POS = must detect · NEG = must stay silent · LIVE = needs a real host / backend (geo, NRD, reputation, malvertising on a real host). Some web-attacks need cross-origin or a non-localhost host — see the LIVE note on each feature.
VIYUH BDR Tester Suite · Web-Attacks · serve via the test server, not file://