diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/.keep" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/.keep"
deleted file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/README.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/README.md"
new file mode 100644
index 0000000000000000000000000000000000000000..8cb91a90d6f9bfeca2b17be302a26fe32a55348f
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/README.md"	
@@ -0,0 +1,182 @@
+
+# 部署Arcadia API Server
+
+## Arcadia环境说明
+本章节Arcadia API Server环境采用kubernetes部署。如已有API Server环境也可以选择自己的环境。
+
+1. 拓扑架构
+
+2. Kubernetes环境
+
+3. Lab环境所需yaml配置文件:
+```
+app-protect-log-config.yaml
+app-protect-policy.yaml
+arcadia-virtualserver.yaml
+arcadia-services-nodeport.yaml
+arcadia-deployments.yaml
+arcadia-services-cluster-ip.yaml
+waf-policy-dataguard.yaml
+```
+
+
+## Kubenetes部署Arcadia应用
+
+1. SSH命令行登陆Kubernetes
+
+2. 创建Lab文件夹并将所需文件导入该文件夹
+```bash
+mkdir -p /home/ubuntu/lab-files/arcadia-manifests/
+```
+3. 部署Arcadia deployment
+```
+kubectl apply -f /home/ubuntu/lab-files/arcadia-manifests/arcadia-deployments.yaml
+```
+
+可以看到部署成功，如下：
+```
+deployment.apps/backend created
+deployment.apps/main created
+deployment.apps/app2 created
+deployment.apps/app3 created
+```
+---
+注：
+```
+此时，Arcadia应用已经正在运行，但是还没有通过Kubernetes服务暴露。
+```
+
+
+
+## 通过Kubenetes Nodeport暴露Arcadia应用
+
+4. 通过Nodeport服务暴露应用
+```
+kubectl apply -f /home/ubuntu/lab-files/arcadia-manifests/arcadia-services-nodeport.yaml
+```
+注：arcadia-services-nodeport.yaml配置如下：
+```yaml
+##################################################################################################
+# FILES - BACKEND
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: default
+  labels:
+    app: backend
+    service: backend
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    nodePort: 30584
+    protocol: TCP
+    targetPort: 80
+    name: backend-80
+  selector:
+    app: backend
+---
+##################################################################################################
+# MAIN
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: main
+  namespace: default
+  labels:
+    app: main
+    service: main
+spec:
+  type: NodePort
+  ports:
+  - name: main-80
+    nodePort: 30585
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: main
+---
+##################################################################################################
+# APP2
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: app2
+  namespace: default
+  labels:
+    app: app2
+    service: app2
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    name: app2-80
+    nodePort: 30586
+    protocol: TCP
+  selector:
+    app: app2
+---
+##################################################################################################
+# APP3
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: app3
+  namespace: default
+  labels:
+    app: app3
+    service: app3
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    name: app3-80
+    nodePort: 30587
+  selector:
+    app: app3
+```
+完成后，可以看到创建了4个服务，如下：
+```
+service/backend created
+service/main created
+service/app2 created
+service/app3 created
+```
+
+---
+注：
+```
+此时Arcadia应用已经通过NodePort方式将BACKEND，MAIN，APP1，APP2和APP3这4个API服务暴露完成。
+
+但是还未对这些API服务进行NAP防护。
+```
+
+---
+
+## 验证Arcadia应用运行状态
+
+5. 浏览器访问http://centos.arcadia-finance.io/
+
+可以正常打开，如图：
+
+![arcadia-centos](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/arcadia-centos.png)
+
+6. 点击登陆Login，输入用户名和密码
+
+用户名：matt
+
+密码：ilovef5
+
+可以看到对应的4个服务（main, back, app2和app3），如图：
+
+![arcadia-login](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/arcadia-login.png)
+
+---
+到达此关卡，说明Arcadia应用已经部署完成，并通过NGINX Plus代理发布成功。🍺🍺
+---
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/app-protect-log-config.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/app-protect-log-config.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..0ffa031d6723e3f6eaf161834cb4c2289d0068ae
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/app-protect-log-config.yaml"	
@@ -0,0 +1,13 @@
+---
+### App Protect Logs ###
+apiVersion: appprotect.f5.com/v1beta1
+kind: APLogConf
+metadata:
+  name: logconf
+spec:
+  filter:
+    request_type: all
+  content:
+    format: default
+    max_request_size: any
+    max_message_size: 5k
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/app-protect-policy.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/app-protect-policy.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..c43c11f9786e3f646c48ca2eca83a6681de07f4c
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/app-protect-policy.yaml"	
@@ -0,0 +1,25 @@
+#### app-protect-policy.yaml ###
+---
+apiVersion: appprotect.f5.com/v1beta1
+kind: APPolicy
+metadata:
+  name: dataguard-blocking
+spec:
+  policy:
+    name: dataguard_blocking
+    template:
+      name: POLICY_TEMPLATE_NGINX_BASE
+    applicationLanguage: utf-8
+    enforcementMode: blocking
+    blocking-settings:
+      violations:
+      - name: VIOL_DATA_GUARD
+        alarm: true
+        block: true
+    data-guard:
+      enabled: true
+      maskData: true
+      creditCardNumbers: true
+      usSocialSecurityNumbers: true
+      enforcementMode: ignore-urls-in-list
+      enforcementUrls: []
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-deployments.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-deployments.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..38fe2ef3cee8ca339e38d0589b010dceb46f32d7
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-deployments.yaml"	
@@ -0,0 +1,137 @@
+##################################################################################################
+# FILES - BACKEND
+##################################################################################################
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: default
+  labels:
+    app: backend
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend
+        version: v1
+    spec:
+      containers:
+      - env:
+        - name: service_name
+          value: backend
+        image: registry.gitlab.com/arcadia-application/back-end/backend:latest
+        imagePullPolicy: IfNotPresent
+        name: backend
+        ports:
+        - containerPort: 80
+          protocol: TCP
+---
+##################################################################################################
+# MAIN
+##################################################################################################
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: main
+  namespace: default
+  labels:
+    app: main
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: main
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: main
+        version: v1
+    spec:
+      containers:
+      - env:
+        - name: service_name
+          value: main
+        image: registry.gitlab.com/arcadia-application/main-app/mainapp:latest
+        imagePullPolicy: IfNotPresent
+        name: main
+        ports:
+        - containerPort: 80
+          protocol: TCP
+---
+##################################################################################################
+# APP2
+##################################################################################################
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app2
+  namespace: default
+  labels:
+    app: app2
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: app2
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: app2
+        version: v1
+    spec:
+      containers:
+      - env:
+        - name: service_name
+          value: app2
+        image: registry.gitlab.com/arcadia-application/app2/app2:latest
+        imagePullPolicy: IfNotPresent
+        name: app2
+        ports:
+        - containerPort: 80
+          protocol: TCP
+---
+##################################################################################################
+# APP3
+##################################################################################################
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app3
+  namespace: default
+  labels:
+    app: app3
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: app3
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: app3
+        version: v1
+    spec:
+      containers:
+      - env:
+        - name: service_name
+          value: app3
+        image: registry.gitlab.com/arcadia-application/app3/app3:latest
+        imagePullPolicy: IfNotPresent
+        name: app3
+        ports:
+        - containerPort: 80
+          protocol: TCP
+        resources: {}
+---
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-services-cluster-ip.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-services-cluster-ip.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..2c5ad01c6b347bc770e056e3f4d46c92055520e8
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-services-cluster-ip.yaml"	
@@ -0,0 +1,79 @@
+##################################################################################################
+# FILES - BACKEND
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: default
+  labels:
+    app: backend
+    service: backend
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+    name: backend-80
+  selector:
+    app: backend
+---
+##################################################################################################
+# MAIN
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: main
+  namespace: default
+  labels:
+    app: main
+    service: main
+spec:
+  type: ClusterIP
+  ports:
+  - name: main-80
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: main
+---
+##################################################################################################
+# APP2
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: app2
+  namespace: default
+  labels:
+    app: app2
+    service: app2
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    name: app2-80
+  selector:
+    app: app2
+---
+##################################################################################################
+# APP3
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: app3
+  namespace: default
+  labels:
+    app: app3
+    service: app3
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    name: app3-80
+  selector:
+    app: app3
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-services-nodeport.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-services-nodeport.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..c279f008d0c6ef6e53718271efcd8a37a92f9142
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-services-nodeport.yaml"	
@@ -0,0 +1,84 @@
+##################################################################################################
+# FILES - BACKEND
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: default
+  labels:
+    app: backend
+    service: backend
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    nodePort: 30584
+    protocol: TCP
+    targetPort: 80
+    name: backend-80
+  selector:
+    app: backend
+---
+##################################################################################################
+# MAIN
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: main
+  namespace: default
+  labels:
+    app: main
+    service: main
+spec:
+  type: NodePort
+  ports:
+  - name: main-80
+    nodePort: 30585
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: main
+---
+##################################################################################################
+# APP2
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: app2
+  namespace: default
+  labels:
+    app: app2
+    service: app2
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    name: app2-80
+    nodePort: 30586
+    protocol: TCP
+  selector:
+    app: app2
+---
+##################################################################################################
+# APP3
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: app3
+  namespace: default
+  labels:
+    app: app3
+    service: app3
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    name: app3-80
+    nodePort: 30587
+  selector:
+    app: app3
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-virtualserver.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-virtualserver.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..85bfd77dc5f1710c20082764cf9488d90d5e73c4
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/arcadia-virtualserver.yaml"	
@@ -0,0 +1,34 @@
+apiVersion: k8s.nginx.org/v1
+kind: VirtualServer
+metadata:
+  name: vs-arcadia
+spec:
+  host: k8s.arcadia-finance.io
+  policies:
+  - name: waf-policy
+  upstreams:
+    - name: main
+      service: main
+      port: 80
+    - name: backend
+      service: backend
+      port: 80
+    - name: app2
+      service: app2
+      port: 80
+    - name: app3
+      service: app3
+      port: 80
+  routes:
+    - path: /
+      action:
+        pass: main
+    - path: /files
+      action:
+        pass: backend
+    - path: /api
+      action:
+        pass: app2
+    - path: /app3
+      action:
+        pass: app3
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/waf-policy-dataguard.yaml" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/waf-policy-dataguard.yaml"
new file mode 100644
index 0000000000000000000000000000000000000000..6af1286401c0eb5b858fa3d3123c68b53bf412c0
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-0-\347\216\257\345\242\203\346\220\255\345\273\272/waf-policy-dataguard.yaml"	
@@ -0,0 +1,12 @@
+apiVersion: k8s.nginx.org/v1
+kind: Policy
+metadata:
+  name: waf-policy
+spec:
+  waf:
+    enable: true
+    apPolicy: "default/dataguard-blocking"
+    securityLog:
+      enable: true
+      apLogConf: "default/logconf"
+      logDest: "syslog:server=10.1.20.11:5144"
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/1-README_NAP_Deployment.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/1-README_NAP_Deployment.md"
new file mode 100644
index 0000000000000000000000000000000000000000..22e8973694bb32c973546b513950c8dcbfd1c453
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/1-README_NAP_Deployment.md"	
@@ -0,0 +1,185 @@
+# 概述
+
+NGINX App Protect（简称NAP）可以对web应用提供WAF防护功能，包括：OWASP Top 10，响应包检查，元字符检查，HTTP协议合规性检查，防逃逸技术，文件类型过滤，JSON、XML和gRPC检查，敏感参数防泄露等。
+
+## 前提条件
+1. NGINX Plus Release 22 及更高版本支持 NGINX App Protect。
+
+2. NGINX App Protect 支持以下操作系统：
+- CentOS/RHEL 7.4.x及更高
+- Debian 9 - (从NGINX Plus R24开始弃用)
+- Debian 10
+- Ubuntu 18.04
+- Ubuntu 20.04
+- Alpine 3.10
+
+3. NGINX App Protect支持的部署环境如下：
+- Linux主机
+- Docker
+- Kubernetes Ingress Controller
+- Cloud
+
+4. 申请好NGINX Plus测试许可。在自己试用账号门户站点里<https://my.f5.com/>，下载好以下2个文件：
+```
+nginx-repo.key
+nginx-repo.crt
+```
+
+# Lab环境介绍
+
+本章节演示和实验采用在CentOS虚机中部署NGINX App Protect环境，学员可根据自己实际情况准备实验环境。本环境中包含以下组件：
+
+## NGINX Plus反向代理服务器
+后面简称反代，
+
+## Web API Servers
+使用Arcadia应用服务，通过GitLab下载安装：https://gitlab.com/arcadia-application
+
+## 测试客户端
+请预装以下软件，并且为了方便测试，建议在客户端hosts配置测试所用域名。
+- 浏览器
+- Postman
+- Jmeter
+
+# CentOS 7.4+环境的NAP安装步骤
+
+1. 如果前面章节的实验已有相关NGINX包，可以备份相关配置和日志
+```bash
+sudo cp -a /etc/nginx /etc/nginx-plus-backup
+sudo cp -a /var/log/nginx /var/log/nginx-plus-backup
+```
+2. 创建/etc/ssl/nginx/目录和/etc/nginx/目录
+```bash
+sudo mkdir -p /etc/ssl/nginx
+sudo mkdir -p /etc/nginx
+```
+3. 将以上《前提条件》中申请的测试许可从门户站点中下载好，并复制到/etc/ssl/nginx/目录下。
+
+4. 安装必备软件包
+```bash
+sudo yum install ca-certificates epel-release wget
+```
+5. 添加NGINX Plus库
+```bash
+sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nginx-plus-7.repo
+```
+6.安装最新版本的NGINX App Protect软件包（包括NGINX Plus）
+```bash
+sudo yum install app-protect
+```
+注：也可以通过以下命令列出可用版本:
+```bash
+sudo yum --showduplicates list app-protect
+```
+从而选择指定版本进行安装，例如：
+```bash
+sudo yum install app-protect-20+2.52.1
+```
+7. 检查 NGINX 二进制版本以确保正确安装了 NGINX Plus
+```bash
+sudo nginx -v
+```
+8. 配置nginx，以下二选一。
+- 可以将Gitee中<11 NGINX Web与API安全>目录下的nginx.conf文件拷贝至/etc/nginx/目录
+- 或者直接vi将如下配置文件内容粘贴至/etc/nginx/nginx.conf中：
+```nginx
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+
+# load the app protect module
+load_module modules/ngx_http_app_protect_module.so;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include          /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    # note that in the dockerfile, the logs are redirected to stdout and can be viewed with `docker logs`
+    access_log  /var/log/nginx/access.log  main;
+
+    server {
+        listen       80;
+        server_name  localhost;
+        proxy_http_version 1.1;
+        proxy_cache_bypass  $http_upgrade;
+
+        proxy_set_header Host $host;
+
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_ignore_client_abort on;
+
+        app_protect_enable on;
+        app_protect_security_log_enable on;
+        # send the logs to the logstash instance on our ELK stack.
+        app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.1.11:5144;
+
+        # main service
+        location / {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
+        }
+
+        # backend service
+        location /files {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30584$request_uri;
+        }
+
+        # app2 service
+        location /api {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30586$request_uri;
+        }
+
+        # app2 service
+        location /app3 {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30587$request_uri;
+        }
+    }
+}
+```
+9. 关闭SELinux，允许全局访问
+```bash
+sudo setenforce 0
+```
+10. 启用并启动NGINX服务
+```bash
+sudo systemctl enable --now nginx.service
+```
+11. 检查运行是否正常
+```bash
+systemctl status nginx
+```
+可以看到nginx的服务已经是active的状态。
+
+---
+至此，就完成了NAP的安装和初始化相关工作。🍺
+---
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/2-README_OWASP Top 10.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/2-README_OWASP Top 10.md"
new file mode 100644
index 0000000000000000000000000000000000000000..ed52b3ca1404216828ec6d2710221cdf3fd6c155
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/2-README_OWASP Top 10.md"	
@@ -0,0 +1,534 @@
+# OWASP Top 10防护
+
+## 相关配置文件列表
+
+```
+nginx.conf
+policy_owasp_top10.json
+``` 
+
+
+# 测试工具
+
+- 浏览器
+- 模拟攻击脚本规则
+
+---
+
+# 模拟攻击测试
+
+
+## SQL注入防护
+
+1. 浏览器输入：
+```
+http://centos.arcadia-finance.io/?hfsagrs=-1+union+select+user%2Cpassword+from+users+--+
+```
+2. 请求被NAP阻断，阻断信息及support ID: 18029559235433355204：
+
+![OWASP-Top-10-SQL注入](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/OWASP-Top-10-SQL%E6%B3%A8%E5%85%A5.png)
+
+3. 攻击防护相关log信息：
+
+```json
+
+{
+  "_index": "waf-logs-2021.10.10",
+  "_type": "_doc",
+  "_id": "PkXKaHwBMIwAeeuRM3s4",
+  "_version": 1,
+  "_score": null,
+  "_source": {
+    "request_status": "blocked",
+    "severity": 2,
+    "bot_category": "Non-BOT",
+    "violation_details": "<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000200c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>LTEgdW5pb24gc2VsZWN0IHVzZXIscGFzc3dvcmQgZnJvbSB1c2VycyAtLSA=</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200002553</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>8</offset><length>15</length></kw_data></sig_data><sig_data><sig_id>200000073</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>11</offset><length>40</length></kw_data></sig_data><sig_data><sig_id>200002736</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>9</offset><length>14</length></kw_data></sig_data><sig_data><sig_id>200000082</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>17</offset><length>34</length></kw_data></sig_data><sig_data><sig_id>200002553</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>8</offset><length>15</length></kw_data></sig_data><sig_data><sig_id>200000073</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>11</offset><length>40</length></kw_data></sig_data><sig_data><sig_id>200002736</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>9</offset><length>14</length></kw_data></sig_data><sig_data><sig_id>200000082</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>17</offset><length>34</length></kw_data></sig_data></violation></request-violations></BAD_MSG>",
+    "uri": "/",
+    "bot_signature_name": "N/A",
+    "violations": [
+      "Attack signature detected",
+      "Violation Rating Threat detected"
+    ],
+    "ip_client": "10.1.1.13",
+    "src_port": "60422",
+    "message": "ASM:attack_type=\"Non-browser Client,SQL-Injection\",blocking_exception_reason=\"N/A\",date_time=\"2021-10-10 06:00:52\",dest_port=\"80\",ip_client=\"10.1.1.13\",is_truncated=\"false\",method=\"GET\",policy_name=\"app_protect_default_policy\",protocol=\"HTTP\",request_status=\"blocked\",response_code=\"0\",severity=\"Critical\",sig_cves=\"N/A\",sig_ids=\"200002553,200000073,200002736,200000082\",sig_names=\"SQL-INJ integer field UNION (Parameter),SQL-INJ \"\"UNION SELECT\"\" (Parameter),SQL-INJ ' UNION SELECT (Parameter)...\",sig_set_names=\"{SQL Injection Signatures},{High Accuracy Signatures;SQL Injection Signatures},{SQL Injection Signatures}...\",src_port=\"60422\",sub_violations=\"N/A\",support_id=\"18029559235433355204\",threat_campaign_names=\"N/A\",unit_hostname=\"c68206ac-6bd7-49d0-ad95-d7b1ccb15787\",uri=\"/\",violation_rating=\"5\",vs_name=\"26-localhost:1-/\",x_forwarded_for_header_value=\"N/A\",outcome=\"REJECTED\",outcome_reason=\"SECURITY_WAF_VIOLATION\",violations=\"Attack signature detected,Violation Rating Threat detected\",violation_details=\"<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000200c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>LTEgdW5pb24gc2VsZWN0IHVzZXIscGFzc3dvcmQgZnJvbSB1c2VycyAtLSA=</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200002553</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>8</offset><length>15</length></kw_data></sig_data><sig_data><sig_id>200000073</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>11</offset><length>40</length></kw_data></sig_data><sig_data><sig_id>200002736</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>9</offset><length>14</length></kw_data></sig_data><sig_data><sig_id>200000082</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>17</offset><length>34</length></kw_data></sig_data><sig_data><sig_id>200002553</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>8</offset><length>15</length></kw_data></sig_data><sig_data><sig_id>200000073</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>11</offset><length>40</length></kw_data></sig_data><sig_data><sig_id>200002736</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>9</offset><length>14</length></kw_data></sig_data><sig_data><sig_id>200000082</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0tMSB1bmlvbiBzZWxlY3QgdXNlcixwYXNzd29yZCBmcm9tIHVzZXJzIC0tIA==</buffer><offset>17</offset><length>34</length></kw_data></sig_data></violation></request-violations></BAD_MSG>\",bot_signature_name=\"N/A\",bot_category=\"N/A\",bot_anomalies=\"N/A\",enforced_bot_anomalies=\"N/A\",client_class=\"Browser\",client_application=\"FireFox\",client_application_version=\"94\",request=\"GET /?hfsagrs=-1+union+select+user%2Cpassword+from+users+--+ HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n\",transport_protocol=\"HTTP/1.1\"\r\n",
+    "sig_set_names": [
+      "{SQL Injection Signatures}",
+      "{High Accuracy Signatures;SQL Injection Signatures}",
+      "{SQL Injection Signatures}..."
+    ],
+    "priority": 130,
+    "timestamp": "Oct 10 06:00:53",
+    "sig_cves": [
+      "N/A"
+    ],
+    "x_forwarded_for_header_value": "N/A",
+    "source_host": "10.1.1.13",
+    "request": "GET /?hfsagrs=-1+union+select+user%2Cpassword+from+users+--+ HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n",
+    "violation_rating": "5",
+    "geoip": {},
+    "unit_hostname": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "dest_port": "80",
+    "outcome_reason": "SECURITY_WAF_VIOLATION",
+    "tags": [
+      "waf",
+      "_geoip_lookup_failure"
+    ],
+    "host": "10.1.1.9",
+    "facility": 16,
+    "date_time": "2021-10-10 06:00:52",
+    "sub_violations": [
+      "N/A"
+    ],
+    "logsource": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "facility_label": "local0",
+    "blocking_exception_reason": "N/A",
+    "@timestamp": "2021-10-10T06:00:53.000Z",
+    "severity_label": "Critical",
+    "is_truncated": "false",
+    "method": "GET",
+    "policy_name": "app_protect_default_policy",
+    "client_class": "Browser",
+    "protocol": "HTTP",
+    "support_id": "18029559235433355204",
+    "@version": "1",
+    "sig_ids": [
+      "200002553",
+      "200000073",
+      "200002736",
+      "200000082"
+    ],
+    "vs_name": "26-localhost:1-/",
+    "outcome": "REJECTED",
+    "bot_anomalies": [
+      "N/A"
+    ],
+    "response_code": "Blocked",
+    "sig_names": [
+      "SQL-INJ integer field UNION (Parameter)",
+      "SQL-INJ "
+    ]
+  },
+  "fields": {
+    "@timestamp": [
+      "2021-10-10T06:00:53.000Z"
+    ]
+  },
+  "sort": [
+    1633845653000
+  ]
+}
+```
+
+
+---
+
+
+## Remote File Include (RFI)远程文件包含防护
+
+解释：
+```
+攻击者利用包含的特性，加上应用本身对文件（包含）控制不严格，最终造成攻击者进行任意文件包含。
+包含的文件内容会被当成PHP脚本文件来解析，从而攻击者可以在包含文件里面使用恶意脚本。
+```
+
+1. 浏览器输入：
+```
+http://centos.arcadia-finance.io/?hfsagrs=php%3A%2F%2Ffilter%2Fresource%3Dhttp%3A%2F%2Fgoogle.com%2Fsearch
+```
+2. 请求被NAP阻断，阻断信息及support ID: 302917768469178547：
+
+![OWASP-Top-10-remote-files-include](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/OWASP-Top-10-remote-files-include.png)
+
+3. 攻击防护相关log信息：
+
+```json
+{
+  "_index": "waf-logs-2021.10.10",
+  "_type": "_doc",
+  "_id": "P0XQaHwBMIwAeeuRXXtZ",
+  "_version": 1,
+  "_score": null,
+  "_source": {
+    "request_status": "blocked",
+    "severity": 3,
+    "bot_category": "Non-BOT",
+    "violation_details": "<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000200c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>cGhwOi8vZmlsdGVyL3Jlc291cmNlPWh0dHA6Ly9nb29nbGUuY29tL3NlYXJjaA==</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200022013</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz1waHA6Ly9maWx0ZXIvcmVzb3VyY2U9aHR0cDovL2dvb2dsZS5jb20vc2VhcmNo</buffer><offset>8</offset><length>12</length></kw_data></sig_data></violation></request-violations></BAD_MSG>",
+    "uri": "/",
+    "bot_signature_name": "N/A",
+    "violations": [
+      "Attack signature detected"
+    ],
+    "ip_client": "10.1.1.13",
+    "src_port": "60432",
+    "message": "ASM:attack_type=\"Remote File Include\",blocking_exception_reason=\"N/A\",date_time=\"2021-10-10 06:07:38\",dest_port=\"80\",ip_client=\"10.1.1.13\",is_truncated=\"false\",method=\"GET\",policy_name=\"app_protect_default_policy\",protocol=\"HTTP\",request_status=\"blocked\",response_code=\"0\",severity=\"Error\",sig_cves=\"N/A\",sig_ids=\"200022013\",sig_names=\"PHP remote file include attempt - filter\",sig_set_names=\"{High Accuracy Signatures;Remote File Include Signatures}\",src_port=\"60432\",sub_violations=\"N/A\",support_id=\"302917768469178547\",threat_campaign_names=\"N/A\",unit_hostname=\"c68206ac-6bd7-49d0-ad95-d7b1ccb15787\",uri=\"/\",violation_rating=\"3\",vs_name=\"26-localhost:1-/\",x_forwarded_for_header_value=\"N/A\",outcome=\"REJECTED\",outcome_reason=\"SECURITY_WAF_VIOLATION\",violations=\"Attack signature detected\",violation_details=\"<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000200c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>cGhwOi8vZmlsdGVyL3Jlc291cmNlPWh0dHA6Ly9nb29nbGUuY29tL3NlYXJjaA==</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200022013</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz1waHA6Ly9maWx0ZXIvcmVzb3VyY2U9aHR0cDovL2dvb2dsZS5jb20vc2VhcmNo</buffer><offset>8</offset><length>12</length></kw_data></sig_data></violation></request-violations></BAD_MSG>\",bot_signature_name=\"N/A\",bot_category=\"N/A\",bot_anomalies=\"N/A\",enforced_bot_anomalies=\"N/A\",client_class=\"Browser\",client_application=\"FireFox\",client_application_version=\"94\",request=\"GET /?hfsagrs=php%3A%2F%2Ffilter%2Fresource%3Dhttp%3A%2F%2Fgoogle.com%2Fsearch HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n\",transport_protocol=\"HTTP/1.1\"\r\n",
+    "sig_set_names": [
+      "{High Accuracy Signatures;Remote File Include Signatures}"
+    ],
+    "priority": 131,
+    "timestamp": "Oct 10 06:07:38",
+    "sig_cves": [
+      "N/A"
+    ],
+    "x_forwarded_for_header_value": "N/A",
+    "source_host": "10.1.1.13",
+    "request": "GET /?hfsagrs=php%3A%2F%2Ffilter%2Fresource%3Dhttp%3A%2F%2Fgoogle.com%2Fsearch HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n",
+    "violation_rating": "3",
+    "geoip": {},
+    "unit_hostname": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "dest_port": "80",
+    "outcome_reason": "SECURITY_WAF_VIOLATION",
+    "tags": [
+      "waf",
+      "_geoip_lookup_failure"
+    ],
+    "host": "10.1.1.9",
+    "facility": 16,
+    "date_time": "2021-10-10 06:07:38",
+    "sub_violations": [
+      "N/A"
+    ],
+    "logsource": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "facility_label": "local0",
+    "blocking_exception_reason": "N/A",
+    "@timestamp": "2021-10-10T06:07:38.000Z",
+    "severity_label": "Error",
+    "is_truncated": "false",
+    "method": "GET",
+    "policy_name": "app_protect_default_policy",
+    "client_class": "Browser",
+    "protocol": "HTTP",
+    "support_id": "302917768469178547",
+    "@version": "1",
+    "sig_ids": [
+      "200022013"
+    ],
+    "vs_name": "26-localhost:1-/",
+    "outcome": "REJECTED",
+    "bot_anomalies": [
+      "N/A"
+    ],
+    "response_code": "Blocked",
+    "sig_names": [
+      "PHP remote file include attempt - filter"
+    ]
+  },
+  "fields": {
+    "@timestamp": [
+      "2021-10-10T06:07:38.000Z"
+    ]
+  },
+  "sort": [
+    1633846058000
+  ]
+}
+```
+
+
+---
+
+## 路径遍历防护
+
+1. 浏览器输入：
+```
+http://centos.arcadia-finance.io/lua/login.lua?referer=google.com%2F&hfsagrs=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
+```
+2. 请求被NAP阻断，阻断信息及support ID: 18029559235433355714：
+
+![OWASP-Top-10-Predictable%20Resource%20Location%20Path%20Traversal](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/OWASP-Top-10-Predictable%20Resource%20Location%20Path%20Traversal.png)
+
+3. 攻击防护相关log信息：
+
+```json
+{
+  "_index": "waf-logs-2021.10.10",
+  "_type": "_doc",
+  "_id": "QkXaaHwBMIwAeeuRPntr",
+  "_version": 1,
+  "_score": null,
+  "_source": {
+    "request_status": "blocked",
+    "severity": 2,
+    "bot_category": "Non-BOT",
+    "violation_details": "<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000000c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>Ly4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL2V0Yy9wYXNzd2Q=</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200000190</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==</buffer><offset>9</offset><length>3</length></kw_data></sig_data><sig_data><sig_id>200003054</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==</buffer><offset>30</offset><length>7</length></kw_data></sig_data><sig_data><sig_id>200003909</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==</buffer><offset>32</offset><length>11</length></kw_data></sig_data></violation></request-violations></BAD_MSG>",
+    "uri": "/lua/login.lua",
+    "bot_signature_name": "N/A",
+    "violations": [
+      "Attack signature detected",
+      "Violation Rating Threat detected"
+    ],
+    "ip_client": "10.1.1.13",
+    "src_port": "62546",
+    "message": "ASM:attack_type=\"Non-browser Client,Predictable Resource Location,Path Traversal\",blocking_exception_reason=\"N/A\",date_time=\"2021-10-10 06:18:24\",dest_port=\"80\",ip_client=\"10.1.1.13\",is_truncated=\"false\",method=\"GET\",policy_name=\"app_protect_default_policy\",protocol=\"HTTP\",request_status=\"blocked\",response_code=\"0\",severity=\"Critical\",sig_cves=\"N/A\",sig_ids=\"200000190,200003054,200003909\",sig_names=\"Directory Traversal attempt (parameter),Directory Traversal attempt (../etc/) (Parameter),\"\"/etc/passwd\"\" access (Parameter)\",sig_set_names=\"{Path Traversal Signatures},{Path Traversal Signatures},{Predictable Resource Location Signatures}\",src_port=\"62546\",sub_violations=\"N/A\",support_id=\"18029559235433355714\",threat_campaign_names=\"N/A\",unit_hostname=\"c68206ac-6bd7-49d0-ad95-d7b1ccb15787\",uri=\"/lua/login.lua\",violation_rating=\"5\",vs_name=\"26-localhost:1-/\",x_forwarded_for_header_value=\"N/A\",outcome=\"REJECTED\",outcome_reason=\"SECURITY_WAF_VIOLATION\",violations=\"Attack signature detected,Violation Rating Threat detected\",violation_details=\"<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000000c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>Ly4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL2V0Yy9wYXNzd2Q=</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200000190</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==</buffer><offset>9</offset><length>3</length></kw_data></sig_data><sig_data><sig_id>200003054</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==</buffer><offset>30</offset><length>7</length></kw_data></sig_data><sig_data><sig_id>200003909</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>aGZzYWdycz0vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==</buffer><offset>32</offset><length>11</length></kw_data></sig_data></violation></request-violations></BAD_MSG>\",bot_signature_name=\"N/A\",bot_category=\"N/A\",bot_anomalies=\"N/A\",enforced_bot_anomalies=\"N/A\",client_class=\"Browser\",client_application=\"FireFox\",client_application_version=\"94\",request=\"GET /lua/login.lua?referer=google.com%2F&hfsagrs=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n\",transport_protocol=\"HTTP/1.1\"\r\n",
+    "sig_set_names": [
+      "{Path Traversal Signatures}",
+      "{Path Traversal Signatures}",
+      "{Predictable Resource Location Signatures}"
+    ],
+    "priority": 130,
+    "timestamp": "Oct 10 06:18:25",
+    "sig_cves": [
+      "N/A"
+    ],
+    "x_forwarded_for_header_value": "N/A",
+    "source_host": "10.1.1.13",
+    "request": "GET /lua/login.lua?referer=google.com%2F&hfsagrs=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n",
+    "violation_rating": "5",
+    "geoip": {},
+    "unit_hostname": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "dest_port": "80",
+    "outcome_reason": "SECURITY_WAF_VIOLATION",
+    "tags": [
+      "waf",
+      "_geoip_lookup_failure"
+    ],
+    "host": "10.1.1.9",
+    "facility": 16,
+    "date_time": "2021-10-10 06:18:24",
+    "sub_violations": [
+      "N/A"
+    ],
+    "logsource": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "facility_label": "local0",
+    "blocking_exception_reason": "N/A",
+    "@timestamp": "2021-10-10T06:18:25.000Z",
+    "severity_label": "Critical",
+    "is_truncated": "false",
+    "method": "GET",
+    "policy_name": "app_protect_default_policy",
+    "client_class": "Browser",
+    "protocol": "HTTP",
+    "support_id": "18029559235433355714",
+    "@version": "1",
+    "sig_ids": [
+      "200000190",
+      "200003054",
+      "200003909"
+    ],
+    "vs_name": "26-localhost:1-/",
+    "outcome": "REJECTED",
+    "bot_anomalies": [
+      "N/A"
+    ],
+    "response_code": "Blocked",
+    "sig_names": [
+      "Directory Traversal attempt (parameter)",
+      "Directory Traversal attempt (../etc/) (Parameter)"
+    ]
+  },
+  "fields": {
+    "@timestamp": [
+      "2021-10-10T06:18:25.000Z"
+    ]
+  },
+  "sort": [
+    1633846705000
+  ]
+}
+```
+
+---
+
+## Cross Site Scripting防护
+
+1. 浏览器输入：
+```
+http://centos.arcadia-finance.io/lua/login.lua?referer=google.com%2F&hfsagrs=+oNmouseoVer%3Dbfet%28%29+
+```
+2. 请求被NAP阻断，阻断信息及support ID: 18029559235433356224：
+
+![OWASP-Top-10-cross%20site%20scripting](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/OWASP-Top-10-cross%20site%20scripting.png)
+
+3. 攻击防护相关log信息：
+
+```json
+{
+  "_index": "waf-logs-2021.10.10",
+  "_type": "_doc",
+  "_id": "Q0XhaHwBMIwAeeuRSXvX",
+  "_version": 1,
+  "_score": null,
+  "_source": {
+    "request_status": "blocked",
+    "severity": 2,
+    "bot_category": "Non-BOT",
+    "violation_details": "<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000200c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>IG9ObW91c2VvVmVyPWJmZXQoKSA=</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200001001</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data><sig_data><sig_id>200101162</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data><sig_data><sig_id>200001001</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data><sig_data><sig_id>200101162</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data></violation></request-violations></BAD_MSG>",
+    "uri": "/lua/login.lua",
+    "bot_signature_name": "N/A",
+    "violations": [
+      "Attack signature detected",
+      "Violation Rating Threat detected"
+    ],
+    "ip_client": "10.1.1.13",
+    "src_port": "62556",
+    "message": "ASM:attack_type=\"Non-browser Client,Cross Site Scripting (XSS)\",blocking_exception_reason=\"N/A\",date_time=\"2021-10-10 06:26:07\",dest_port=\"80\",ip_client=\"10.1.1.13\",is_truncated=\"false\",method=\"GET\",policy_name=\"app_protect_default_policy\",protocol=\"HTTP\",request_status=\"blocked\",response_code=\"0\",severity=\"Critical\",sig_cves=\"N/A\",sig_ids=\"200001001,200101162\",sig_names=\"onmouse... (Parameter),onmouseover (Parameter)\",sig_set_names=\"{Cross Site Scripting Signatures;High Accuracy Signatures},{Cross Site Scripting Signatures;High Accuracy Signatures}\",src_port=\"62556\",sub_violations=\"N/A\",support_id=\"18029559235433356224\",threat_campaign_names=\"N/A\",unit_hostname=\"c68206ac-6bd7-49d0-ad95-d7b1ccb15787\",uri=\"/lua/login.lua\",violation_rating=\"5\",vs_name=\"26-localhost:1-/\",x_forwarded_for_header_value=\"N/A\",outcome=\"REJECTED\",outcome_reason=\"SECURITY_WAF_VIOLATION\",violations=\"Attack signature detected,Violation Rating Threat detected\",violation_details=\"<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000200c00-3a03030c30000072</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>parameter</context><parameter_data><value_error/><enforcement_level>global</enforcement_level><name>aGZzYWdycw==</name><auto_detected_type>alpha-numeric</auto_detected_type><value>IG9ObW91c2VvVmVyPWJmZXQoKSA=</value><param_name_pattern>*</param_name_pattern><staging>0</staging></parameter_data><staging>0</staging><sig_data><sig_id>200001001</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data><sig_data><sig_id>200101162</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data><sig_data><sig_id>200001001</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data><sig_data><sig_id>200101162</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>aGZzYWdycz0gb05tb3VzZW9WZXI9YmZldCgpIA==</buffer><offset>9</offset><length>12</length></kw_data></sig_data></violation></request-violations></BAD_MSG>\",bot_signature_name=\"N/A\",bot_category=\"N/A\",bot_anomalies=\"N/A\",enforced_bot_anomalies=\"N/A\",client_class=\"Browser\",client_application=\"FireFox\",client_application_version=\"94\",request=\"GET /lua/login.lua?referer=google.com%2F&hfsagrs=+oNmouseoVer%3Dbfet%28%29+ HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n\",transport_protocol=\"HTTP/1.1\"\r\n",
+    "sig_set_names": [
+      "{Cross Site Scripting Signatures;High Accuracy Signatures}",
+      "{Cross Site Scripting Signatures;High Accuracy Signatures}"
+    ],
+    "priority": 130,
+    "timestamp": "Oct 10 06:26:07",
+    "sig_cves": [
+      "N/A"
+    ],
+    "x_forwarded_for_header_value": "N/A",
+    "source_host": "10.1.1.13",
+    "request": "GET /lua/login.lua?referer=google.com%2F&hfsagrs=+oNmouseoVer%3Dbfet%28%29+ HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n",
+    "violation_rating": "5",
+    "geoip": {},
+    "unit_hostname": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "dest_port": "80",
+    "outcome_reason": "SECURITY_WAF_VIOLATION",
+    "tags": [
+      "waf",
+      "_geoip_lookup_failure"
+    ],
+    "host": "10.1.1.9",
+    "facility": 16,
+    "date_time": "2021-10-10 06:26:07",
+    "sub_violations": [
+      "N/A"
+    ],
+    "logsource": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "facility_label": "local0",
+    "blocking_exception_reason": "N/A",
+    "@timestamp": "2021-10-10T06:26:07.000Z",
+    "severity_label": "Critical",
+    "is_truncated": "false",
+    "method": "GET",
+    "policy_name": "app_protect_default_policy",
+    "client_class": "Browser",
+    "protocol": "HTTP",
+    "support_id": "18029559235433356224",
+    "@version": "1",
+    "sig_ids": [
+      "200001001",
+      "200101162"
+    ],
+    "vs_name": "26-localhost:1-/",
+    "outcome": "REJECTED",
+    "bot_anomalies": [
+      "N/A"
+    ],
+    "response_code": "Blocked",
+    "sig_names": [
+      "onmouse... (Parameter)",
+      "onmouseover (Parameter)"
+    ]
+  },
+  "fields": {
+    "@timestamp": [
+      "2021-10-10T06:26:07.000Z"
+    ]
+  },
+  "sort": [
+    1633847167000
+  ]
+}
+```
+
+---
+
+## Multiple decoding多次解码防护
+
+1. 浏览器输入：
+```
+http://centos.arcadia-finance.io/three_decodin%2525252567.html
+```
+2. 请求被NAP告警，告警信息及support ID: 302917768469183137：
+
+![OWASP-Top-10-多次解码](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/OWASP-Top-10-%E5%A4%9A%E6%AC%A1%E8%A7%A3%E7%A0%81.png)
+
+3. 攻击防护相关log信息：
+
+```json
+{
+  "_index": "waf-logs-2021.10.10",
+  "_type": "_doc",
+  "_id": "TEX3aHwBMIwAeeuRSXur",
+  "_version": 1,
+  "_score": null,
+  "_source": {
+    "request_status": "alerted",
+    "severity": 2,
+    "bot_category": "Non-BOT",
+    "violation_details": "<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000000c00-3a03030c30000072</block><alarm>577f0ffcb9d0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>7</viol_index><viol_name>VIOL_EVASION</viol_name><context>uri</context><evasions><buffer>L3RocmVlX2RlY29kaW4lMjUyNTI1MjU2OC5odG1s</buffer><offset>14</offset><length>7</length><blocking_mask>16</blocking_mask></evasions></violation></request-violations></BAD_MSG>",
+    "uri": "/three_decodin%2568.html",
+    "bot_signature_name": "N/A",
+    "violations": [
+      "Evasion technique detected"
+    ],
+    "ip_client": "10.1.1.13",
+    "src_port": "55122",
+    "message": "ASM:attack_type=\"Detection Evasion\",blocking_exception_reason=\"N/A\",date_time=\"2021-10-10 06:50:08\",dest_port=\"80\",ip_client=\"10.1.1.13\",is_truncated=\"false\",method=\"GET\",policy_name=\"app_protect_default_policy\",protocol=\"HTTP\",request_status=\"alerted\",response_code=\"404\",severity=\"Critical\",sig_cves=\"N/A\",sig_ids=\"N/A\",sig_names=\"N/A\",sig_set_names=\"N/A\",src_port=\"55122\",sub_violations=\"Evasion technique detected:Multiple decoding\",support_id=\"302917768469183137\",threat_campaign_names=\"N/A\",unit_hostname=\"c68206ac-6bd7-49d0-ad95-d7b1ccb15787\",uri=\"/three_decodin%2568.html\",violation_rating=\"2\",vs_name=\"26-localhost:1-/\",x_forwarded_for_header_value=\"N/A\",outcome=\"PASSED\",outcome_reason=\"SECURITY_WAF_FLAGGED\",violations=\"Evasion technique detected\",violation_details=\"<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>10000000000c00-3a03030c30000072</block><alarm>577f0ffcb9d0fea-befbf35cb000007e</alarm><learn>0-0</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>7</viol_index><viol_name>VIOL_EVASION</viol_name><context>uri</context><evasions><buffer>L3RocmVlX2RlY29kaW4lMjUyNTI1MjU2OC5odG1s</buffer><offset>14</offset><length>7</length><blocking_mask>16</blocking_mask></evasions></violation></request-violations></BAD_MSG>\",bot_signature_name=\"N/A\",bot_category=\"N/A\",bot_anomalies=\"N/A\",enforced_bot_anomalies=\"N/A\",client_class=\"Browser\",client_application=\"FireFox\",client_application_version=\"94\",request=\"GET /three_decodin%2525252568.html HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nCookie: PHPSESSID=9pucfgkfrtk71i9dvmo072jokn\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n\",transport_protocol=\"HTTP/1.1\"\r\n",
+    "sig_set_names": [
+      "N/A"
+    ],
+    "priority": 130,
+    "timestamp": "Oct 10 06:50:09",
+    "sig_cves": [
+      "N/A"
+    ],
+    "x_forwarded_for_header_value": "N/A",
+    "source_host": "10.1.1.13",
+    "request": "GET /three_decodin%2525252568.html HTTP/1.1\\r\\nHost: centos.arcadia-finance.io\\r\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nConnection: keep-alive\\r\\nCookie: PHPSESSID=9pucfgkfrtk71i9dvmo072jokn\\r\\nUpgrade-Insecure-Requests: 1\\r\\n\\r\\n",
+    "violation_rating": "2",
+    "geoip": {},
+    "unit_hostname": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "dest_port": "80",
+    "outcome_reason": "SECURITY_WAF_FLAGGED",
+    "tags": [
+      "waf",
+      "_geoip_lookup_failure"
+    ],
+    "host": "10.1.1.9",
+    "facility": 16,
+    "date_time": "2021-10-10 06:50:08",
+    "sub_violations": [
+      "Evasion technique detected:Multiple decoding"
+    ],
+    "logsource": "c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+    "facility_label": "local0",
+    "blocking_exception_reason": "N/A",
+    "@timestamp": "2021-10-10T06:50:09.000Z",
+    "severity_label": "Critical",
+    "is_truncated": "false",
+    "method": "GET",
+    "policy_name": "app_protect_default_policy",
+    "client_class": "Browser",
+    "protocol": "HTTP",
+    "support_id": "302917768469183137",
+    "@version": "1",
+    "sig_ids": [
+      "N/A"
+    ],
+    "vs_name": "26-localhost:1-/",
+    "outcome": "PASSED",
+    "bot_anomalies": [
+      "N/A"
+    ],
+    "response_code": "404",
+    "sig_names": [
+      "N/A"
+    ]
+  },
+  "fields": {
+    "@timestamp": [
+      "2021-10-10T06:50:09.000Z"
+    ]
+  },
+  "sort": [
+    1633848609000
+  ]
+}
+```
+
+---
+本章节Lab主要介绍了NAP对OWASP Top 10常见攻击的防护，大家可以多测试不同的攻击策略以及调整NAP的防护策略。🍺
+---
+
+
+
+
+
+
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/README.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/README.md"
new file mode 100644
index 0000000000000000000000000000000000000000..07676877edb2161111ae31f70efa9cc64464f8e7
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/README.md"	
@@ -0,0 +1,12 @@
+# 本章节Lab实验简介
+
+## Lab顺序
+
+### Step-1：NAP部署
+
+### Step-2：OWASP Top 10测试
+
+---
+注：
+- NAP部署手册请参考《1-README_NAP_Deployment.md》
+- OWASP Top 10测试手册请参考《1-README_OWASP Top 10.md》
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/nginx.conf" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/nginx.conf"
new file mode 100644
index 0000000000000000000000000000000000000000..6f04469a51a0b728579b6e5ccede9b8858f63132
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/nginx.conf"	
@@ -0,0 +1,82 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+
+# load the app protect module
+load_module modules/ngx_http_app_protect_module.so;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include          /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    # note that in the dockerfile, the logs are redirected to stdout and can be viewed with `docker logs`
+    access_log  /var/log/nginx/access.log  main;
+
+    server {
+        listen       80;
+        server_name  localhost;
+        proxy_http_version 1.1;
+        proxy_cache_bypass  $http_upgrade;
+
+        proxy_set_header Host $host;
+
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_ignore_client_abort on;
+
+        app_protect_enable on;
+        app_protect_security_log_enable on;
+        # send the logs to the logstash instance on our ELK stack.
+        app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.1.11:5144;
+
+        # main service
+        location / {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
+        }
+
+        # backend service
+        location /files {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30584$request_uri;
+        }
+
+        # app2 service
+        location /api {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30586$request_uri;
+        }
+
+        # app2 service
+        location /app3 {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30587$request_uri;
+        }
+    }
+}
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/nginx_owasp_top10.conf" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/nginx_owasp_top10.conf"
new file mode 100644
index 0000000000000000000000000000000000000000..d712ba7f8bde0fadb121541e1628dfaaf182dca9
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/nginx_owasp_top10.conf"	
@@ -0,0 +1,83 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+
+# load the app protect module
+load_module modules/ngx_http_app_protect_module.so;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include          /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    # note that in the dockerfile, the logs are redirected to stdout and can be viewed with `docker logs`
+    access_log  /var/log/nginx/access.log  main;
+
+    server {
+        listen       80;
+        server_name  localhost;
+        proxy_http_version 1.1;
+        proxy_cache_bypass  $http_upgrade;
+
+        proxy_set_header Host $host;
+
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_ignore_client_abort on;
+
+        app_protect_enable on;
+        app_protect_security_log_enable on;
+        app_protect_policy_file "/etc/nginx/policy_owasp_top10.json";
+        # send the logs to the logstash instance on our ELK stack.
+        app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.1.11:5144;
+
+        # main service
+        location / {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
+        }
+
+        # backend service
+        location /files {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30584$request_uri;
+        }
+
+        # app2 service
+        location /api {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30586$request_uri;
+        }
+
+        # app2 service
+        location /app3 {
+            resolver 10.1.1.8:5353;
+            resolver_timeout 5s;
+            client_max_body_size 0;
+            default_type text/html;
+            proxy_pass http://k8s.arcadia-finance.io:30587$request_uri;
+        }
+    }
+}
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/policy_owasp_top10.json" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/policy_owasp_top10.json"
new file mode 100644
index 0000000000000000000000000000000000000000..bcf8ec057c4a262ca010325d79a262d2caa2e11d
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-1-OWASP Top 10\351\230\262\346\212\244/policy_owasp_top10.json"	
@@ -0,0 +1,86 @@
+{
+	"policy": {
+	    "name": "Complete_OWASP_Top_Ten",
+	    "description": "A generic, OWASP Top 10 protection items v1.0",
+	    "template": {
+	    "name": "POLICY_TEMPLATE_NGINX_BASE"
+	    },
+	    "enforcementMode":"blocking",
+	    "signature-settings":{
+		"signatureStaging": false,
+		"minimumAccuracyForAutoAddedSignatures": "high"
+	    },
+	    "caseInsensitive": true,
+	    "general": {
+	    "trustXff": true
+	    },
+	    "data-guard": {
+	    "enabled": true
+	    },
+	    "blocking-settings": {
+	    "violations": [
+		{
+		"alarm": true,
+		"block": true,
+		"description": "Modified NAP cookie",
+		"name": "VIOL_ASM_COOKIE_MODIFIED"
+		},
+		{
+		"alarm": true,
+		"block": true,
+		"description": "XML data does not comply with format settings",
+		"name": "VIOL_XML_FORMAT"
+		},
+		{
+		"name": "VIOL_FILETYPE",
+		"alarm": true,
+		"block": true
+		}
+	    ],
+	    "evasions": [
+		{
+		"description": "Bad unescape",
+		"enabled": true
+		},
+		{
+		"description": "Apache whitespace",
+		"enabled": true
+		},
+		{
+		"description": "Bare byte decoding",
+		"enabled": true
+		},
+		{
+		"description": "IIS Unicode codepoints",
+		"enabled": true
+		},
+		{
+		"description": "IIS backslashes",
+		"enabled": true
+		},
+		{
+		"description": "%u decoding",
+		"enabled": true
+		},
+		{
+		"description": "Multiple decoding",
+		"enabled": true,
+		"maxDecodingPasses": 3
+		},
+		{
+		"description": "Directory traversals",
+		"enabled": true
+		}
+	    ]
+	    },
+	    "xml-profiles": [
+	    {
+		"name": "Default",
+		"defenseAttributes": {
+		"allowDTDs": false,
+		"allowExternalReferences": false
+		}
+	    }
+	    ]
+	}
+}
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/.keep" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/.keep"
deleted file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/Arcadia API.postman_collection.json" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/Arcadia API.postman_collection.json"
new file mode 100644
index 0000000000000000000000000000000000000000..b432770478f7245dfe8f4dd9631c227ff7b4a3a4
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/Arcadia API.postman_collection.json"	
@@ -0,0 +1,213 @@
+{
+	"info": {
+		"_postman_id": "a3d3b734-6de2-45f7-9286-166d1a7afca5",
+		"name": "Arcadia API",
+		"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
+	},
+	"item": [
+		{
+			"name": "Last Transactions",
+			"request": {
+				"auth": {
+					"type": "noauth"
+				},
+				"method": "GET",
+				"header": [],
+				"url": {
+					"raw": "https://api.arcadia-finance.io/trading/transactions.php",
+					"protocol": "https",
+					"host": [
+						"api",
+						"arcadia-finance",
+						"io"
+					],
+					"path": [
+						"trading",
+						"transactions.php"
+					]
+				}
+			},
+			"response": []
+		},
+		{
+			"name": "POST Buy Stocks",
+			"request": {
+				"auth": {
+					"type": "noauth"
+				},
+				"method": "POST",
+				"header": [
+					{
+						"key": "Content-Type",
+						"value": "application/json",
+						"type": "text"
+					}
+				],
+				"body": {
+					"mode": "raw",
+					"raw": "{\r\n\t\"trans_value\":12,\r\n\t\"qty\":16,\r\n\t\"company\":\"MSFT\",\r\n\t\"action\":\"buy\",\r\n\t\"stock_price\":198\r\n}"
+				},
+				"url": {
+					"raw": "http://app-protect-centos.arcadia-finance.io/trading/rest/buy_stocks.php",
+					"protocol": "http",
+					"host": [
+						"app-protect-centos",
+						"arcadia-finance",
+						"io"
+					],
+					"path": [
+						"trading",
+						"rest",
+						"buy_stocks.php"
+					]
+				}
+			},
+			"response": []
+		},
+		{
+			"name": "POST Sell Stocks",
+			"request": {
+				"auth": {
+					"type": "noauth"
+				},
+				"method": "POST",
+				"header": [
+					{
+						"key": "Content-Type",
+						"value": "application/json",
+						"type": "text"
+					}
+				],
+				"body": {
+					"mode": "raw",
+					"raw": "{\r\n\t\"trans_value\":212,\r\n\t\"qty\":16,\r\n\t\"company\":\"MSFT\",\r\n\t\"action\":\"sell\",\r\n\t\"stock_price\":158\r\n}"
+				},
+				"url": {
+					"raw": "http://app-protect-centos.arcadia-finance.io/trading/rest/sell_stocks.php",
+					"protocol": "http",
+					"host": [
+						"app-protect-centos",
+						"arcadia-finance",
+						"io"
+					],
+					"path": [
+						"trading",
+						"rest",
+						"sell_stocks.php"
+					]
+				}
+			},
+			"response": []
+		},
+		{
+			"name": "POST Transfert Money",
+			"request": {
+				"auth": {
+					"type": "noauth"
+				},
+				"method": "POST",
+				"header": [
+					{
+						"key": "Content-Type",
+						"value": "application/json",
+						"type": "text"
+					}
+				],
+				"body": {
+					"mode": "raw",
+					"raw": "{\r\n    \"amount\":92,\r\n    \"account\":2075894,\r\n    \"currency\":\"GBP\",\r\n    \"friend\":\"Vincent\"\r\n}",
+					"options": {
+						"raw": {
+							"language": "javascript"
+						}
+					}
+				},
+				"url": {
+					"raw": "http://app-protect-centos.arcadia-finance.io/api/rest/execute_money_transfer.php",
+					"protocol": "http",
+					"host": [
+						"app-protect-centos",
+						"arcadia-finance",
+						"io"
+					],
+					"path": [
+						"api",
+						"rest",
+						"execute_money_transfer.php"
+					]
+				}
+			},
+			"response": []
+		},
+		{
+			"name": "POST Buy Stocks XSS attack",
+			"request": {
+				"auth": {
+					"type": "noauth"
+				},
+				"method": "POST",
+				"header": [
+					{
+						"key": "Content-Type",
+						"value": "application/json",
+						"type": "text"
+					}
+				],
+				"body": {
+					"mode": "raw",
+					"raw": "{\r\n\t\"trans_value\":66,\r\n\t\"qty\":4,\r\n\t\"company\":\"MSFT\",\r\n\t\"action\":\"test<script>alert(document.cookie)</script>\",\r\n\t\"stock_price\":198\r\n}"
+				},
+				"url": {
+					"raw": "http://app-protect-centos.arcadia-finance.io/trading/rest/buy_stocks.php",
+					"protocol": "http",
+					"host": [
+						"app-protect-centos",
+						"arcadia-finance",
+						"io"
+					],
+					"path": [
+						"trading",
+						"rest",
+						"buy_stocks.php"
+					]
+				}
+			},
+			"response": []
+		},
+		{
+			"name": "POST Transfert Money Attack",
+			"request": {
+				"auth": {
+					"type": "noauth"
+				},
+				"method": "POST",
+				"header": [
+					{
+						"key": "Content-Type",
+						"value": "application/json",
+						"type": "text"
+					}
+				],
+				"body": {
+					"mode": "raw",
+					"raw": "{\r\n    \"amount\":\"12\",\r\n    \"account\":\"<script>\",\r\n    \"currency\":\"GBP\",\r\n    \"friend\":\"Bart\"\r\n}"
+				},
+				"url": {
+					"raw": "http://app-protect-centos.arcadia-finance.io/api/rest/execute_money_transfer.php",
+					"protocol": "http",
+					"host": [
+						"app-protect-centos",
+						"arcadia-finance",
+						"io"
+					],
+					"path": [
+						"api",
+						"rest",
+						"execute_money_transfer.php"
+					]
+				}
+			},
+			"response": []
+		}
+	]
+}
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/NginxApiSecurityPolicy.json" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/NginxApiSecurityPolicy.json"
new file mode 100644
index 0000000000000000000000000000000000000000..e5fa4eb3edd33bf67dc5471dc645dae89e053bda
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/NginxApiSecurityPolicy.json"	
@@ -0,0 +1,124 @@
+{
+	"policy" : {
+	   "name" : "app_protect_api_security_policy",
+	   "description" : "NGINX App Protect API Security Policy. The policy is intended to be used with an OpenAPI file",
+	   "template": {
+	     "name": "POLICY_TEMPLATE_NGINX_BASE"
+	   },
+     
+	   "open-api-files" : [
+		   {
+			"link": "https://api.swaggerhub.com/apis/F5EMEASSA/Arcadia-OAS3/2.0.1-schema/swagger.json"
+		   }
+	   ],
+     
+	   "enforcer-settings" : {
+	      "enforcerStateCookies" : {
+		 "secureAttribute" : "always"
+	      }
+	   },
+	   "blocking-settings" : {
+	      "violations" : [
+		 {
+		    "block" : true,
+		    "description" : "Mandatory request body is missing",
+		    "name" : "VIOL_MANDATORY_REQUEST_BODY"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter location",
+		    "name" : "VIOL_PARAMETER_LOCATION"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Mandatory parameter is missing",
+		    "name" : "VIOL_MANDATORY_PARAMETER"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "JSON data does not comply with JSON schema",
+		    "name" : "VIOL_JSON_SCHEMA"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter array value",
+		    "name" : "VIOL_PARAMETER_ARRAY_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal Base64 value",
+		    "name" : "VIOL_PARAMETER_VALUE_BASE64"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal request content type",
+		    "name" : "VIOL_URL_CONTENT_TYPE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal static parameter value",
+		    "name" : "VIOL_PARAMETER_STATIC_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter value length",
+		    "name" : "VIOL_PARAMETER_VALUE_LENGTH"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter data type",
+		    "name" : "VIOL_PARAMETER_DATA_TYPE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter numeric value",
+		    "name" : "VIOL_PARAMETER_NUMERIC_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Parameter value does not comply with regular expression",
+		    "name" : "VIOL_PARAMETER_VALUE_REGEXP"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal URL",
+		    "name" : "VIOL_URL"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter",
+		    "name" : "VIOL_PARAMETER"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal empty parameter value",
+		    "name" : "VIOL_PARAMETER_EMPTY_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal repeated parameter name",
+		    "name" : "VIOL_PARAMETER_REPEATED"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal method",
+		    "name" : "VIOL_METHOD"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal gRPC method",
+		    "name" : "VIOL_GRPC_METHOD"
+		 }
+	      ]
+	   },
+     
+	   "xml-profiles" : [
+	      {
+		 "name" : "Default",
+		 "defenseAttributes" : {
+		     "maximumNameLength" : 1024
+		 }
+	      }
+	   ]
+	}
+}
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/README.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/README.md"
new file mode 100644
index 0000000000000000000000000000000000000000..a9da04818eeb1b90bc306be6ecee9fc0de0751e6
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/README.md"	
@@ -0,0 +1,390 @@
+# API安全防护
+
+如今，App爆发式增长，而且很多金融机构或者互联网企业都在大力发展其API经济，所以API无处不在。
+
+近年来，无数安全事件或者很多重大信息安全泄露事件都有API息息相关，因此，本章节介绍NAP如何对API进行防护。
+
+可以通过OpenAPI配置文件来构建NAP的防护策略。
+
+## Arcadia API环境说明
+如已有API Server环境也可以选择自己的环境。
+
+1. 相关工具
+- Arcadia OAS3文件：https://app.swaggerhub.com/apis/F5EMEASSA/Arcadia-OAS3/2.0.1-schema
+- Postman （所需配置文件集Arcadia API.postman_collection.json）
+
+
+2. Lab环境所需yaml配置文件:
+```
+NginxApiSecurityPolicy.json
+nginx.conf
+log_default.json
+
+```
+
+
+## 配置步骤
+
+1. SSH命令行登陆CentOS
+
+2. 切换目录
+
+```bash
+cd /etc/nginx
+```
+
+
+3. 导入NginxApiSecurityPolicy.json配置文件
+
+NAP的防护配置中已经调用了OpenAPI的swagger文件：https://api.swaggerhub.com/apis/F5EMEASSA/Arcadia-OAS3/2.0.1-schema/swagger.json
+
+NginxApiSecurityPolicy.json配置文件如下：
+
+
+```json
+{
+	"policy" : {
+	   "name" : "app_protect_api_security_policy",
+	   "description" : "NGINX App Protect API Security Policy. The policy is intended to be used with an OpenAPI file",
+	   "template": {
+	     "name": "POLICY_TEMPLATE_NGINX_BASE"
+	   },
+     
+	   "open-api-files" : [
+		   {
+			"link": "https://api.swaggerhub.com/apis/F5EMEASSA/Arcadia-OAS3/2.0.1-schema/swagger.json"
+		   }
+	   ],
+     
+	   "enforcer-settings" : {
+	      "enforcerStateCookies" : {
+		 "secureAttribute" : "always"
+	      }
+	   },
+	   "blocking-settings" : {
+	      "violations" : [
+		 {
+		    "block" : true,
+		    "description" : "Mandatory request body is missing",
+		    "name" : "VIOL_MANDATORY_REQUEST_BODY"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter location",
+		    "name" : "VIOL_PARAMETER_LOCATION"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Mandatory parameter is missing",
+		    "name" : "VIOL_MANDATORY_PARAMETER"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "JSON data does not comply with JSON schema",
+		    "name" : "VIOL_JSON_SCHEMA"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter array value",
+		    "name" : "VIOL_PARAMETER_ARRAY_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal Base64 value",
+		    "name" : "VIOL_PARAMETER_VALUE_BASE64"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal request content type",
+		    "name" : "VIOL_URL_CONTENT_TYPE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal static parameter value",
+		    "name" : "VIOL_PARAMETER_STATIC_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter value length",
+		    "name" : "VIOL_PARAMETER_VALUE_LENGTH"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter data type",
+		    "name" : "VIOL_PARAMETER_DATA_TYPE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter numeric value",
+		    "name" : "VIOL_PARAMETER_NUMERIC_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Parameter value does not comply with regular expression",
+		    "name" : "VIOL_PARAMETER_VALUE_REGEXP"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal URL",
+		    "name" : "VIOL_URL"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal parameter",
+		    "name" : "VIOL_PARAMETER"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal empty parameter value",
+		    "name" : "VIOL_PARAMETER_EMPTY_VALUE"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal repeated parameter name",
+		    "name" : "VIOL_PARAMETER_REPEATED"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal method",
+		    "name" : "VIOL_METHOD"
+		 },
+		 {
+		    "block" : true,
+		    "description" : "Illegal gRPC method",
+		    "name" : "VIOL_GRPC_METHOD"
+		 }
+	      ]
+	   },
+     
+	   "xml-profiles" : [
+	      {
+		 "name" : "Default",
+		 "defenseAttributes" : {
+		     "maximumNameLength" : 1024
+		 }
+	      }
+	   ]
+	}
+}
+```
+
+4. 导入nginx.conf配置文件
+
+在nginx的配置文件中的NAP防护策略文件中调用：NginxApiSecurityPolicy.json
+
+nginx.conf配置文件如下：
+
+```nginx
+  user  nginx;
+  worker_processes  auto;
+
+  error_log  /var/log/nginx/error.log notice;
+  pid        /var/run/nginx.pid;
+
+  load_module modules/ngx_http_app_protect_module.so;
+
+  events {
+      worker_connections 1024;
+  }
+
+  http {
+      include          /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+      sendfile        on;
+      keepalive_timeout  65;
+
+      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+      access_log  /var/log/nginx/access.log  main;
+
+      server {
+          listen 80;
+          server_name localhost;
+          proxy_http_version 1.1;
+
+          app_protect_enable on;
+          app_protect_policy_file "/etc/nginx/NginxApiSecurityPolicy.json";
+          app_protect_security_log_enable on;
+          # app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.20.11:5144;
+	  app_protect_security_log "/etc/app_protect/conf/log_default.json" /var/log/nginx/access.log;
+
+          location / {
+              resolver 10.1.1.8:5353;
+              resolver_timeout 5s;
+              client_max_body_size 0;
+              default_type text/html;
+              proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
+          }
+      }
+  }
+``` 
+
+
+5. 重启nginx服务
+
+```bash
+sudo systemctl restart nginx
+```
+
+6. 确认nginx服务正常运行
+
+```bash
+sudo systemctl status nginx
+```
+
+确保nginx的服务已经active。
+
+---
+
+
+## 测试验证步骤
+
+### 正常API请求可以执行成功
+
+1. 使用Postman，导入Arcadia API.postman_collection.json配置文件集，打开Arcadia API
+
+2. 发送Last Transaction的API call
+
+可以发现这是一个GET请求，如图：
+
+![Postman-1-Last_Transactions](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Postman-1-Last_Transactions.png)
+
+检查API请求日志：
+```bash
+tail -f /var/log/nginx/access.log 
+```
+
+```
+10.1.1.13 - - [10/Oct/2021:12:32:10 +0000] "GET /trading/transactions.php HTTP/1.1" 200 392 "-" "PostmanRuntime/7.28.4" "-"
+```
+---
+
+2. POST发送Buy Stocks的API call
+
+![Postman-1-POST_Buy_Stocks](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Postman-1-POST_Buy_Stocks.png)
+
+检查API请求日志：
+
+```
+10.1.1.13 - - [10/Oct/2021:12:35:59 +0000] "POST /trading/rest/buy_stocks.php HTTP/1.1" 200 99 "-" "PostmanRuntime/7.28.4" "-"
+```
+---
+
+3. POST发送Sell Stocks的API call
+
+![Postman-1-POST_Sell_Stocks](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Postman-1-POST_Sell_Stocks.png)
+
+检查API请求日志：
+
+```
+10.1.1.13 - - [10/Oct/2021:12:41:05 +0000] "POST /trading/rest/sell_stocks.php HTTP/1.1" 200 100 "-" "PostmanRuntime/7.28.4" "-"
+```
+---
+
+### 异常API请求被阻断
+
+5. POST发送Buy Stocks的API call的同时增加跨站脚本XXS攻击
+
+![Postman-1-POST_Buy_Stocks_XSS](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Postman-1-POST_Buy_Stocks_XSS.png)
+
+检查API请求被阻断的日志：
+
+```json
+
+attack_type="Non-browser Client,Abuse of Functionality,Cross Site Scripting (XSS)",
+blocking_exception_reason="N/A",
+date_time="2021-10-10 13:10:57",
+dest_port="80",
+ip_client="10.1.1.13",
+is_truncated="false",
+method="POST",
+policy_name="app_protect_api_security_policy",
+protocol="HTTP",
+request_status="blocked",
+response_code="0",
+severity="Critical",
+sig_cves="N/A",
+sig_ids="200001475,200000098,200001088,200000157",
+sig_names="XSS script tag end (Parameter) (2),XSS script tag (Parameter),alert() (Parameter)...",
+sig_set_names="{Cross Site Scripting Signatures;High Accuracy Signatures},{Cross Site Scripting Signatures;High Accuracy Signatures},{Cross Site Scripting Signatures}...",
+src_port="50020",
+sub_violations="N/A",
+support_id="609722702720363299",
+threat_campaign_names="N/A",
+unit_hostname="c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+uri="/trading/rest/buy_stocks.php",
+violation_rating="5",
+vs_name="25-localhost:1-/",
+x_forwarded_for_header_value="N/A",
+outcome="REJECTED",
+outcome_reason="SECURITY_WAF_VIOLATION",
+violations="Illegal meta character in value,Attack signature detected,Violation Rating Threat detected,Bot Client Detected",
+violation_details="<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>100010cabd0c42-3a03f31c30000076</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-20</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>URL</context><object_data><object>L3RyYWRpbmcvcmVzdC9idXlfc3RvY2tzLnBocA==</object></object_data><staging>0</staging><content_profile_data><type>JSON</type><content_id>3</content_id><content_profile_id>12</content_profile_id><content_profile_name>json_POST_~trading~rest~buy_stocks.php</content_profile_name><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><location>element value</location></content_profile_data><sig_data><sig_id>200001475</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><offset>5</offset><length>7</length></kw_data></sig_data><sig_data><sig_id>200000098</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><offset>4</offset><length>7</length></kw_data></sig_data><sig_data><sig_id>200001088</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><offset>12</offset><length>6</length></kw_data></sig_data><sig_data><sig_id>200000157</sig_id><blocking_mask>2</blocking_mask><kw_data><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><offset>18</offset><length>15</length></kw_data></sig_data></violation><violation><viol_index>24</viol_index><viol_name>VIOL_PARAMETER_VALUE_METACHAR</viol_name><context>URL</context><object_data><object>L3RyYWRpbmcvcmVzdC9idXlfc3RvY2tzLnBocA==</object></object_data><staging>0</staging><content_profile_data><type>JSON</type><content_id>3</content_id><content_profile_id>12</content_profile_id><content_profile_name>json_POST_~trading~rest~buy_stocks.php</content_profile_name><location>element value</location></content_profile_data><violation_data><element><type>value</type><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><metachar_index>60</metachar_index></element><element><type>value</type><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><metachar_index>62</metachar_index></element><element><type>value</type><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><metachar_index>40</metachar_index></element><element><type>value</type><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><metachar_index>41</metachar_index></element><element><type>value</type><buffer>dGVzdDxzY3JpcHQ+YWxlcnQoZG9jdW1lbnQuY29va2llKTwvc2NyaXB0Pg==</buffer><metachar_index>47</metachar_index></element></violation_data></violation></request-violations></BAD_MSG>",
+bot_signature_name="Postman",
+bot_category="HTTP Library",
+bot_anomalies="N/A",
+enforced_bot_anomalies="N/A",
+client_class="Untrusted Bot",
+client_application="N/A",
+client_application_version="N/A",
+request="POST /trading/rest/buy_stocks.php HTTP/1.1\r\nContent-Type: application/json\r\nUser-Agent: PostmanRuntime/7.28.4\r\nAccept: */*\r\nPostman-Token: aa5289c8-e3d4-4c1d-ac63-73638d5aa6cc\r\nHost: app-protect-centos.arcadia-finance.io\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: keep-alive\r\nContent-Length: 133\r\n\r\n{\r\n	""trans_value"":66,\r\n	""qty"":4,\r\n	""company"":""MSFT"",\r\n	""action"":""test<script>alert(document.cookie)</script>"",\r\n	""stock_price"":198\r\n}",
+transport_protocol="HTTP/1.1"
+
+```
+---
+
+6. POST发送Transfer Money的API call的同时增加攻击
+
+![Postman-1-POST_Transfer_Money_XSS](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Postman-1-POST_Transfer_Money_XSS.png)
+
+检查API请求被阻断的日志：
+
+```json
+
+attack_type="Non-browser Client,Abuse of Functionality,Cross Site Scripting (XSS)",
+blocking_exception_reason="N/A",
+date_time="2021-10-10 13:23:00",
+dest_port="80",
+ip_client="10.1.1.13",
+is_truncated="false",
+method="POST",
+policy_name="app_protect_api_security_policy",
+protocol="HTTP",
+request_status="blocked",
+response_code="0",
+severity="Critical",
+sig_cves="N/A",
+sig_ids="200001475,200000098",
+sig_names="XSS script tag end (Parameter) (2),XSS script tag (Parameter)",
+sig_set_names="{Cross Site Scripting Signatures;High Accuracy Signatures},{Cross Site Scripting Signatures;High Accuracy Signatures}",
+src_port="56874",
+sub_violations="N/A",
+support_id="609722702720363809",
+threat_campaign_names="N/A",
+unit_hostname="c68206ac-6bd7-49d0-ad95-d7b1ccb15787",
+uri="/api/rest/execute_money_transfer.php",
+violation_rating="5",
+vs_name="25-localhost:1-/",
+x_forwarded_for_header_value="N/A",
+outcome="REJECTED",
+outcome_reason="SECURITY_WAF_VIOLATION",
+violations="Illegal meta character in value,Attack signature detected,JSON data does not comply with JSON schema,Violation Rating Threat detected,Bot Client Detected",
+violation_details="<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>100010cabd0c42-3a03f31c30000076</block><alarm>477f0ffcbbd0fea-befbf35cb000007e</alarm><learn>0-20</learn><staging>0-0</staging></violation_masks><request-violations><violation><viol_index>42</viol_index><viol_name>VIOL_ATTACK_SIGNATURE</viol_name><context>URL</context><object_data><object>L2FwaS9yZXN0L2V4ZWN1dGVfbW9uZXlfdHJhbnNmZXIucGhw</object></object_data><staging>0</staging><content_profile_data><type>JSON</type><content_id>2</content_id><content_profile_id>10</content_profile_id><content_profile_name>json_POST_~api~rest~execute_money_transfer.php</content_profile_name><buffer>PHNjcmlwdD4=</buffer><location>element value</location></content_profile_data><sig_data><sig_id>200001475</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>PHNjcmlwdD4=</buffer><offset>1</offset><length>7</length></kw_data></sig_data><sig_data><sig_id>200000098</sig_id><blocking_mask>3</blocking_mask><kw_data><buffer>PHNjcmlwdD4=</buffer><offset>0</offset><length>7</length></kw_data></sig_data></violation><violation><viol_index>24</viol_index><viol_name>VIOL_PARAMETER_VALUE_METACHAR</viol_name><context>URL</context><object_data><object>L2FwaS9yZXN0L2V4ZWN1dGVfbW9uZXlfdHJhbnNmZXIucGhw</object></object_data><staging>0</staging><content_profile_data><type>JSON</type><content_id>2</content_id><content_profile_id>10</content_profile_id><content_profile_name>json_POST_~api~rest~execute_money_transfer.php</content_profile_name><location>element value</location></content_profile_data><violation_data><element><type>value</type><buffer>PHNjcmlwdD4=</buffer><metachar_index>60</metachar_index></element><element><type>value</type><buffer>PHNjcmlwdD4=</buffer><metachar_index>62</metachar_index></element></violation_data></violation><violation><viol_index>81</viol_index><viol_name>VIOL_JSON_SCHEMA</viol_name><context>URL</context><object_data><object>L2FwaS9yZXN0L2V4ZWN1dGVfbW9uZXlfdHJhbnNmZXIucGhw</object></object_data><staging>0</staging><content_profile_data><type>JSON</type><content_id>2</content_id><content_profile_id>10</content_profile_id><content_profile_name>json_POST_~api~rest~execute_money_transfer.php</content_profile_name><location>element value</location></content_profile_data><json_error><tag>$.amount</tag><error>Type Violation</error><received_str>string</received_str><expected_str>integer</expected_str></json_error><json_error><tag>$.account</tag><error>Type Violation</error><received_str>string</received_str><expected_str>integer</expected_str></json_error></violation></request-violations></BAD_MSG>",
+bot_signature_name="Postman",
+bot_category="HTTP Library",
+bot_anomalies="N/A",
+enforced_bot_anomalies="N/A",
+client_class="Untrusted Bot",
+client_application="N/A",
+client_application_version="N/A",
+request="POST /api/rest/execute_money_transfer.php HTTP/1.1\r\nContent-Type: application/json\r\nUser-Agent: PostmanRuntime/7.28.4\r\nAccept: */*\r\nPostman-Token: 31b0c3db-1dd2-4872-a7da-8874037ad7ec\r\nHost: app-protect-centos.arcadia-finance.io\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: keep-alive\r\nContent-Length: 95\r\n\r\n{\r\n    ""amount"":""12"",\r\n    ""account"":""<script>"",\r\n    ""currency"":""GBP"",\r\n    ""friend"":""Bart""\r\n}",
+transport_protocol="HTTP/1.1"
+
+```
+
+---
+
+本章节Lab主要介绍了NAP对API攻击的防护，大家可以使用不同的OpenAPI文件测试。🍺
+---
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/nginx.conf" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/nginx.conf"
deleted file mode 100644
index 5d33ec360a0f1ca790f7ef8849847cc14904dd61..0000000000000000000000000000000000000000
--- "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/nginx.conf"	
+++ /dev/null
@@ -1,48 +0,0 @@
-        user nginx;
-
-        worker_processes 1;
-        load_module modules/ngx_http_app_protect_module.so;
-
-        error_log /var/log/nginx/error.log debug;
-
-        events {
-            worker_connections  1024;
-        }
-
-        http {
-            include       /etc/nginx/mime.types;
-            default_type  application/octet-stream;
-            sendfile        on;
-            keepalive_timeout  65;
-
-        proxy_http_version 1.1;
-        proxy_cache_bypass  $http_upgrade;
-
-        proxy_set_header Host "k8s.arcadia-finance.io";
-
-        proxy_set_header X-Forwarded-Server $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_ignore_client_abort on;
-
-            server {
-                listen       80;
-                server_name  localhost;
-                proxy_http_version 1.1;
-
-                app_protect_enable on;
-                app_protect_policy_file "/etc/nginx/policy_bots.json";
-                app_protect_security_log_enable on;
-                app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.1.11:5144;
-
-                location / {
-		    resolver 10.1.1.8:5353;
-                    resolver_timeout 5s;
-                    client_max_body_size 0;
-                    default_type text/html;
-                    proxy_pass http://k8s.arcadia-finance.io:30274$request_uri;
-                }
-            }
-        }
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/nginx_api.conf" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/nginx_api.conf"
new file mode 100644
index 0000000000000000000000000000000000000000..3baa6961ff0a3bf09d2c9b1f7953ead5bf3dbd07
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-2-API\345\256\211\345\205\250\351\230\262\346\212\244/nginx_api.conf"	
@@ -0,0 +1,44 @@
+  user  nginx;
+  worker_processes  auto;
+
+  error_log  /var/log/nginx/error.log notice;
+  pid        /var/run/nginx.pid;
+
+  load_module modules/ngx_http_app_protect_module.so;
+
+  events {
+      worker_connections 1024;
+  }
+
+  http {
+      include          /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+      sendfile        on;
+      keepalive_timeout  65;
+
+      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+      access_log  /var/log/nginx/access.log  main;
+
+      server {
+          listen 80;
+          server_name localhost;
+          proxy_http_version 1.1;
+
+          app_protect_enable on;
+          app_protect_policy_file "/etc/nginx/NginxApiSecurityPolicy.json";
+          app_protect_security_log_enable on;
+          # app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.20.11:5144;
+          app_protect_security_log "/etc/app_protect/conf/log_default.json" /var/log/nginx/access.log;
+
+          location / {
+              resolver 10.1.1.8:5353;
+              resolver_timeout 5s;
+              client_max_body_size 0;
+              default_type text/html;
+              proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
+          }
+      }
+  }
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/.keep" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/.keep"
deleted file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/README.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/README.md"
new file mode 100644
index 0000000000000000000000000000000000000000..90ce3199d18bdae1e11196efdd188292843ec690
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/README.md"	
@@ -0,0 +1,215 @@
+# Bot机器人防护
+
+Bot 签名特征会检测User-Agent标头和URI。
+
+可以为每个机器人类配置一个操作，也可以为每个机器人签名单独配置一个动作：
+
+- ignore：机器人签名特征被忽略（即禁用）
+- detected：只报告而不提出违规 - VIOL_BOT_CLIENT。除非触发另一次违规，否则该请求被认为是合法的。
+- alarm：报告，提出违规，但通过请求。该请求被标记为非法。
+- block：报告、提出违规并阻止请求
+
+
+## Arcadia API环境说明
+如已有API Server环境也可以选择自己的环境。
+
+1. 相关工具
+
+- Jmeter (所需配置文件：HTTP Request Bots.jmx，browserlist.txt，50k-bots.csv)
+
+##### 工具说明：
+
+
+2. Lab环境所需yaml配置文件:
+```
+policy_bots.json
+nginx.conf
+log_default.json
+
+```
+
+## 安装并更新威胁情报Threat Campaigns
+
+1. SSH命令行登陆CentOS
+
+2. 添加repo
+
+```bash
+sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-security-updates-7.repo
+```
+
+3. 安装威胁情报Threat Campaigns
+
+```bash
+sudo yum install app-protect-threat-campaigns
+```
+
+## 配置步骤
+
+1. SSH命令行登陆CentOS
+
+2. 切换目录
+
+```bash
+cd /etc/nginx
+```
+
+
+3. 导入policy_bots.json配置文件
+
+
+policy_bots.json配置文件如下：
+
+
+```json
+{
+	"policy": {
+	    "name": "bot_defense_policy",
+	    "template": {
+		"name": "POLICY_TEMPLATE_NGINX_BASE"
+	    },
+	    "applicationLanguage": "utf-8",
+	    "enforcementMode": "blocking",
+	    "bot-defense": {
+		"settings": {
+		    "isEnabled": true
+		},
+		"mitigations": {
+		    "classes": [
+			{
+			    "name": "trusted-bot",
+			    "action": "alarm"
+			},
+			{
+			    "name": "untrusted-bot",
+			    "action": "block"
+			},
+			{
+			    "name": "malicious-bot",
+			    "action": "block"
+			}
+		    ]
+		}
+	    }
+	}
+}
+```
+
+##### Bot策略说明：
+
+针对不同类型的Bot防护动作可以采用默认或者根据需要修改，也可以基于某个Bot特征单独进行动作的修改。
+
+默认动作是：
+
+- trusted-bot: detected
+- untrusted-bot: alarm
+- malicious-bot: block
+
+
+
+4. 导入或vi编辑nginx.conf配置文件
+
+在nginx的配置文件中的NAP防护策略文件中调用：policy_bots.json
+
+nginx.conf配置文件如下：
+
+```nginx
+  user  nginx;
+  worker_processes  auto;
+
+  error_log  /var/log/nginx/error.log notice;
+  pid        /var/run/nginx.pid;
+
+  load_module modules/ngx_http_app_protect_module.so;
+
+  events {
+      worker_connections 1024;
+  }
+
+  http {
+      include          /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+      sendfile        on;
+      keepalive_timeout  65;
+
+      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+      access_log  /var/log/nginx/access.log  main;
+
+      server {
+          listen 80;
+          server_name localhost;
+          proxy_http_version 1.1;
+
+          app_protect_enable on;
+          app_protect_policy_file "/etc/nginx/policy_bots.json";
+          app_protect_security_log_enable on;
+          app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.20.11:5144;
+          app_protect_security_log "/etc/app_protect/conf/log_default.json" /var/log/nginx/access.log;
+
+          location / {
+              resolver 10.1.1.8:5353;
+              resolver_timeout 5s;
+              client_max_body_size 0;
+              default_type text/html;
+              proxy_pass http://k8s.arcadia-finance.io:30274$request_uri;
+          }
+      }
+  }
+``` 
+
+
+5. 重启nginx服务
+
+```bash
+sudo systemctl restart nginx
+```
+
+6. 确认nginx服务正常运行
+
+```bash
+sudo systemctl status nginx
+```
+
+确保nginx的服务已经active。
+
+---
+
+
+## 测试验证步骤
+
+### 执行Bots请求测试
+
+1. 使用Jmeter，打开File -> Open -> HTTP Request Bots.jmx，如图：
+
+![Bots-HTTP_Request_Bots_jmx](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Bots-HTTP_Request_Bots_jmx.png)
+
+注：
+Jmeter会将模拟的公网恶意IP注入在HTTP的XFF字段中。
+
+---
+
+2. 发送大量Bots请求
+
+点击绿色按钮，如图：
+
+![Bots-jmeter_play](https://gitee.com/michaelwang19/reference/raw/master/Pictures/NGINX%20Training/Bots-jmeter_play.png)
+
+等待发送完成，大概需要几分钟...
+
+---
+
+3. 可以打开Thread Group，点击View Results Tree中查看所发送的每一个Bot请求。
+
+---
+
+4. 检查日志中详细的Bot检测防护日志。
+
+
+
+---
+
+本章节Lab主要介绍了NAP对Bots攻击的防护，大家可以使用不同的工具进行测试。🍺
+---
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/nginx_bot.conf" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/nginx_bot.conf"
new file mode 100644
index 0000000000000000000000000000000000000000..cdb6f5c2b814f7e07946ee4706053aa5cc9230a2
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/nginx_bot.conf"	
@@ -0,0 +1,44 @@
+  user  nginx;
+  worker_processes  auto;
+
+  error_log  /var/log/nginx/error.log notice;
+  pid        /var/run/nginx.pid;
+
+  load_module modules/ngx_http_app_protect_module.so;
+
+  events {
+      worker_connections 1024;
+  }
+
+  http {
+      include          /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+      sendfile        on;
+      keepalive_timeout  65;
+
+      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+      access_log  /var/log/nginx/access.log  main;
+
+      server {
+          listen 80;
+          server_name localhost;
+          proxy_http_version 1.1;
+
+          app_protect_enable on;
+          app_protect_policy_file "/etc/nginx/policy_bots.json";
+          app_protect_security_log_enable on;
+          app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.20.11:5144;
+          app_protect_security_log "/etc/app_protect/conf/log_default.json" /var/log/nginx/access.log;
+
+          location / {
+              resolver 10.1.1.8:5353;
+              resolver_timeout 5s;
+              client_max_body_size 0;
+              default_type text/html;
+              proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
+          }
+      }
+  }
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/policy_bots.json" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/policy_bots.json"
new file mode 100644
index 0000000000000000000000000000000000000000..2b1c8ac4749b561cbaa56bc2056645b11b98e0a1
--- /dev/null
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/Lab-3-Bots\346\234\272\345\231\250\344\272\272\351\230\262\346\212\244/policy_bots.json"	
@@ -0,0 +1,31 @@
+{
+	"policy": {
+	    "name": "bot_defense_policy",
+	    "template": {
+		"name": "POLICY_TEMPLATE_NGINX_BASE"
+	    },
+	    "applicationLanguage": "utf-8",
+	    "enforcementMode": "blocking",
+	    "bot-defense": {
+		"settings": {
+		    "isEnabled": true
+		},
+		"mitigations": {
+		    "classes": [
+			{
+			    "name": "trusted-bot",
+			    "action": "alarm"
+			},
+			{
+			    "name": "untrusted-bot",
+			    "action": "block"
+			},
+			{
+			    "name": "malicious-bot",
+			    "action": "block"
+			}
+		    ]
+		}
+	    }
+	}
+}
\ No newline at end of file
diff --git "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/README.md" "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/README.md"
index 12965b25b7fb239490c13ee597404be6cc79110e..a4993348c71b3bcac26c08405ed6c11bf9676277 100644
--- "a/11 NGINX Web\344\270\216API\345\256\211\345\205\250/README.md"	
+++ "b/11 NGINX Web\344\270\216API\345\256\211\345\205\250/README.md"	
@@ -1,6 +1,23 @@
 # 概述
 
-NGINX App Protect（简称NAP）可以对web应用提供WAF防护功能，包括：OWASP Top 10，响应包检查，元字符检查，HTTP协议合规性检查，防逃逸技术，文件类型过滤，JSON、XML和gRPC检查，敏感参数防泄露等。
+NGINX App Protect可以对web应用提供WAF防护功能，包括：OWASP Top 10，响应包检查，元字符检查，HTTP协议合规性检查，防逃逸技术，文件类型过滤，JSON、XML和gRPC检查，敏感参数防泄露等。
+
+---
+
+# Lab介绍
+
+NGINX Web与API安全的Lab实验分为以下4大部分：
+
+## Lab-0：环境搭建
+
+## Lab-1：OWASP Top 10防护
+
+## Lab-2：API安全防护
+
+## Lab-3：Bots机器人防护
+
+
+---
 
 ## 前提条件
 1. NGINX Plus Release 22 及更高版本支持 NGINX App Protect。
@@ -19,167 +36,10 @@ NGINX App Protect（简称NAP）可以对web应用提供WAF防护功能，包括
 - Kubernetes Ingress Controller
 - Cloud
 
-4. 申请好NGINX Plus测试许可。在自己试用账号门户站点里<https://my.f5.com/>，下载好以下2个文件：
-```
-nginx-repo.key
-nginx-repo.crt
-```
+---
 
 # Lab环境介绍
 
-本章节演示和实验采用在CentOS虚机中部署NGINX App Protect环境，学员可根据自己实际情况准备实验环境。本环境中包含以下组件：
-
-## NGINX Plus反向代理服务器
-后面简称反代，
-
-## Web API Servers
-使用Arcadia应用服务，通过GitLab下载安装：https://gitlab.com/arcadia-application
-
-## 测试客户端
-请预装以下软件，并且为了方便测试，建议在客户端hosts配置测试所用域名。
-- 浏览器
-- Postman
-- Jmeter
-
-# CentOS 7.4+环境的NAP安装步骤
-
-1. 如果前面章节的实验已有相关NGINX包，可以备份相关配置和日志
-```
-sudo cp -a /etc/nginx /etc/nginx-plus-backup
-sudo cp -a /var/log/nginx /var/log/nginx-plus-backup
-```
-2. 创建/etc/ssl/nginx/目录和/etc/nginx/目录
-```
-sudo mkdir -p /etc/ssl/nginx
-sudo mkdir -p /etc/nginx
-```
-3. 将以上《前提条件》中申请的测试许可从门户站点中下载好，并复制到/etc/ssl/nginx/目录下。
-
-4. 安装必备软件包
-```
-sudo yum install ca-certificates epel-release wget
-```
-5. 添加NGINX Plus库
-```
-sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nginx-plus-7.repo
-```
-6.安装最新版本的NGINX App Protect软件包（包括NGINX Plus）
-```
-sudo yum install app-protect
-```
-注：也可以通过以下命令列出可用版本:
-```
-sudo yum --showduplicates list app-protect
-```
-从而选择指定版本进行安装，例如：
-```
-sudo yum install app-protect-20+2.52.1
-```
-7. 检查 NGINX 二进制版本以确保正确安装了 NGINX Plus
-```
-sudo nginx -v
-```
-8. 配置nginx，以下二选一。
-- 可以将Gitee中<11 NGINX Web与API安全>目录下的nginx.conf文件拷贝至/etc/nginx/目录
-- 或者直接vi将如下配置文件内容粘贴至/etc/nginx/nginx.conf中：
-```
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log notice;
-
-# load the app protect module
-load_module modules/ngx_http_app_protect_module.so;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-    include          /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" "$http_x_forwarded_for"';
-
-    # note that in the dockerfile, the logs are redirected to stdout and can be viewed with `docker logs`
-    access_log  /var/log/nginx/access.log  main;
-
-    server {
-        listen       80;
-        server_name  localhost;
-        proxy_http_version 1.1;
-        proxy_cache_bypass  $http_upgrade;
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Forwarded-Server $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_ignore_client_abort on;
-
-        app_protect_enable on;
-        app_protect_security_log_enable on;
-        # send the logs to the logstash instance on our ELK stack.
-        app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=10.1.1.11:5144;
-
-        # main service
-        location / {
-            resolver 10.1.1.8:5353;
-            resolver_timeout 5s;
-            client_max_body_size 0;
-            default_type text/html;
-            proxy_pass http://k8s.arcadia-finance.io:30585$request_uri;
-        }
-
-        # backend service
-        location /files {
-            resolver 10.1.1.8:5353;
-            resolver_timeout 5s;
-            client_max_body_size 0;
-            default_type text/html;
-            proxy_pass http://k8s.arcadia-finance.io:30584$request_uri;
-        }
-
-        # app2 service
-        location /api {
-            resolver 10.1.1.8:5353;
-            resolver_timeout 5s;
-            client_max_body_size 0;
-            default_type text/html;
-            proxy_pass http://k8s.arcadia-finance.io:30586$request_uri;
-        }
-
-        # app2 service
-        location /app3 {
-            resolver 10.1.1.8:5353;
-            resolver_timeout 5s;
-            client_max_body_size 0;
-            default_type text/html;
-            proxy_pass http://k8s.arcadia-finance.io:30587$request_uri;
-        }
-    }
-}
-```
-9. 关闭SELinux，允许全局访问
-```
-sudo setenforce 0
-```
-10. 启用并启动NGINX服务
-```
-sudo systemctl enable --now nginx.service
-```
-11. 检查运行是否正常
-```
-systemctl status nginx
-```
-可以看到nginx的服务已经是active的状态。
+本章节演示和实验采用在CentOS虚机中部署NGINX App Protect环境，学员可根据自己实际情况准备实验环境。
 
 ---
-至此，就完成了NAP的安装和初始化相关工作。🍺
----