🛡️ Category 1 — Phishing & AiTM

One test page per feature. Open each, follow the on-page steps, watch the BDR service-worker console + dashboard.
📖 NEW TO TESTING? — Read the Tester's Guide firstread me
Plain-English: what BDR is, the 5 results to look for (block / warn / banner / QR-blur / silent), how to run tests + report. No tech background needed.
Backend (:4004) + SOAR (:4000) + extension loaded. Watch chrome://extensions → VIYUH BDR → service worker and http://localhost:3000 → Incidents. Open pages fresh.
⭐ MASTER TEST CONSOLE — all features, one pagestart here
Every Category-1 case (positives, FP guards, v0.5.0 fixes, known-gaps) — launchable with PASS/FAIL tracking + copy-report. Hand this to the team.
🔴 LIVE TESTS — real Gmail / Drive / real sites (step-by-step)live
8 real-world tests with numbered steps a newbie can follow: malicious QR in Gmail, QR via Drive link, phishing link+attachment, look-alike domains, known-bad domains, password reuse, weak password.
1 · Homograph / typosquattinghigh
Look-alike domains (micros0ft, paypa1, IDN).
2 · AiTM / SSO-clone — deep test sethigh
25 cases: visible-text clones (8 brands), OCR text-as-image (5), kit fingerprints (4), off-domain credential relay (5), negatives (3). Grid: dataset.
3 · Credential-reuse — deep test setmedium
Same password reused across SaaS apps (no SSO needed). 5-step guided flow + negatives. Privacy: salted hash only. Grid: dataset.
3b · Password-strength — deep test setlow
Weak-password policy (SquareX). On-device scoring (score only, never the password); weak → in-page warning. Grid: dataset.
4 · Brand-impersonationmedium
Fake PayPal login on a non-PayPal domain.
5 · Browser-in-the-Browserhigh
Fake in-page browser window spoofing Apple.
6 · QR / quishinghigh
QR code hiding a look-alike phishing URL.
7 · Webmail responsehigh
Mock webmail: phishing link + .exe attachment.
+ Reputation (data lake)high
Known-bad domains from the Redis lake (not look-alikes).
Negative controlsnone
Should NOT detect — false-positive check.