demo: managed rulesets (owasp core + cloudflare managed)

the cloudflare managed ruleset and owasp core ruleset are enabled on this zone. they inspect query strings, form bodies, and headers for known attack signatures — xss, sqli, path traversal, command injection, and more. this page fires three fetch() calls to /api/owasp-probe with different payloads. the managed rules block before the function runs.

# fire a probe

# or from your terminal

# safe → 200
curl -s -o /dev/null -w "%{http_code}\n" "https://rhocfsandbox.com/api/owasp-probe?q=hello"

# xss → 403 from the managed ruleset
curl -s -o /dev/null -w "%{http_code}\n" --data-urlencode "q=<script>alert(1)</script>" -G "https://rhocfsandbox.com/api/owasp-probe"

# sqli → 403 from the managed ruleset
curl -s -o /dev/null -w "%{http_code}\n" --data-urlencode "q=' OR 1=1 --" -G "https://rhocfsandbox.com/api/owasp-probe"

# what's the config