Hands-on OWAF lab
Test it!
Send sample malicious strings toward this origin. With OWAF in Blocking mode you should get 403 Forbidden. Use one-click submit, curl, or header/cookie probes — then confirm matches in the WAF Console.
Before you start
- Only test against this demo host — never against systems you do not own.
- Confirm Blocking vs Detection in the WAF Console before interpreting results.
- Blocked: 403 (or OVHcloud error page). Allowed: “request reached origin” page.
1. Clean baseline (should pass)
Submit a harmless value first so you know what “allowed” looks like.
Blocking / Detection / Disabled → success page from origin. No CRS block.
2. SQL injection — POST body
OWASP CRS scores classic SQLi patterns in form fields.
Blocking → 403. Detection → may still reach origin, but logged. Rule family: SQLi (CRS 942x).
1' OR '1'='1
More SQLi samples
-
' UNION SELECT NULL,NULL-- -
1; DROP TABLE users--
3. Cross-site scripting — POST body
Script tags and event handlers in user input are a common XSS class covered by CRS.
Blocking → 403. Detection → logged, may still pass. Rule family: XSS (CRS 941x).
<script>alert('xss')</script>
More XSS samples
-
<img src=x onerror=alert(1)> -
javascript:alert(document.domain)
4. Path traversal — GET query
CRS inspects query strings. GET keeps the payload visible in the address bar if allowed.
Blocking → 403. Detection → logged. Rule family: LFI / path traversal (CRS 930x).
../../../../etc/passwd
5. Command injection style — POST
Shell metacharacters in parameters are often scored by CRS RCE / command-injection rules.
Blocking → 403. Detection → logged. Rule family: RCE / command injection (CRS 932x).
; cat /etc/passwd
6. Headers & cookies
CRS also inspects headers and cookies — not only form bodies. Browsers will not let a
page forge User-Agent; use curl for that. Cookies can be set from this page, then requested.
Blocking → 403 on scanner UA or malicious cookie (policy-dependent). Rule families: scanner detection / SQLi in cookie (CRS 913x / 942x).
Cookie probe (browser)
Sets a cookie on this host, then GETs /test-echo so OWAF sees the Cookie header.
session=1 OR 1=1
User-Agent probe (curl only)
Scanner-like user agents are a common CRS signal. Run this in a terminal.
7. Rate-limit / bot tease
Fires rapid identical GETs at /test-echo from your browser (same URL,
method, and headers — no cache-busting query). Only meaningful if you enabled a
rate-limit or bot policy in the WAF Console — otherwise you will mostly
see 200s. Choose how many requests to send (default 20).
With rate-limit on → some requests 403 / 429 (or similar). Without it → mostly 200. Check the console for counters.
Mode cheat sheet
| OWAF mode | Malicious sample | Clean baseline |
|---|---|---|
| Blocking | 403 — never hits this nginx | Success page |
| Detection | Logged; success page may still appear | Success page |
| Disabled | No WAF decision — success page | Success page |
Exact rules depend on paranoia level and enabled CRS rules in the WAF Console.