a request was blocked by:

🔍 Mapping Cloudflare UUIDs to OWASP CRS rule IDs 📘 Displaying rule messages, regex patterns, and metadata 🧠 Highlighting matched payload segments 🔐 Uploading and decrypting encrypted Cloudflare event JSONs 🛡️ Ensuring zero data storage for privacy and security 🧭 Viewing results in interactive Table/Card formats

How we built it

Frontend React TailwindCSS

Backend Node.js + Express

Processing & Integrations Custom parser (parse-crs.js) to extract CRS rules Cloudflare API for UUID ↔ CRS mapping Cloudflare matched-data-cli for payload decryption Google OAuth (Console) for secure login - currently disabled for the judges No database – all processing is in-memory

Challenges we ran into

Mapping Cloudflare UUIDs back to CRS rule IDs Parsing large CRS rule files efficiently Automating Cloudflare matched-data-cli securely Handling encrypted payloads safely without storage Designing a UI that simplifies complex security data

Accomplishments that we're proud of

Successfully mapped UUIDs to CRS rules Built an end-to-end decryption workflow Created regex match highlighting Zero data storage for maximum privacy Clean, responsive UI for security teams

What we learned

Deep understanding of OWASP CRS internals Cloudflare WAF event structure Secure backend automation Building privacy-focused tools Improving UX for security debugging

What's next for OWASP CRS RuleLookup

Support for more WAF vendors Advanced analytics & dashboards Rule tuning recommendations Team collaboration features Exportable reports for SOC teams

Built With

• express.js
• google-gmail-oauth
• matched-data-cli
• node.js
• react
• tailwind