🛡️ VIYUH BDR — Tester's Guide
First time testing? Read this once (5 min). It tells you what BDR is, what to look for, and how to report what you find. No tech background needed.
▶ Open the Test Console
All individual test pages
What is this?
VIYUH BDR is a browser extension that catches phishing — fake websites and emails that try to steal your password, money, or login. Your job as a tester is simple: open the test pages, see if BDR catches the fake ones, and report anything it misses or wrongly flags.
1Install the extension
- Download:
http://localhost:4004/ext/bdr-extension-unpacked.zip and unzip it.
- Open
chrome://extensions in Chrome → turn on Developer mode (top-right).
- Click Load unpacked → pick the unzipped folder.
- You should see a card: VIYUH BDR version 0.5.0 (or higher). ✅ Installed.
Tip: click the card's “service worker” link to open BDR's log window — you'll see a line every time it catches something. Keep it open while testing.
2Know the 5 things BDR can do
When you open a test page, BDR reacts in one of these ways. Each test tells you which one to expect — your job is to confirm you saw it.
🛑
BLOCK page stop
A full red page covers the site: “This site may be deceptive.” For confident, dangerous threats (known phishing, fake browser windows). You cannot use the site.
⚠️
WARNING page caution
An amber page with a “Proceed anyway” button. For likely look-alike domains (e.g. micros0ft.com). You're warned but can continue if you're sure.
🔔
In-page BANNER notice
A small card on the page itself (the site still loads). For hygiene: a fake brand login, a re-used password, or a weak password.
🟩
QR neutralized blurred
A bad QR code gets blurred with a “Blocked by VIYUH BDR” badge so you can't scan it. The rest of the page/inbox stays usable.
😶
Nothing (silent) safe
For safe pages, BDR does nothing — the page just loads normally. This is correct! Some tests expect silence (those are the false-positive checks).
Example of BDR's log line (in the “service worker” window):
[BDR] DETECTION [high] homograph: Look-alike of microsoft (micros0ft.com) — immediate warn
3Run the tests
- Open the Test Console. It lists every test, grouped by feature.
- Each row has a 🌐/📄 open button (opens the test in a new tab), a plain description, and the expected result.
- Open the test → look at what happened → come back and click PASS (you saw the expected result) or FAIL (you didn't).
- Every test page also has a banner at the top reminding you what it is and what you should see — so you never have to guess.
Two kinds of “correct”: a red POSITIVE test PASSES when BDR catches it. A green NEGATIVE test PASSES when BDR stays silent (it's a safe page — flagging it would be a false alarm).
4Report what you find
When you're done (or hit a problem), click 📋 Copy report at the top of the console — it copies a ready-to-send summary, with a ⚠ FAILURES section. Paste it back to the team.
If something looks wrong, tell us:
- The case ID (e.g.
BI-F1) shown on the row.
- What you saw vs what was expected (“expected a banner, saw nothing”).
- A screenshot if you can, + the BDR log line if there was one.
One more thing — “Known gaps”
At the bottom of the console there's a 🟣 Known gaps section. Those are advanced attacks we already know BDR doesn't catch yet (they're on the roadmap). They're listed so you can confirm them and not report them as new bugs — but if you find a brand-new way to slip past BDR, that's gold: report it!
▶ Start testing now