=== Test 1: GET con SQLi en query string ===
$ curl -i 'http://138.197.228.148/?id=1%20OR%201=1--%20'
HTTP/1.1 403 Forbidden
Server: nginx
Date: Thu, 28 May 2026 01:23:45 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600

=== Test 2: GET con UNION SELECT ===
$ curl -i 'http://138.197.228.148/?q=UNION%20SELECT%20username%20FROM%20users'
HTTP/1.1 403 Forbidden
Server: nginx
Date: Thu, 28 May 2026 01:23:46 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600

=== Test 3: XSS payload ===
$ curl -i 'http://138.197.228.148/?x=<script>alert(1)</script>'
HTTP/1.1 403 Forbidden
Server: nginx
Date: Thu, 28 May 2026 01:23:46 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600

=== Test 4: Path traversal ===
$ curl -i 'http://138.197.228.148/api/../../../../etc/passwd'
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 28 May 2026 01:23:46 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 103
Connection: keep-alive
vary: Origin
Access-Control-Allow-Credentials: true

=== Test 5: Command injection ===
$ curl -i 'http://138.197.228.148/?cmd=;cat%20/etc/passwd'
HTTP/1.1 403 Forbidden
Server: nginx
Date: Thu, 28 May 2026 01:23:46 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600

=== Test 6: Scanner User-Agent (sqlmap) ===
$ curl -i -H 'User-Agent: sqlmap/1.0' 'http://138.197.228.148/'
HTTP/1.1 403 Forbidden
Server: nginx
Date: Thu, 28 May 2026 01:23:46 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600

=== Test 7: GET normal (debe pasar) ===
$ curl -i 'http://138.197.228.148/api/v1/health'
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 28 May 2026 01:23:47 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 103
