UDF Lab Environment
⚠️ WAF Test Page
Test F5 WAF detection against this demo app or any custom target FQDN — including customer applications.
⚠️ Lab & Authorized Use Only: Only test against applications you own or have explicit written permission to test. These payloads are for demonstrating F5 WAF capabilities.

🎯 Attack Target Configuration

🏠 This Demo App 🔐 Login Page 📄 API Endpoint

🏆 OWASP Top 10 Attack Suite (2021)

Run all OWASP Top 10 attack payloads against the configured target. Results show whether F5 WAF blocked or passed each attack.

📊 Attack Summary —

0
✅ Blocked by WAF
0
❌ Passed Through
0
⚠️ Network Error
0
📊 Total Attacks
🔬 Individual Attack Tests

💉 SQL Injection

Classic SQLi payload to bypass authentication. F5 WAF detects and blocks SQL syntax in request parameters.

' OR '1'='1' --

🔀 Cross-Site Scripting (XSS)

Reflected XSS payload. F5 WAF detects script injection attempts in request parameters and headers.

<script>alert('XSS')</script>

📁 Path Traversal

Directory traversal attempt to access sensitive files. F5 WAF blocks ../ patterns in request paths.

../../../../etc/passwd

💻 Command Injection

OS command injection attempt. F5 WAF detects shell command patterns injected into request parameters.

; cat /etc/passwd

🔍 LDAP Injection

LDAP injection targeting directory service authentication. F5 WAF detects LDAP filter manipulation.

*)(uid=*))(|(uid=*

📦 XXE Injection

XML External Entity injection targeting XML parsers. F5 WAF detects DOCTYPE and ENTITY declarations.

<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>