demo: waf custom rule → user-agent / header block

one waf rule, three ways to trigger it. matches on either user-agent contains "sqlmap" or a custom x-test-bot: sqlmap header — browsers refuse to let javascript spoof user-agent, so the alternate header is provided for the in-browser fetch demo.

# method 1: curl (any terminal)

# spoof user-agent
curl -i -A "sqlmap-demo" "https://rhocfsandbox.com/waf-ua"

# or send the alternate header
curl -i -H "x-test-bot: sqlmap" "https://rhocfsandbox.com/waf-ua"

# method 2: devtools (any browser)

open devtools → ... menu → more tools → network conditions
uncheck "use browser default" for user agent
type sqlmap into the custom field
reload this page — blocked at the edge

# method 3: in-page fetch (this button)

the button below sends a background fetch() with the alternate header and shows the response. because user-agent is on the browser's "forbidden header names" list, we use x-test-bot instead — the waf rule matches on either.

click the button…

# what's the rule

rule name	`SITE_waf_ua_bot`
expression	`http.request.uri.path eq "/waf-ua" and (lower(http.user_agent) contains "sqlmap" or any(http.request.headers["x-test-bot"][*] contains "sqlmap"))`
action	block · custom html response (403)