Looking to see how a modern Web Application Firewall performs in the real world? With SafeLine’s public demo, you can test its protection against real attack payloads — no local installation required.
What is SafeLine?
SafeLine is one of the most popular free, self-hosted Web Application Firewalls (WAFs) in 2025 — with over 17,000 GitHub stars. Unlike traditional signature-based WAFs, it uses a semantic analysis engine to understand the intent behind HTTP requests, dramatically reducing false positives.
It’s designed for simplicity, privacy, and performance — making it a perfect fit for homelab users, developers, and startups alike.
Goal: Test SafeLine’s Detection Capabilities
SafeLine provides a public demo for testing its detection engine:
- WAF Interface URL: https://demo.waf.chaitin.com:10084/hello.html
- Attack Payload Generator Page: https://demo.waf.chaitin.com/
With this setup, you can simulate common web attacks like:
- SQL Injection
- Cross-site Scripting (XSS)
- Command Injection
- Directory Traversal
- Path Manipulation
- HTTP Flood
The tests here are safe and intended for educational purposes. Do not use them against unauthorized or production systems.
Step-by-Step Guide
1. Visit the Attack Simulation Interface
Go to the payload generator page:
➡️ https://demo.waf.chaitin.com/
Here, you’ll find a pre-built SQL Injection payload for common web attacks:
1 and 1=1
2. Configure the Target
In the Target Input field, paste the URL of the protected endpoint:
https://demo.waf.chaitin.com:10084/hello.html
This endpoint is protected by the SafeLine WAF in strict defense mode.
3. Launch the simulated attack
Click on "Launch" directly to start this SQL Injection.
SafeLine will analyze the payload and, if blocked, it means SafeLine successfully intercepted and mitigated the attack.
4. Analyze the Results
Check the attack log by visiting https://demo.waf.chaitin.com:9443/statistics, and click on "Attacks".
Here is the attack we just launched:
Here are the details of the attack:
Behind the Scenes
What makes SafeLine stand out:
- Semantic Detection: Not just matching patterns, but understanding the behavior of requests.
-
Free Tier Includes:
- Rate limiting
- Identity authentication
- Anti-bot challenges
- Unlimited custom rules
- No account or credit card required
- Self-hosted (Docker-based deployment)
- Large active community
Final Thoughts
Testing SafeLine’s public demo is a great way to understand what modern WAFs are capable of — and why semantic analysis might be the future of web application defense.
If you’re curious, try deploying it locally via Docker and protect your own app in just a few minutes.
Got questions or feedback? Join the community on Discord or leave a comment below.
Top comments (0)