# VIYUH BDR — Tester Suite

One place for a tester to exercise **every** BDR detection and record PASS/FAIL. It reuses the
real fixtures under `bdr/testing/` (no duplicate attack pages) and rolls up progress so you can
hand back a report.

**25 features · 317 test cases** (180 POS · 89 NEG · 48 LIVE), across two categories.

## Start here
1. Make sure the **BDR extension is loaded** and the **backend stack is running** (it reports detections + powers the LIVE checks).
2. Serve the test folder (content scripts need `http(s)`, not `file://`):
   ```
   node bdr/testing/serve.mjs      # → http://localhost:4005
   ```
3. Open the **collective master**: <http://localhost:4005/tester-suite/index.html>
   - Phishing only: `tester-suite/phishing/index.html`
   - Web-Attacks only: `tester-suite/web-attacks/index.html`
4. Keep **chrome://extensions → VIYUH BDR → "service worker"** open to watch detections live.

## How to test a case
- Click **open** on a row → the real test page loads.
- Watch the extension: it should do what the **Expected** column says.
- Click **PASS** (it matched) or **FAIL** (it didn't). Progress saves in your browser automatically.
- Use the **search box** and the **POS / NEG / LIVE** filter to focus. **Copy report** puts a
  markdown summary (with the list of any FAILED cases) on your clipboard to send back.

## What the case types mean
| Type | Meaning |
|------|---------|
| **POS** | An attack — the BDR **must detect** it (warn / block / banner / isolate). |
| **NEG** | A benign look-alike — the BDR **must stay silent** (false-positive guard). |
| **LIVE** | Needs a real host or the backend (can't fully fire from a plain localhost fixture). |

## LIVE cases — extra setup
- **Reputation, Newly-registered-domain, Geo-blocking** — need the **backend** (lake + RDAP + geoip). Just have the stack running.
- **Malvertising on a "real" host** — open the fixture via `http://malvert.127.0.0.1.nip.io:4005/...` (a real hostname that still points at your local server).
- **Clickjacking** — the overlay iframe must be **cross-origin**; the fixtures already use a different origin (`127.0.0.1` vs `localhost`).
- **Legit-service phishing / Multi-hop** — best validated on the **real services** (SharePoint, Google Docs, Dropbox) per each feature's note; the local fixtures use a test-origin meta override.
- **Drive-by download** — triggers on an actual **file download** from a risky host.
- **Social-referrer** — a real social platform → risky-site click.

## Each tester sees their own PC
Detections report to the shared backend tagged with this PC's **BDR id** (`bdrdev_…`, shown in the
extension popup). Open the dashboard at `/bdr/agents`, pick this PC, and you'll see **only your own**
machine's detections. The admin view (`/bdr`) shows the whole fleet.

## Maintaining the suite
- The single source of truth is **`data/catalog.js`** (`window.BDR_CATALOG`) — every feature + case,
  with paths relative to `bdr/testing/`.
- To add/adjust cases, edit `catalog.js`; the three pages render from it automatically.
- Design lives in `assets/suite.css`; behavior (PASS/FAIL, progress, report) in `assets/suite.js`.