WAF Testing Suite

📁 File Upload Test

Test: .php, .exe, .jsp, double extensions, null bytes

💉 SQL Injection

Payloads:

⚡ Cross-Site Scripting (XSS)

Payloads:

📂 Path Traversal / LFI

Payloads:

💻 Command Injection

Payloads:

🌐 SSRF / Open Redirect

Payloads:

📋 Header Injection

Test with curl:

curl -H "X-Forwarded-For: 127.0.0.1" /headers.php

  curl -H "Host: evil.com" /

  curl -H "X-Custom: test%0d%0aInjected: header" /

🔧 HTTP Methods

Test with curl:

curl -X OPTIONS /

  curl -X PUT -d "test" /test.txt

  curl -X DELETE /test.txt

  curl -X TRACE /

📄 XML / XXE

Payload:

<?xml version="1.0"?>

      
      

          
💉 SQL Injection
          

              
              
              Login
          
          
Payloads:
          ?id=1' OR '1'='1
          ?id=1; DROP TABLE users--
          UNION SELECT
      

      
      

          
⚡ Cross-Site Scripting (XSS)
          

              
              Search
          
          
Payloads:
          <script>alert('XSS')</script>
          <img src=x onerror=alert(1)>
          <svg onload=alert(1)>
          javascript:alert(1)
      

      
      

      

      
      

          
🤖 Bot / Scanner Detection
          Check User-Agent
          
Test with curl:
          
curl -A "sqlmap/1.0" /bot.php

  curl -A "Nikto" /bot.php

  curl -A "Googlebot" /bot.php
      

      
      

          
📏 Size / Buffer Tests
          Request Size Info
          
Test with curl:
          
# Large query string
  curl "/?$(python3 -c 'print("A"*10000)')"

  # Large POST body
  curl -X POST -d "$(python3 -c 'print(\"A\"*100000)')" /size.php
      

      
      

          
🔒 Sensitive File Access
          .git/config
          .env
          wp-config.php
          config.php.bak
          .htaccess
          server-status
          phpinfo.php
      

      
      

          
🔨 Rate Limit / Brute Force
          

              
              
              Send 10 Requests