Local playground

Requires rustc 1.90+ and a checkout of the xorappsec engine repository.

1. Build

   cd xorappsec
   cargo build --release -p xorappsec

2. Run the demo (proxy + dashboard + fake shop)

   ./target/release/xorappsec demo

   Shop :8080 · dashboard :9090 · bare origin :18080 (do not expose).

3. Benign then attack

   curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8080/
   curl -sS -D- 'http://127.0.0.1:8080/search?q=1%27%20UNION%20SELECT%20password%20FROM%20users--'
   ./examples/smoke.sh

   Expect 200 on / and login; 403 on SQLi, XSS, Log4Shell, Spring4Shell, Text4Shell, open redirect.

4. Read the event on the dashboard Events tab, or xorappsec ctl events --limit 10.

Next: protect your origin.