This is index.html inside the root-folder

Subfolder A
Subfolder B (forbidden by URL Access Rule)
Subfolder C (forbidden by URL Access Rule)


The following input-boxes will submit their values to phptest_get.php or phptest_post.php with the HTTP-Method mentioned on the submit button.

writes into $form_post variable of phptest_post.php
numbers only (0-9), input will be validated serverside!!!

writes into $form_get variable of phptest_get.php:


This Page is intended for testing URL Access-Rules and Input Validation Rules of FortiWeb WAF inside Team Fortinets Lab.

Important: The page has to be accessed via it's 172.29.1.88 IP-Address (FortiWEB VIP), otherwise FortiWeb will be bypassed!

For CSRF protection testing just try to write form_get or form_post variables to phptest_get.php or phptest_post.php and apply corresponding protection profiles in the webprotection profiles on FortiWeb.
Here you can download a prepared version of this page to intentionally trigger CSRF protection (right click --> save to....)  csrf.html

CSRF behavior  can be observed when submitting with HTTP-GET in the URL (tknfv parameter with session ID)

For questions contact sebastian.mallach@sva.de