Cloudflare WAF CPU Bomb Lab

WEB APPLICATION FIREWALL
Defend your CPU against complex algorithmic denial-of-service (ReDoS) attacks by tuning WAF regex rules.

Global WAF Control Desk

PHASE: TUTORIAL

The "Mini-Bomb" Regex

A Regex engine tries to match text patterns. If it fails, it backtracks to try a different path.

Look at this rule: ^(a+)+$

It looks for repeating a's. Let's see what happens when we feed it the word aaaaX.

Engine State
aaaaX
Start parsing string...