Serves any static file directly from the web root. Supports HTML, images, PDF, text inline; all other types as forced downloads.
curl https://www.cxprotect.com/index.html
curl -x 127.0.0.1:8080 https://www.cxprotect.com/index.html
Standard HTML multipart/form-data interface for single file uploads. Max 200 MB.
Browser: /upload-formcurl -X POST -F "file=@/path/to/file.txt" https://www.cxprotect.com/upload
curl -x 127.0.0.1:8080 -X POST -F "file=@/path/to/file.txt" https://www.cxprotect.com/upload
Upload multiple files simultaneously using the files field name.
curl -X POST -F "files=@file1.txt" -F "files=@file2.pdf" https://www.cxprotect.com/upload-multiple
curl -x 127.0.0.1:8080 -X POST -F "files=@file1.txt" -F "files=@file2.pdf" https://www.cxprotect.com/upload-multiple
Upload raw binary data via request body. Use ?filename= to name the saved file. Tests upload buffer size and DLP rules on raw POST data.
curl -X POST --data-binary "@/path/to/file.zip" -H "Content-Type: application/zip" "https://www.cxprotect.com/upload-direct?filename=test.zip"
curl -x 127.0.0.1:8080 -X POST --data-binary "@/path/to/file.zip" -H "Content-Type: application/zip" "https://www.cxprotect.com/upload-direct?filename=test.zip"
Enforces a per-request upload size cap. Returns 413 Payload Too Large if exceeded. Tests how your proxy handles oversized uploads.
/upload-limit/:mb — default 1 MB, max 200 MB.
curl -X POST -F "file=@large_file.bin" https://www.cxprotect.com/upload-limit/1
curl -x 127.0.0.1:8080 -X POST -F "file=@large_file.bin" https://www.cxprotect.com/upload-limit/1
Returns a browsable directory listing. Available for /downloads, /malware, /image_store, /uploads, and any folder in the web root.
curl https://www.cxprotect.com/downloads
curl -x 127.0.0.1:8080 https://www.cxprotect.com/downloads
Download real sample files. Supports HTTP Range requests for partial download testing.
curl -H "Range: bytes=0-1048576" https://www.cxprotect.com/downloads/swgaudit.exe -o partial.exe
curl -x 127.0.0.1:8080 -H "Range: bytes=0-1048576" https://www.cxprotect.com/downloads/swgaudit.exe -o partial.exe
EICAR test files in various formats for testing ClamAV, SqScan, and custom signature detection.
Browser: /malwarecurl https://www.cxprotect.com/malware/eicar-test.txt
curl -x 127.0.0.1:8080 https://www.cxprotect.com/malware/eicar-test.txt
curl -x 127.0.0.1:8080 https://www.cxprotect.com/malware/custom_sig.txt
Returns all request headers as an HTML table. Key for testing X-Forwarded-For, Via, User-Agent stripping, cookie pass-through, and custom injected headers.
curl -H "X-Custom-Test: hello" https://www.cxprotect.com/echo-headers
curl -x 127.0.0.1:8080 https://www.cxprotect.com/echo-headers
Returns method, URL, headers, query params, and body as JSON. Useful for request-type identification and content modifier testing.
Browser: /echo-requestcurl -X POST -H "Content-Type: application/json" -d '{"test":"value"}' https://www.cxprotect.com/echo-requestcurl -x 127.0.0.1:8080 -X POST -H "Content-Type: application/json" -d '{"test":"value"}' https://www.cxprotect.com/echo-requestEchoes the POST body back as an HTML page. Tests DLP upload blocking, upload buffer size limits, and content modifier find-and-replace on POST data.
Browser: /post-datacurl -X POST -d "username=admin&password=secret" https://www.cxprotect.com/post-data
curl -x 127.0.0.1:8080 -X POST -H "Content-Type: text/plain" -d "Anonymous Proxy" https://www.cxprotect.com/post-data
Sets multiple test cookies with varying attributes (HttpOnly, SameSite=None, persistent). Tests cookie filter keep/drop rules and elevated privacy (third-party cookie stripping).
Browser: /set-cookie Set custom cookiecurl -i https://www.cxprotect.com/set-cookie
curl -x 127.0.0.1:8080 -i https://www.cxprotect.com/set-cookie
Echoes cookies received in the request as a table. After visiting /set-cookie, check here to see which cookies your proxy forwarded or dropped.
curl -H "Cookie: session_id=abc123; tracking_id=xyz789" https://www.cxprotect.com/cookie-echo
curl -x 127.0.0.1:8080 -H "Cookie: session_id=abc123; tracking_id=xyz789" https://www.cxprotect.com/cookie-echo
Always returns a Content-Encoding: gzip response regardless of Accept-Encoding. Tests proxy transparent decompression and compress-incoming/outgoing rules.
curl -H "Accept-Encoding: gzip" --compressed https://www.cxprotect.com/compressed-data
curl -x 127.0.0.1:8080 -H "Accept-Encoding: gzip" --compressed https://www.cxprotect.com/compressed-data
Sends response in N chunks with a delay between each. No Content-Length header → forces Transfer-Encoding: chunked. Tests chunked response buffering.
Routes: /chunked/:chunks?/:delay_ms? · /transfer-encoding (alias)
curl -N https://www.cxprotect.com/transfer-encoding
curl -x 127.0.0.1:8080 -i -N https://www.cxprotect.com/chunked/10/500
Drips one byte at a time with a configurable delay between each byte. Tests proxy read-timeout, buffer patience, and keepalive timeout.
Route: /trickle/:bytes?/:delay_ms? — defaults: 80 bytes, 100ms delay.
curl -N https://www.cxprotect.com/trickle/50/200
curl -x 127.0.0.1:8080 -N https://www.cxprotect.com/trickle/50/200
Generates and streams exactly the requested amount of random data. Supports byte suffixes: K = KB, M = MB, G = GB. Max 2 GB.
Tests minimum/maximum content size response profiling and download buffer size limits.
Browser: 100 KB Browser: 1 MBcurl https://www.cxprotect.com/content-size/1M -o /dev/null
curl -x 127.0.0.1:8080 https://www.cxprotect.com/content-size/512M -o /dev/null
Streams N megabytes of binary data. Default 1 MB, max 100 MB. Tests proxy buffering, memory limits, and throughput.
Browser: 1 MB Browser: 10 MBcurl https://www.cxprotect.com/large-payload/10 -o /dev/null
curl -x 127.0.0.1:8080 https://www.cxprotect.com/large-payload/50 -o /dev/null
Returns random binary data of exactly ?size= bytes as a downloadable blob. Use ?filename= to name it.
curl "https://www.cxprotect.com/blob?size=1024&filename=test.bin" -o test.bin
curl -x 127.0.0.1:8080 "https://www.cxprotect.com/blob?size=1024&filename=test.bin" -o test.bin
Holds the response for N seconds before replying. Tests proxy connect timeout, header timeout, and keepalive timeout thresholds.
Routes: /delay/:seconds? · /simulate_delay/:seconds? (alias). Default 5s, max 60s.
curl https://www.cxprotect.com/simulate_delay/10
curl -x 127.0.0.1:8080 https://www.cxprotect.com/delay/30
Forces the server to return any status code 100–599. 3xx codes redirect to /status/200.
curl https://www.cxprotect.com/status/500
curl -x 127.0.0.1:8080 -i https://www.cxprotect.com/status/403
Returns a status code with a completely empty body. Tests how the proxy handles bodyless responses (204, 304, 403, etc.).
curl -i "https://www.cxprotect.com/no-response?code=204"
curl -x 127.0.0.1:8080 -i "https://www.cxprotect.com/no-response?code=403"
Sets a fixed set of proxy-relevant response headers plus any additional ones you specify via query params. Tests header filter keep/drop/inject policies.
Also echoes back X-Forwarded-For and Via headers received from the proxy.
curl -i "https://www.cxprotect.com/custom-headers?X-Test-Header=myvalue"
curl -x 127.0.0.1:8080 -i "https://www.cxprotect.com/custom-headers"
Requires HTTP Basic Auth. Credentials default to admin / secret. On success, serves the downloads directory listing.
Route: /auth/basic/:user?/:pass? — override credentials in the URL.
curl -u admin:secret https://www.cxprotect.com/auth/basic
curl -x 127.0.0.1:8080 -u admin:secret https://www.cxprotect.com/auth/basic
curl -u wronguser:wrongpass https://www.cxprotect.com/auth/basic
Requires HTTP Digest Auth (MD5). Fixed credentials: admin / secret. On success, serves the downloads directory listing.
curl --digest -u admin:secret https://www.cxprotect.com/auth/digest
curl -x 127.0.0.1:8080 --digest -u admin:secret https://www.cxprotect.com/auth/digest
Performs N redirects before landing on the final destination. Default 3 hops, max 20. Override status code with ?code=301.
Tests proxy redirect-following, 302 redirect behaviour, and URL encoding through redirect hops.
3 hops (302) 5 hops (301) 10 hops (307)curl -L https://www.cxprotect.com/redirect/5
curl -x 127.0.0.1:8080 -L "https://www.cxprotect.com/redirect/5?code=301"
Immediately destroys the TCP socket — no HTTP response is ever sent. Simulates a hard connection failure or unreachable host. Tests how the proxy handles and reports connection failures.
curl https://www.cxprotect.com/drop-connection
curl -x 127.0.0.1:8080 https://www.cxprotect.com/drop-connection
Comprehensive interactive page for testing multiple CSP directives including script-src, img-src, frame-src, and connect-src.
curl -I https://www.cxprotect.com/testcsp
curl -x 127.0.0.1:8080 -I https://www.cxprotect.com/testcsp
Page with require-trusted-types-for 'script' enforced. Tests if the proxy strips or modifies CSP headers that would otherwise block DOM injection.
curl -I https://www.cxprotect.com/csp_tt
curl -x 127.0.0.1:8080 -I https://www.cxprotect.com/csp_tt
Receives browser-sent CSP violation reports (Content-Type: application/csp-report). Stores up to 500 reports. View logged reports in your browser.
curl -X POST -H "Content-Type: application/csp-report" \
-d '{"csp-report":{"document-uri":"https://www.cxprotect.com/testcsp","violated-directive":"script-src"}}' \
https://www.cxprotect.com/csp_reportscurl -x 127.0.0.1:8080 -X POST -H "Content-Type: application/csp-report" \
-d '{"csp-report":{"document-uri":"https://www.cxprotect.com/testcsp","violated-directive":"script-src"}}' \
https://www.cxprotect.com/csp_reports