Test if WAF is working

Hello,

Can anyone recommend a 100% reliable test if WAF is actually working (especially the SQL-INJ/XSS features)?

Firewall profile has form/url/cookie/xss/sql features enabled. I think I have configured the real webserver and virtual webserver correctly, but I don't know how to verify this.

Thank you!
Tim