WAF Test Target

Intentionally vulnerable. For authorized WAF testing only.

Test endpoints

• /search?q= reflected XSS
• /login SQL injection (POST username/password)
• /comment stored XSS
• /file?name= path traversal
• /ping?host= command injection (simulated)
• /redirect?url= open redirect
• POST /api/user JSON SQLi: {"id": "1"}
• /health health check