app-under-test
A dynamic site with the shape of an attackable application — login form, reflected search, file upload, JSON API — and none of the actual holes. Point WAF, bot and rate-limit rules at it, then ask the detector what reached the origin.
Test surface
| Endpoint | What it is for |
|---|---|
POST /login | credential stuffing, bot detection, JS challenges |
GET /search?q= | reflected parameter — SQLi/XSS-shaped WAF probes |
POST /upload | multipart body inspection, body-size limits |
GET|POST /api/orders | API schema enforcement, per-endpoint rate limits |
GET /_detector/requests | what actually arrived — the blocking oracle |
POST /_detector/reset | clear the buffer before a test run |
Catalogue
| ID | Name | Category | Price |
|---|---|---|---|
| 1 | Edge Widget | hardware | 42.0 |
| 2 | Origin Shield | service | 99.0 |
| 3 | Cache Key Ring | hardware | 12.5 |
| 4 | Bot Deterrent | service | 250.0 |
| 5 | TLS Certificate Holder | misc | 7.25 |
app-under-test · version 0.1.0-rc.4