WAF test page

Back to the start page

Block answers 403 with the Blocked by the WAF page when the rules match. Detect always answers 200 with the echo and only logs. Plain (plain) has no WAF.

Detections: kubectl -n envoy-gateway-system logs -l gateway.envoyproxy.io/owning-gateway-name=web -c coraza-detect

Query string

Request body

Ready-made examples

CRS runs at its default paranoia level 1 with anomaly threshold 5.

• SQL injection 1' OR '1'='1: block detect
  block: 403 (waf-test.sh asserts this); detect: 200
• XSS <script>alert(1)</script>: block detect
  block: 403 (waf-test.sh asserts it for a form body, the same CRS rule reads the query); detect: 200
• Path traversal ../../etc/passwd: block detect
  block: may be blocked, not covered by waf-test.sh; detect: 200
• Command injection ; cat /etc/passwd: block detect
  block: may be blocked, not covered by waf-test.sh; detect: 200
• Harmless value hello: block detect
  both: 200 with the echo