Two ways to test. Layer 1 — the core self-tests below prove every detection's logic in ~2 min, no browser. Layer 2 — the live tests in each table below drive the wiring end-to-end; watch results on the /bdr dashboard (or curl -s localhost:4004/api/detections?limit=15 | jq '.items[]').
Before Layer 2: reload the extension → chrome://extensions → VIYUH BDR → ↻ (v0.9.100). Most new heuristics are WARN (proceed-able), not block — that's the precision-first design.
# Layer 1 — run EVERY core self-test (expect 715 pass / 1 fail = credreuse cosmetic) cd /Users/resecsystems/Documents/viyuh-soar-backend_local for t in bdr/tests/*.test.mjs bdr/tests/*-verify.mjs; do printf "%-42s " "$(basename "$t")"; node "$t" 2>&1 | grep -iE '[0-9]+ passed' | tail -1 done
| Loophole | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| S1 iframe-login | open | framed-credential row (Card 1, flagged host in iframe) | Card 2 (same-origin localhost) silent |
| S2 AiTM proxy | node bdr/tests/aitm-range-verify.mjs · live needs an /etc/hosts combosquat | 26/0 core; live: look-alike same-origin harvest → block | SSO that redirects to IdP silent |
| S6 magecart | open | card-exfil WARN on the two "skimmer" buttons | "same-origin" + "order id" buttons silent |
| Loophole | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| S5 | open paypal.* | brand-subdomain WARN ("paypal used as a subdomain…") | okta.* → silent |
| core | node bdr/tests/brandimp-range-verify.mjs | 29/0 (paypal/chase/coinbase subdomains fire) | okta/github/salesforce/adobe silent |
| Loophole | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| #47a ClickFix | open | ClickFix heads-up (powershell in clipboard) | "Copy a normal note" silent |
| #47b id-upload | open | JUSTIFY (upload → personal me@gmail.com) | corporate widget silent (with policy) |
| #47c sensitive dl | secrets.env id_rsa.pem | download-dlp WARN (credential file) | report.csv → silent |
| #1,6,7,8, 9,10,26,27 | DLP range · node bdr/tests/dlp.test.mjs | 129/0 core: anti-evasion, force-block, click-send, magic-byte, beacon/ws, shadow-DOM, file-drop | prose / base64-image / UUID clean |
| Loophole | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| #25,28,29, 30,52,S3,S4 | web-attacks range · node bdr/tests/cat2-webattacks.test.mjs | 155/0 core: clickjacking, zero-width, de-glyph, path-IOC, NRD-corroboration, flag-propagation | search-result-click redirects silent (#25) |
| Loophole | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| #19 oversize+danger | set cap=400/warn-only on dashboard, then big.iso | .iso BLOCKED despite warn-only mode | big.pdf → warn+delivered |
| #15,16,17, 33,34,35,37 | file range · node bdr/tests/file-analysis.test.mjs | 46/0 core: data:/blob: decode, type-mismatch, chunked-oversize, iso/xll, RTF-OLE | benign RTF / non-dangerous large types silent |
| Loophole | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| #41 rotated | open | rotated 90° QR still decodes + fires (scheme) | rotated non-QR → nothing |
| #38,39,40,50 | QR range · node bdr/tests/malicious-qr.test.mjs | 25/0 core: dangerous scheme, short-link unfurl, open-redirect, age-gate | clean QR / aged-known host silent |
| Loophole | Test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| #5,#42 (+4,20,21,22) | node bdr/tests/extensions-detect.test.mjs | 10/0: unpopular <all_urls> → WARN; "Vendor: ChatGPT" + risky perms → ai-impersonation | uBlock-class + "Liner: ChatGPT" silent |
| #51,#43,#23 | dev-build only: /bdr/extensions → Test tab | #51 injects only on DEV build; #43 alarm=30min; #23 sideload block (opt-in) | prod install ignores injected set |
| Feature | Live test | Expect (fires) | Counter-check (silent) |
|---|---|---|---|
| watermarking | open | identity overlay in ~1–3 s (page has secrets) | plain page → no overlay |
| last-mile controls | open sensitive app | copy / cut / drag / print / right-click / save / download all blocked + toast | same page on localhost → nothing blocked |
| JIT access | open JIT app | reason interstitial covers the page; enter reason → granted 30 min | non-JIT host → opens straight through |
| session recording | SW console: chrome.storage.local.get('bdr_session_timeline') | metadata timeline (nav / download / last-mile / jit) | no keystrokes / content / screen |
| UEBA | download 6+ files from :8090 in <1 min | "Exfil-burst: N downloads" on /bdr within ~1 min | <6 downloads → nothing |
Configure sensitive apps / last-mile modes / JIT hosts / UEBA thresholds at /bdr/insider.
| What | Test | Expect | Note |
|---|---|---|---|
| disarm loop | disguised-invoice.pdf (download 2–3×) | ONE "CDR unavailable" per file, auto-clears; after 2, circuit-breaker → silent. No storm. | Engine :8000 is down → pass-through. Start :8000 to see real disarm. |
All artifacts pre-staged & verified. Precision-first: only near-zero-FP structural signals ever block; new heuristics warn.
Full feature handbook (every category): bdr/BDR_FEATURE_TEST_HANDBOOK.md · loophole runbook: bdr/LOOPHOLE_TEST_GUIDE.md · dashboard: localhost:3000/bdr