VIYUH BDR — Feature Test Handbook

For the testing team. One file: every implemented feature, what it does, *when it fires* (use case), and *how to test it*. Extension v0.9.103.

• What's implemented: ~85 features across 6 live categories (Phishing, Web-Based Attacks, File Analysis, Extensions, In-Browser DLP & Shadow-AI, Insider Threat & Last-Mile) + Threat Extraction (CDR). Roadmap categories (ITDR, Isolation, SOC integrations, Cloud Email) are not yet built — see §9, don't test those.
• How to read a row: *What it does* = the detection. *Use case* = the real attack/behavior it catches. *How to test* = the concrete action to trigger it.

0 · Setup (once)

Services — all must be up:

for p in 4004 4005 3000 8090; do curl -s -o /dev/null -w ":$p %{http_code}\n" http://localhost:$p/; done
# 4004 backend · 4005 test range · 3000 dashboard · 8090 file host

Load the extension: chrome://extensions → VIYUH BDR → ↻ Reload (must read v0.9.103). If content scripts look stale after a manifest change, Remove + Load unpacked ~/Downloads/bdr-extension-unpacked.

Where to see a detection (any of these):

• Dashboard (primary): http://localhost:3000/bdr — each detection is a row; click for detail.
• Terminal: curl -s "http://localhost:4004/api/detections?limit=15" | jq '.items[] | {feature,headline,severity}'
• On page: a block page, a proceed-able warn, or a top-right notification, depending on tier.
• Service-worker log: chrome://extensions → VIYUH BDR → *service worker* → Console (DETECTION […] lines).

Response tiers (precision-first — most are WARN, not block):

Test hosts — this Mac is 192.168.1.11; the *.192-168-1-11.nip.io hosts resolve to it. If the LAN IP changes (DHCP), re-point the test hosts + re-seed (ask the dev).

1 · Fast lane — prove every detection core (2 min, no browser)

cd /Users/resecsystems/Documents/viyuh-soar-backend_local
for t in bdr/tests/*.test.mjs bdr/tests/*-verify.mjs; do
  printf "%-40s " "$(basename "$t")"; node "$t" 2>&1 | grep -iE '[0-9]+ passed' | tail -1
done

Expect every line N passed, 0 failed except credreuse-range-verify.mjs (1 pre-existing cosmetic label). If any other file fails, a core regressed. This proves the *logic*; the sections below prove the *live wiring*.

2 · Phishing & AiTM / Token Theft (9 live)

Live range: http://localhost:4005/phishing/ · cores: node bdr/tests/{brandimp,homograph,aitm}-range-verify.mjs

3 · Web-Based Attacks / Malicious Websites (19 live)

Live range: http://localhost:4005/web-attacks/ · core: node bdr/tests/cat2-webattacks.test.mjs (155/0)

4 · Malicious File Analysis (12 live)

Live range: http://localhost:4005/file-analysis/ · core: node bdr/tests/file-analysis.test.mjs (46/0) · downloads via :8090

5 · Malicious & Risky Browser Extensions (13 live)

Core (definitive): node bdr/tests/extensions-detect.test.mjs (10/0) · live via /bdr/extensions → Test tab (dev build only)

6 · Malicious QR Codes (4 live)

Live range: http://localhost:4005/qr/ · core: node bdr/tests/malicious-qr.test.mjs (25/0)

7 · In-Browser DLP & Shadow-AI (~45 live)

Live range: http://localhost:4005/dlp/ · admin console: http://localhost:3000/bdr/dlp · core: node bdr/tests/dlp.test.mjs (129/0) · full case list: bdr/testing/dlp/DLP_TEST_CASES.md

Too many to list per-row; the headline ones the testing team should hit:

Enforcement mode + sanctioned/corporate/restricted host lists are all set on /bdr/dlp.

8 · Insider Threat & Last-Mile Control (5 live)

Admin console: http://localhost:3000/bdr/insider · cores: node bdr/tests/{last-mile,jit-access,ueba}.test.mjs (18/14/9). Demo policy is live: sensitive app sensitive-app.192-168-1-11.nip.io, JIT app jit-app.192-168-1-11.nip.io.

Configure all of the above (sensitive apps, per-action mode, JIT hosts, UEBA thresholds, watermark) from /bdr/insider.

Known limits (honest — for the testing team's report): last-mile controls & the JIT/watermark overlays are *client-side*, so a determined insider with DevTools can remove an overlay or use a channel not yet hooked (async clipboard API from the console, view-source, disabling JS, a second browser). UEBA's burst detector catches *fast* exfil; a patient "low-and-slow" drip below the threshold needs the cloud-baseline tier (roadmap). These are architectural limits of any browser-extension control — true enforcement needs the endpoint agent / managed policy.

8b · Threat Extraction (CDR) — inline-cdr

Downloads of Office/PDF/email/archives are intercepted and rebuilt clean (active content stripped).

• Test: download :8090/disguised-invoice.pdf (a PDF carrying JavaScript + a Launch action).
• CDR engine UP (:8000): "Disarming…" → "Disarmed — removed javascript", a clean file lands.
• CDR engine DOWN: ONE "CDR unavailable" (auto-clears), file delivered as-is; after 2, the circuit-breaker pauses — no notification storm (fixed).

9 · Roadmap — NOT yet implemented (do not test)

These catalog categories are planned but not built — no detections will fire:

• SaaS & Identity (ITDR) — SSO enforcement, MFA-gap, OAuth-scope, device-code phishing, etc.
• Browser & File Isolation — RBI, disposable cloud browser, cloud file isolation.
• Agentic AI Security — prompt-injection, agent action confirmation, MCP abuse (only ai-dlp-prompts is live).
• SOC Telemetry & Integrations — SIEM/SOAR/STIX/EDR/CASB.
• Cloud Email Security (inbound + internal) — mailbox analysis, BEC, mass-forwarding, ATO.

10 · Regression tripwires (run after any change)

Precision-first = no new false positives. These must stay green:

node bdr/tests/legit-domains-fp.test.mjs      # 66/0 — real brands never flagged
node bdr/tests/brandimp-range-verify.mjs      # 29/0 — incl. S5 okta/github SILENT
node bdr/tests/extensions-detect.test.mjs     # 10/0 — uBlock-class silent
node bdr/tests/dlp.test.mjs                    # 129/0 — prose/UUID clean

Full suite: for t in bdr/tests/*.mjs; do node "$t"; done → all green except the 1 known credreuse cosmetic label.

*Companion docs: LOOPHOLE_TEST_GUIDE.md (52-loophole one-by-one) · LOOPHOLE_FIXES.md (fix catalog) · the live launcher http://localhost:4005/ links every test page.*