Phase: 3 — L7 Networking + WAF + API Security Goal: Build a production-grade WAF from scratch: OWASP rule set, multi-layer normalization, body inspection, scoring model, and hot-reload config. By end of week you understand every feature AWS WAF charges $5/month/rule for.
Background in this wiki: HTTPS guide Ch 12 (web attacks and defences), Ch 20 (request smuggling, reproduced), Ch 22 (SSRF); TCP/IP guide Ch 53 (firewalls, and policy as tests). Security in Depth: Part 6 (advanced web attacks) and Chapter 40C (WAF architecture and bypasses).