Protected by GuardX

WAF Test Lab

An intentionally vulnerable playground to verify your GuardX WAF rules.

Intentionally vulnerable applicationBuilt for WAF testing only. Never deploy it in production.

Pick a scenarioEach card below is a different attack class.

Send a payloadClick an example payload to fill the field, then submit.

Watch the WAFA block or challenge page instead of the result means GuardX caught it.

Attack scenarios 8

SQL Injection

Critical

Input is concatenated straight into a SQL query without sanitising.

Test payloadsClick a payload to fill the field

Reflected XSS

High

Input is echoed back into the page without output encoding.

Test payloadsClick a payload to fill the field

Stored XSS

High

Comments are saved and shown to every visitor without escaping.

user1: This is a normal comment

user2: Another safe comment here

Test payloadsClick a payload to fill the field

File Upload

Critical

Any file type is accepted and stored under its original name.

Test:

Upload shell.php containing PHP code
Upload test.php.jpg (double extension)
Upload an .htaccess file

SSRF

High

The server fetches whatever URL it is given, including internal ones.

Test payloadsClick a payload to fill the field

CSRF

Medium

A state-changing form with no anti-CSRF token.

Test: Create an external HTML page with an auto-submitting form:
<form action="THIS_URL" method="POST">...</form>
No token validation means the form is CSRF-vulnerable.

Directory Traversal / LFI

High

The file path is used as given, so ../ sequences escape the folder.

Test payloadsClick a payload to fill the field

Command Injection

Critical

The hostname is appended to a shell command.

Test payloadsClick a payload to fill the field