Browser security test lab

Sensitive file generator NEW Build CSV, XLSX, JSON, TXT or HTML files of fake customers, optionally zipped or Base64. /dlp/generate Drag & drop files NEW Drag-and-drop upload and drag-out download, separate from the file picker. /dlp/dragdrop EICAR antivirus test file NEW The harmless standard test file every antivirus flags; plain or zipped. /files/eicar Files download Lists test files (PDF, ZIP, TXT, no-extension) for one-click download. /files Download methods Many ways to trigger a download (anchor, blob, data URI, fetch, form…). /download-methods Upload (≤ 5 MB) File upload form; saved to uploads/. Larger files are rejected. /upload-form Chunked stream Response streamed in chunks without Content-Length. /streaming Stream a file, no length Streams a test file as attachment with no Content-Length header. /streaming2/sample.zip

Sensitive data patterns NEW Copy-ready SSNs, test cards, IBAN, cloud keys and labels for DLP rule checks. /dlp/patterns Clipboard copy & paste NEW Copy via API, execCommand or keyboard; paste and read back, with an event log. /dlp/clipboard Exfiltration channels NEW Send one fake record via form, fetch, XHR, beacon, image, upload and Base64; compare what arrives. /dlp/exfil Confidential report view NEW Fake confidential table for screenshot, print, save-as, screen-share and watermark tests. /dlp/sensitive-view Modal DLP test Modal dialog showing fake SSNs and emails for masking/copy tests. /modal-dlp Print z-order test Reproduces print overlay / z-index layering behaviour. /print-zorder-test Test modal Simple in-page modal. /test-modal Test overlay Full-page overlay layer. /test-overlay Referral form (Workday style) Form that mimics a referral page for detection tests. /workday Referral form v2 Shorter variant of the referral form. /workday2 Cropguide test Third-party script injection test (Cropguide widget). /cropguide

Browser capabilities NEW Which web APIs are exposed: clipboard, capture, WebRTC, WebGL, storage, client hints. /browser/capabilities Cookies & storage NEW SameSite, HttpOnly and session cookies plus local storage and IndexedDB persistence. /browser/storage User-agent mirror Echoes your user agent and all request headers; sets a test cookie. /what-is-my-user-agent Browser fingerprint FingerprintJS2 hash of this browser. /fingerprint Fingerprint diff detector Shows which fingerprint components change between visits. /fingerprint-diffs Cookie viewer Lists cookies and sets a 300-day test cookie on first visit. /show_cookies

Who am I NEW Your IP, client hints, fetch metadata and privacy headers as the server sees them. /net/whoami DNS lookup NEW Resolve a hostname with the server's DNS and see addresses and timing. /net/dns HTTP behaviour tools NEW Pick a status code, delay, redirect chain, download size or mismatched file type. /net/tools Server-sent events NEW Long-lived event stream to check proxy buffering. /net/sse Echo log NEW What /api/echo received from the exfiltration and drag & drop tests. /api/echo/log

Random images Loads ~70 images, no caching, to measure page load. /random-images

Popups & dialogs NEW window.open with and without a click, alert/confirm/prompt, fullscreen, notifications, leave-page warning. /browser/popups Iframe with CORS Embeddable page that sends open CORS headers. /iframe Iframe content Small content page meant to be framed. /iframe-content Self-closing tab Button opens a tab that closes itself after 5 seconds. /button_page

Two-step login Username → password → /hello shows what was entered. Displays the password back. Never use real credentials. /username Password field reader Button reads a password field via JavaScript. /passpop

Device lookup by email Looks up a user's devices through the Island management API. Needs ISLAND_MGMT_API_KEY in .env /submit-email Approval workflow Receives bypass requests (POST JSON) and lets you approve or deny them. Needs ISLAND_WORKFLOW_API_KEY in .env. Data in data/requests.jsonl /requestApproval Agent finder (embedded) Embedded third-party agent-finder page. /agent-finder

UTF-8 page (Chinese) Non-Latin page to check encoding handling. /error Privacy policy: HeadMod extension Privacy policy for the Badam HeadMod browser extension. /privacy-policy-badam-modheader Classic homepage The original Confused Cat Coder homepage. /classic