@@ -15,6 +15,34 @@ BlazeHTTP 是一款简单易用的 WAF **防护效果测试**工具。
15
15
| 准确率 | 准确率是检出率和误报率的综合指标,避免漏报和误报顾此失彼。 | |
16
16
| 检测耗时 | 用来反应 WAF 性能,耗时越大则性能越差。 | |
17
17
18
+ ## 样本示例
19
+
20
+ ``` bash
21
+ # 正常样本:testcases/00/02/5ebf56a710da27b73a9ad59219f0.white
22
+ GET /
[email protected] /lib/hooks/useHeights.js HTTP/1.1
23
+ Host: npm.staticblitz.com
24
+ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
25
+ Accept: * /*
26
+ Origin: https://stackblitz.com
27
+ Sec-Fetch-Site: cross-site
28
+ Sec-Fetch-Mode: cors
29
+ Sec-Fetch-Dest: empty
30
+ Referer: https://stackblitz.com/
31
+ Accept-Encoding: gzip, deflate
32
+ Accept-Language: zh-CN,zh; q=0.9,en-US; q=0.8,en; q=0.7
33
+
34
+ # 黑样本:testcases/8a/36/0bbc7685860c526e33f3cbd83f9c.black
35
+ GET /vulnerabilities/sqli_blind/? id=1%27+or+%27%27%3D%27& Submit=Submit HTTP/1.1
36
+ Host: 10.10.3.128
37
+ Upgrade-Insecure-Requests: 1
38
+ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
39
+ Accept: text/html,application/xhtml+xml,application/xml; q=0.9,image/avif,image/webp,image/apng,* /* ; q=0.8,application/signed-exchange; v=b3; q=0.7
40
+ Referer: http://10.10.3.128/vulnerabilities/sqli_blind/? id=1%27+and+%27%27%3D%27& Submit=Submit
41
+ Accept-Encoding: gzip, deflate
42
+ Accept-Language: zh-CN,zh; q=0.9,en-US; q=0.8,en; q=0.7
43
+ Connection: close
44
+ ```
45
+
18
46
## 安装使用
19
47
20
48
GitHub CI 预编译的产物已上传 Release,可以[ 直接下载] ( https://github.com/chaitin/blazehttp/releases ) 最新的版本使用。
0 commit comments