Predefined test cases
Each case sends one request through the pipeline: inspection → detection → behaviour → decision → logging.
TC-01Normal request
A clean search query with no suspicious characters.
GET /search?q=laptop bags
TC-02SQL injection tautology
Classic boolean tautology submitted as plain text only.
POST /login?username=' OR '1'='1
TC-03UNION SELECT extraction
UNION based data extraction attempt string.
GET /search?q=1 UNION SELECT username, password FROM users
TC-04Reflected XSS script tag
Script tag payload. It is escaped, never rendered.
GET /search?q=<script>alert(1)</script>
TC-05XSS event handler
Image tag with an onerror handler.
GET /search?q=<img src=x onerror=alert(document.cookie)>
TC-06Directory traversal
Relative path traversal string. No file is opened.
GET /file?path=../../../../var/log/app.log
TC-07Encoded traversal
URL encoded traversal variant.
GET /file?path=%2e%2e%2f%2e%2e%2fconfig
TC-08Local file inclusion
Sensitive system file reference. Nothing is read.
GET /file?path=/etc/passwd
TC-09File wrapper inclusion
Stream wrapper inclusion attempt.
GET /file?path=file:///etc/shadow
TC-10Command injection
Shell separator with a system command. Never executed.
GET /command?cmd=ping 127.0.0.1; whoami
TC-11Command substitution
Command substitution syntax detected as text.
GET /command?cmd=echo $(uname -a)
TC-12Scanner user agent
Request that claims to come from a vulnerability scanner.
GET /?q=scan
TC-13Rate limit burst
Sends a burst of clean requests from one IP to trip the limiter.
GET /search?q=burst (x60)
Custom request inspector
Craft your own request against the local mock app.
Safety notice
- Requests never leave this application — the target is the bundled mock test app.
- Payloads are normalised and matched against patterns as strings only.
- No SQL, shell command, script or file path from a payload is ever executed.
- Blocked IPs are flagged temporarily and released automatically.