play.teler.sh — teler WAF playground

##
# See https://github.com/teler-sh/teler-waf#custom-rules to write your own rules
# See https://github.com/teler-sh/teler-waf#dsl-expression to write your own DSL expressions
##

excludes:
  # - 1 # CommonWebAttack
  # - 2 # CVE
  - 3 # BadIPAddress
  - 4 # BadReferrer
  # - 5 # BadCrawler
  # - 6 # DirectoryBruteforce
whitelists:
  - request.Headers matches "(curl|Go-http-client|okhttp)/*" && threat == BadCrawler
  - request.URI startsWith "/wp-login.php"
  - request.IP in ["127.0.0.1", "::1", "0.0.0.0"]
  - request.Headers contains "authorization" && request.Method == "POST"
customs:
  - name: Log4j Attack
    condition: or
    rules:
      - method: GET
        element: 0 # 0 = URI, 1 = Headers, 2 = Body, 3 = Any
        pattern: \$\{.*:\/\/.*\/?\w+?\}
        dsl: ""
  - name: Body Contains "foo" String
    condition: or
    rules:
      - method: ""
        element: 0
        pattern: ""
        dsl: request.Body contains "foo"
  - name: Headers Contains "curl" String
    condition: or
    rules:
      - method: ""
        element: 0
        pattern: ""
        dsl: request.Headers contains "curl"
  - name: Request IP Address is Localhost
    condition: or
    rules:
      - method: ""
        element: 0
        pattern: ""
        dsl: request.IP in ["127.0.0.1", "::1", "0.0.0.0"]
  - name: LDAP Injection
    condition: or
    rules:
      - method: ALL
        element: 3
        pattern: (and|or|not|&&|\|\|)
        dsl: ""
  - name: Method is GET
    condition: or
    rules:
      - method: ""
        element: 0
        pattern: ""
        dsl: request.Method == "GET"
  - name: Request Contains "foo" String
    condition: or
    rules:
      - method: ""
        element: 0
        pattern: ""
        dsl: 'one(request.ALL, # contains "foo")'
  - name: SQL Injection
    condition: or
    rules:
      - method: ALL
        element: 0
        pattern: (union|select|insert|update|delete|drop|alter)
        dsl: ""

error means failed to process config and/or request
the message appears is that the request was detected as a threat, or teler-waf managed to catch it based on the config
ok is :ok: ¯\_(ツ)_/¯
shortcuts: Ctrl+P to play, Ctrl+C to clear logs, and Ctrl+R to reset forms
don't even bother SSRFing the server, it's useless. give it a shot if u don't trust me, dawg 💀
feeling a bit mischievous & want to test a teler WAF under the influence? give waf.teler.app a spin!

> teler-waf version v1.5.1
> build e8e9ed9 @ 07/30/24 12:05:36 UTC

teler WAF Playground