A purpose-built application for Cloudflare WAF testing, training, and live demonstrations
SQLi detection, brute force protection, credential stuffing rules
Reflected XSS, HTML injection, input sanitization rules
Rate limiting, schema validation, API shield testing
Malicious payload upload detection and blocking
Path-based access control, custom WAF rules
Stored XSS and content injection vectors
| Endpoint | WAF Features | Example Payload |
|---|---|---|
| /login | SQLi rules, brute force rate limiting | ' OR 1=1 -- |
| /search | Reflected XSS, HTML injection | <script>alert(1)</script> |
| /products | Parameter tampering, path traversal | ../../etc/passwd |
| /api/products | Rate limiting, API abuse | Rapid repeated requests |
| /upload | Malicious file upload | PHP webshells, .exe files |
| /admin | Access control, IP restrictions | Custom rule blocking |
| /reviews/:id | Stored XSS, content injection | <img onerror=alert(1)> |