🔓 Demo: JSON Response Field Decryption

Endpoint /api/users.php menyimpan field sensitif dalam bentuk terenkripsi (AES-256-GCM) di upstream. WAF secara otomatis mendekripsi field email, phone, salary, dan secret sebelum response dikirim ke client — tanpa mengubah data yang tersimpan.

🔍 WAF Test – XSS (GET)

💉 WAF Test – SQL Injection (GET)

📋 Payload Siap Pakai

• XSS: ?search=<script>alert(1)</script>
• SQLi: ?user=1 UNION SELECT 1,2,3--
• LFI: ?page=../../../etc/passwd
• CMD: ?search=;cat /etc/passwd
• Login POST: username=admin, password=password123