Trigger API calls on this page, then navigate elsewhere — network logs stay in the same session.
Record a session, then open replay → Network to inspect headers and bodies.
Waiting for API calls…
Enable WAF → Block console script injection, hard-refresh, then test on this page (not the home page). eval() may already be blocked by browser CSP — use the script-tag test to verify WAF blocking.
Warning: document.write() after page load wipes the entire page if not blocked. Reload if the screen goes blank.
Enable blockScriptInjection in WAF, refresh, then click a test…
// 1) eval
eval('window.__sr_inj_eval = 1')
// 2) new Function
new Function('window.__sr_inj_fn = 1')()
// 3) document.write — DANGER: wipes the page if not blocked; reload after testing
document.write('<!-- injected -->')
// 4) dynamic script tag (run on /demo/network where body exists)
var s = document.createElement('script')
s.textContent = 'window.__sr_inj_script = 1'
document.body.appendChild(s)
// 5) javascript: / event handler
var el = document.createElement('button')
el.setAttribute('onclick', 'window.__sr_inj_onclick = 1')
document.body.appendChild(el)
Toggle WAF → Detection → Client environment → API hooking prevention, hard-refresh, then simulate a malicious hook. With prevention on, tampered hooks are restored and logged as probes; with it off, hooks stay in place and no probe is expected.
Guard status: checking policy…
Hard-refresh after changing WAF policy, then click a hijack test…