🧪 Efficacy Lab — fire every attack case (GET & POST) at this host and watch, live, what the edge stops. Open the lab →

🛡 Apigee compare — same origin behind Google Apigee: payments-secured-by-apigee /lab · features /features · open control payments-open /lab

🏦 Acme Pay — payments API

Origin app, intentionally vulnerable. Served on pod 2d5720b40210.

The same origin sits behind three hostnames so you can compare: open (no gateway) vs secure (wslproxy WAF) vs secured-by-apigee (Google Apigee).

Classic web (OWASP)

Reflected XSS — /search?q=laptop
SQL injection — /products?cat=deposit
Path traversal / LFI — /statement?file=welcome.txt
OS command injection — /ping?host=127.0.0.1
Server-side template injection — /render?tpl=Hello

Named CVEs & SSRF (beyond the Top 10)

Log4Shell / JNDI (CVE-2021-44228) — /lookup?user=guest
Spring4Shell (CVE-2022-22965) — /bind?class.module.classLoader=x
SSRF → cloud metadata — /fetch?url=https://acme.example/logo.png

API security

NoSQL injection auth bypass — POST /api/login {"user":"admin","pass":{"$ne":null}}
BOLA / IDOR — GET /api/accounts/9999
Mass assignment — POST /api/profile {"role":"admin"}
JWT alg:none forgery — GET /api/me with a forged bearer token
XXE — POST /api/import (XML)
GraphQL introspection — POST /graphql
Prototype pollution — POST /api/merge {"__proto__":{"admin":true}}
Open redirect — /api/redirect?to=https://evil.example
HTTP request smuggling — POST /api/batch with a pipelined GET /admin HTTP/1.1