VIYUH BDR — Loophole Test Console

ext v0.9.100 · reload before testing
:4004 api :4005 range :3000 dash :8090 files

Two ways to test. Layer 1 — the core self-tests below prove every detection's logic in ~2 min, no browser. Layer 2 — the live tests in each table below drive the wiring end-to-end; watch results on the /bdr dashboard (or curl -s localhost:4004/api/detections?limit=15 | jq '.items[]').

Before Layer 2: reload the extension → chrome://extensions → VIYUH BDR → ↻ (v0.9.100). Most new heuristics are WARN (proceed-able), not block — that's the precision-first design.

# Layer 1 — run EVERY core self-test (expect 715 pass / 1 fail = credreuse cosmetic)
cd /Users/resecsystems/Documents/viyuh-soar-backend_local
for t in bdr/tests/*.test.mjs bdr/tests/*-verify.mjs; do
  printf "%-42s " "$(basename "$t")"; node "$t" 2>&1 | grep -iE '[0-9]+ passed' | tail -1
done

3 Critical blind-spots

LoopholeLive testExpect (fires)Counter-check (silent)
S1
iframe-login
openframed-credential row (Card 1, flagged host in iframe)Card 2 (same-origin localhost) silent
S2
AiTM proxy
node bdr/tests/aitm-range-verify.mjs · live needs an /etc/hosts combosquat26/0 core; live: look-alike same-origin harvest → blockSSO that redirects to IdP silent
S6
magecart
opencard-exfil WARN on the two "skimmer" buttons"same-origin" + "order id" buttons silent

S5 Phishing — brand-as-subdomain

LoopholeLive testExpect (fires)Counter-check (silent)
S5open paypal.*brand-subdomain WARN ("paypal used as a subdomain…")okta.* → silent
corenode bdr/tests/brandimp-range-verify.mjs29/0 (paypal/chase/coinbase subdomains fire)okta/github/salesforce/adobe silent

12 In-Browser DLP & Shadow-AI

LoopholeLive testExpect (fires)Counter-check (silent)
#47a
ClickFix
openClickFix heads-up (powershell in clipboard)"Copy a normal note" silent
#47b
id-upload
openJUSTIFY (upload → personal me@gmail.com)corporate widget silent (with policy)
#47c
sensitive dl
secrets.env id_rsa.pemdownload-dlp WARN (credential file)report.csv → silent
#1,6,7,8,
9,10,26,27
DLP range · node bdr/tests/dlp.test.mjs129/0 core: anti-evasion, force-block, click-send, magic-byte, beacon/ws, shadow-DOM, file-dropprose / base64-image / UUID clean

7 Web-Based Attacks (Cat-2)

LoopholeLive testExpect (fires)Counter-check (silent)
#25,28,29,
30,52,S3,S4
web-attacks range · node bdr/tests/cat2-webattacks.test.mjs155/0 core: clickjacking, zero-width, de-glyph, path-IOC, NRD-corroboration, flag-propagationsearch-result-click redirects silent (#25)

8 Malicious File Analysis

LoopholeLive testExpect (fires)Counter-check (silent)
#19
oversize+danger
set cap=400/warn-only on dashboard, then big.iso.iso BLOCKED despite warn-only modebig.pdf → warn+delivered
#15,16,17,
33,34,35,37
file range · node bdr/tests/file-analysis.test.mjs46/0 core: data:/blob: decode, type-mismatch, chunked-oversize, iso/xll, RTF-OLEbenign RTF / non-dangerous large types silent

5 Malicious QR Codes

LoopholeLive testExpect (fires)Counter-check (silent)
#41
rotated
openrotated 90° QR still decodes + fires (scheme)rotated non-QR → nothing
#38,39,40,50QR range · node bdr/tests/malicious-qr.test.mjs25/0 core: dangerous scheme, short-link unfurl, open-redirect, age-gateclean QR / aged-known host silent

6 Malicious Extensions

LoopholeTestExpect (fires)Counter-check (silent)
#5,#42
(+4,20,21,22)
node bdr/tests/extensions-detect.test.mjs10/0: unpopular <all_urls> → WARN; "Vendor: ChatGPT" + risky perms → ai-impersonationuBlock-class + "Liner: ChatGPT" silent
#51,#43,#23dev-build only: /bdr/extensions → Test tab#51 injects only on DEV build; #43 alarm=30min; #23 sideload block (opt-in)prod install ignores injected set

5 Insider Threat & Last-Mile Control

FeatureLive testExpect (fires)Counter-check (silent)
watermarkingopenidentity overlay in ~1–3 s (page has secrets)plain page → no overlay
last-mile controlsopen sensitive appcopy / cut / drag / print / right-click / save / download all blocked + toastsame page on localhost → nothing blocked
JIT accessopen JIT appreason interstitial covers the page; enter reason → granted 30 minnon-JIT host → opens straight through
session recordingSW console: chrome.storage.local.get('bdr_session_timeline')metadata timeline (nav / download / last-mile / jit)no keystrokes / content / screen
UEBAdownload 6+ files from :8090 in <1 min"Exfil-burst: N downloads" on /bdr within ~1 min<6 downloads → nothing

Configure sensitive apps / last-mile modes / JIT hosts / UEBA thresholds at /bdr/insider.

+ CDR notification-loop fix (bonus)

WhatTestExpectNote
disarm loopdisguised-invoice.pdf (download 2–3×)ONE "CDR unavailable" per file, auto-clears; after 2, circuit-breaker → silent. No storm.Engine :8000 is down → pass-through. Start :8000 to see real disarm.

All artifacts pre-staged & verified. Precision-first: only near-zero-FP structural signals ever block; new heuristics warn.
Full feature handbook (every category): bdr/BDR_FEATURE_TEST_HANDBOOK.md · loophole runbook: bdr/LOOPHOLE_TEST_GUIDE.md · dashboard: localhost:3000/bdr