WAF Security Validation Lab

This lab safely echoes and logs test requests. It never executes payloads or accesses files/databases.

Health: /health | /api/cases

Test endpoints

• /test/sqli?input=benign — SQL injection
  Candidate rule group: AWSManagedRulesSQLiRuleSet
• /test/xss?input=benign — Cross-site scripting
  Candidate rule group: AWSManagedRulesCommonRuleSet
• /test/traversal?input=benign — Path traversal / local file inclusion
  Candidate rule group: AWSManagedRulesCommonRuleSet
• /test/rfi?input=benign — Remote file inclusion
  Candidate rule group: AWSManagedRulesCommonRuleSet
• /test/rce?input=benign — Command injection signature
  Candidate rule group: AWSManagedRulesKnownBadInputsRuleSet
• /test/scanner?input=benign — Scanner user-agent
  Candidate rule group: AWSManagedRulesCommonRuleSet
• /test/admin?input=benign — Administrative URL probe
  Candidate rule group: Custom URI path rule

Run attack-signature requests only from approved test clients against this isolated lab.