Put <script>alert("123")</script> in the URL
E.g. www.abc.com/<script>alert("123")</script>
Different WAF have different block page like the following:
How to test a website being protected by WAF?
AVP Club
http://www.avpclub.ddns.info/discuz/
Malwarebytes
Remoteroot
Offensive Computing
http://www.offensivecomputing.net/
PC Zone
http://www.pczone.com.tw/vbb3/forum/28/
Deepsoft
malware sample website