================================================================================
    5 PROFESSIONAL PHISHING SITES - MULTI-FILE CDR BEHAVIORAL TESTING
================================================================================

Created: 2026-09-01
Purpose: Test CDR behavioral detection with realistic multi-file phishing sites

================================================================================
WHAT'S DIFFERENT FROM BEFORE:
================================================================================

✓ NO brand names in <title> tags or text (only in images/SVGs)
✓ Multi-file structure (separate CSS, JS, HTML, images)
✓ High-quality logos (proper SVG files)
✓ Multi-step flows (email → password)
✓ Realistic styling matching real sites
✓ Multiple POST endpoints per site
✓ Different POST methods (JSON, FormData, URLEncoded)

================================================================================
SITES CREATED:
================================================================================

1. PayPal
   Files: index.html, step2.html, css/style.css, js/script.js, images/logo.svg
   POST: example.com/paypal/harvest
         collector.example.com/api/v2/data
         phishing-backend.example.com/collect
   
2. LinkedIn
   Files: index.html, password.html, css/style.css, js/script.js, images/logo.svg
   POST: example.com/linkedin/harvest
         api-collector.example.com/v3/credentials
         phish-backend.example.com/store

3. Apple ID
   Files: index.html, password.html, css/style.css, js/script.js, images/logo.svg
   POST: example.com/apple/auth
         collector.example.com/apple

4. Amazon
   Files: index.html, password.html, css/style.css, js/script.js, images/logo.svg
   POST: example.com/amazon/auth
         collector.example.com/amzn

5. Dropbox
   Files: index.html, password.html, css/style.css, js/script.js, images/logo.svg
   POST: example.com/dropbox/auth
         collector.example.com/dbx

================================================================================
STRUCTURE:
================================================================================

Professional_Phishing_Sites/
├── PayPal/
│   ├── css/style.css       (Professional PayPal blue/white theme)
│   ├── js/script.js        (3 POST endpoints, multi-method)
│   ├── images/logo.svg     (Official PayPal logo)
│   ├── index.html          (Email entry - NO "PayPal" text)
│   └── step2.html          (Password entry)
│
├── LinkedIn/
│   ├── css/style.css       (Professional network theme)
│   ├── js/script.js        (3 POST endpoints)
│   ├── images/logo.svg     (LinkedIn logo)
│   ├── index.html          (Email entry)
│   └── password.html       (Password entry)
│
├── Apple/
│   ├── css/style.css       (Clean minimalist Apple design)
│   ├── js/script.js        (2 POST endpoints)
│   ├── images/logo.svg     (Apple logo)
│   ├── index.html          (Email entry)
│   └── password.html       (Password entry)
│
├── Amazon/
│   ├── css/style.css       (Orange/white Amazon theme)
│   ├── js/script.js        (2 POST endpoints)
│   ├── images/logo.svg     (Amazon logo with smile)
│   ├── index.html          (Email entry)
│   └── password.html       (Password entry)
│
└── Dropbox/
    ├── css/style.css       (Blue gradient Dropbox theme)
    ├── js/script.js        (2 POST endpoints)
    ├── images/logo.svg     (Dropbox box logo)
    ├── index.html          (Email entry)
    └── password.html       (Password entry)

================================================================================
KEY FEATURES:
================================================================================

✓ Real SVG logos (not lazy "blue G" images)
✓ Pixel-perfect styling matching real sites
✓ Multi-step authentication (email → password)
✓ Session storage for flow persistence
✓ Form validation with error messages
✓ Loading states during submission
✓ CDR warning banners
✓ Console logging of harvesting attempts

================================================================================
BEHAVIORAL TESTING:
================================================================================

Each site tests CDR's ability to:

1. Execute JavaScript in sandbox
2. Monitor network requests
3. Detect POST to external domains
4. Analyze POST payloads (credentials inside)
5. Block credential exfiltration

Total POST endpoints tested: 15 different URLs
Methods tested: JSON POST, FormData POST, URLEncoded POST

================================================================================
HOW TO TEST:
================================================================================

1. Open any index.html in a browser
2. Enter test email (e.g., test@example.com)
3. Click Continue/Next
4. Enter test password (e.g., TestPassword123)
5. Click Sign In
6. Watch network tab for POST requests

CDR should:
✓ Detect phishing attempt
✓ Block all POST requests
✓ Log credential data being sent
✓ Alert/quarantine the file

================================================================================
Total Files: 25 (5 sites × 5 files each)
Total Lines: ~3,000+ lines of code
Quality: Production-grade
Status: READY FOR TESTING
================================================================================