{"categories":[{"blurb":"Download, upload and streaming behaviour.","icon":"\u2b07","id":"files","name":"Files & Downloads","pages":[{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Build CSV, XLSX, JSON, TXT or HTML files of fake customers, optionally zipped or Base64.","method":"GET","new":true,"path":"/dlp/generate","show":true,"source":"lab/generate.html","tags":["dlp","download","csv","xlsx","zip"],"title":"Sensitive file generator"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Drag-and-drop upload and drag-out download, separate from the file picker.","method":"GET","new":true,"path":"/dlp/dragdrop","show":true,"source":"lab/dragdrop.html","tags":["upload","drag","download"],"title":"Drag & drop files"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"The harmless standard test file every antivirus flags; plain or zipped.","method":"GET","new":true,"path":"/files/eicar","show":true,"source":"inline (lab.py)","tags":["malware","antivirus","download"],"title":"EICAR antivirus test file"},{"added":"Mon, 10 Mar 2025 00:00:00 GMT","desc":"Lists test files (PDF, ZIP, TXT, no-extension) for one-click download.","method":"GET","notes":"Files live in static/files_for_test/","path":"/files","show":true,"source":"files.html","tags":["download","dlp","pdf","zip"],"title":"Files download"},{"added":"Fri, 04 Apr 2025 00:00:00 GMT","desc":"Many ways to trigger a download (anchor, blob, data URI, fetch, form\u2026).","method":"GET","path":"/download-methods","show":true,"source":"download_methods.html","tags":["download","blob","fetch"],"title":"Download methods"},{"added":"Thu, 03 Apr 2025 00:00:00 GMT","desc":"File upload form; saved to uploads/. Larger files are rejected.","method":"GET \u2192 POST /upload","path":"/upload-form","show":true,"source":"upload.html","tags":["upload","dlp"],"title":"Upload (\u2264 5 MB)"},{"added":"Fri, 28 Mar 2025 00:00:00 GMT","desc":"Response streamed in chunks without Content-Length.","method":"GET","path":"/streaming","show":true,"source":"inline","tags":["stream","chunked"],"title":"Chunked stream"},{"added":"Fri, 28 Mar 2025 00:00:00 GMT","desc":"Streams a test file as attachment with no Content-Length header.","method":"GET","notes":"Any file name from static/files_for_test/ works.","path":"/streaming2/sample.zip","show":true,"source":"inline","tags":["stream","download"],"title":"Stream a file, no length"}]},{"blurb":"Sensitive data, clipboard, print and overlay controls.","icon":"\ud83d\udee1","id":"dlp","name":"DLP & Data Protection","pages":[{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Copy-ready SSNs, test cards, IBAN, cloud keys and labels for DLP rule checks.","method":"GET","new":true,"path":"/dlp/patterns","show":true,"source":"lab/patterns.html","tags":["dlp","ssn","pci","secrets","clipboard"],"title":"Sensitive data patterns"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Copy via API, execCommand or keyboard; paste and read back, with an event log.","method":"GET","new":true,"path":"/dlp/clipboard","show":true,"source":"lab/clipboard.html","tags":["dlp","clipboard","copy","paste"],"title":"Clipboard copy & paste"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Send one fake record via form, fetch, XHR, beacon, image, upload and Base64; compare what arrives.","method":"GET","new":true,"notes":"Results in /api/echo/log","path":"/dlp/exfil","show":true,"source":"lab/exfil.html","tags":["dlp","upload","beacon","fetch","exfil"],"title":"Exfiltration channels"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Fake confidential table for screenshot, print, save-as, screen-share and watermark tests.","method":"GET","new":true,"path":"/dlp/sensitive-view","show":true,"source":"lab/sensitive_view.html","tags":["dlp","print","screenshot","watermark"],"title":"Confidential report view"},{"added":"Wed, 12 Mar 2025 00:00:00 GMT","desc":"Modal dialog showing fake SSNs and emails for masking/copy tests.","method":"GET","path":"/modal-dlp","show":true,"source":"modal_dlp.html","tags":["dlp","ssn","modal","masking"],"title":"Modal DLP test"},{"desc":"Reproduces print overlay / z-index layering behaviour.","method":"GET","path":"/print-zorder-test","show":true,"source":"inline","tags":["print","overlay"],"title":"Print z-order test"},{"desc":"Simple in-page modal.","method":"GET","path":"/test-modal","show":true,"source":"inline","tags":["modal"],"title":"Test modal"},{"desc":"Full-page overlay layer.","method":"GET","path":"/test-overlay","show":true,"source":"inline","tags":["overlay"],"title":"Test overlay"},{"desc":"Form that mimics a referral page for detection tests.","method":"GET","path":"/workday","show":true,"source":"Workday.html","tags":["form","detection"],"title":"Referral form (Workday style)"},{"desc":"Shorter variant of the referral form.","method":"GET","path":"/workday2","show":true,"source":"Workday2.html","tags":["form"],"title":"Referral form v2"},{"added":"Wed, 18 Jun 2025 00:00:00 GMT","desc":"Third-party script injection test (Cropguide widget).","method":"GET","path":"/cropguide","show":true,"source":"cropguide-test-20250618.html","tags":["script","third-party"],"title":"Cropguide test"}]},{"blurb":"User agent, headers, cookies and fingerprinting.","icon":"\ud83e\uddec","id":"browser","name":"Browser Identity","pages":[{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Which web APIs are exposed: clipboard, capture, WebRTC, WebGL, storage, client hints.","method":"GET","new":true,"path":"/browser/capabilities","show":true,"source":"lab/capabilities.html","tags":["browser","api","fingerprint"],"title":"Browser capabilities"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"SameSite, HttpOnly and session cookies plus local storage and IndexedDB persistence.","method":"GET","new":true,"path":"/browser/storage","show":true,"source":"lab/storage.html","tags":["cookie","storage","session"],"title":"Cookies & storage"},{"desc":"Echoes your user agent and all request headers; sets a test cookie.","method":"GET","path":"/what-is-my-user-agent","show":true,"source":"inline","tags":["headers","user-agent","cookie"],"title":"User-agent mirror"},{"added":"Mon, 31 Mar 2025 00:00:00 GMT","desc":"FingerprintJS2 hash of this browser.","method":"GET","path":"/fingerprint","show":true,"source":"fingerprint.html","tags":["fingerprint"],"title":"Browser fingerprint"},{"added":"Mon, 31 Mar 2025 00:00:00 GMT","desc":"Shows which fingerprint components change between visits.","method":"GET","path":"/fingerprint-diffs","show":true,"source":"fingerprint-diffs.html","tags":["fingerprint","diff"],"title":"Fingerprint diff detector"},{"added":"Tue, 22 Apr 2025 00:00:00 GMT","desc":"Lists cookies and sets a 300-day test cookie on first visit.","method":"GET","path":"/show_cookies","show":true,"source":"inline","tags":["cookie"],"title":"Cookie viewer"}]},{"blurb":"DNS, request inspection and HTTP edge cases.","icon":"\ud83c\udf10","id":"network","name":"Network & HTTP","pages":[{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Your IP, client hints, fetch metadata and privacy headers as the server sees them.","method":"GET","new":true,"path":"/net/whoami","show":true,"source":"lab/whoami.html","tags":["ip","headers","network"],"title":"Who am I"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Resolve a hostname with the server's DNS and see addresses and timing.","method":"GET","new":true,"path":"/net/dns","show":true,"source":"lab/dns.html","tags":["dns","network"],"title":"DNS lookup"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Pick a status code, delay, redirect chain, download size or mismatched file type.","method":"GET","new":true,"path":"/net/tools","show":true,"source":"lab/nettools.html","tags":["http","status","redirect","proxy","mime"],"title":"HTTP behaviour tools"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"Long-lived event stream to check proxy buffering.","method":"GET","new":true,"path":"/net/sse","show":true,"source":"lab/sse.html","tags":["stream","sse","proxy"],"title":"Server-sent events"},{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"What /api/echo received from the exfiltration and drag & drop tests.","method":"GET","new":true,"path":"/api/echo/log","show":true,"source":"lab/echo_log.html","tags":["log","echo"],"title":"Echo log"}]},{"blurb":"Load and rendering checks.","icon":"\u26a1","id":"performance","name":"Performance","pages":[{"added":"Wed, 26 Mar 2025 00:00:00 GMT","desc":"Loads ~70 images, no caching, to measure page load.","method":"GET","path":"/random-images","show":true,"source":"random_images.html","tags":["images","performance","cache"],"title":"Random images"}]},{"blurb":"Window, iframe and popup behaviour.","icon":"\ud83e\ude9f","id":"frames","name":"Tabs, Frames & Popups","pages":[{"added":"Mon, 26 Oct 2026 00:00:00 GMT","desc":"window.open with and without a click, alert/confirm/prompt, fullscreen, notifications, leave-page warning.","method":"GET","new":true,"path":"/browser/popups","show":true,"source":"lab/popups.html","tags":["popup","dialog","notification"],"title":"Popups & dialogs"},{"desc":"Embeddable page that sends open CORS headers.","method":"GET","path":"/iframe","show":true,"source":"iframe.html","tags":["iframe","cors"],"title":"Iframe with CORS"},{"desc":"Small content page meant to be framed.","method":"GET","path":"/iframe-content","show":true,"source":"inline","tags":["iframe"],"title":"Iframe content"},{"added":"Thu, 29 May 2025 00:00:00 GMT","desc":"Button opens a tab that closes itself after 5 seconds.","method":"GET","path":"/button_page","show":true,"source":"inline","tags":["tab","popup"],"title":"Self-closing tab"},{"added":"Mon, 21 Jul 2025 00:00:00 GMT","desc":"Placeholder test page.","method":"GET","path":"/dummy","show":false,"source":"inline","tags":["misc"],"title":"Dummy page"},{"added":"Mon, 21 Jul 2025 00:00:00 GMT","desc":"Placeholder page that fetches content.","method":"GET","path":"/dummy2","show":false,"source":"inline","tags":["misc","fetch"],"title":"Dummy page 2"}]},{"blurb":"Login flows and password field handling. Test data only.","icon":"\ud83d\udd11","id":"auth","name":"Credentials & Forms","pages":[{"desc":"Username \u2192 password \u2192 /hello shows what was entered.","method":"GET \u2192 POST","notes":"Displays the password back. Never use real credentials.","path":"/username","show":true,"source":"username.html, password.html","tags":["login","password","phishing"],"title":"Two-step login"},{"desc":"Button reads a password field via JavaScript.","method":"GET","path":"/passpop","show":true,"source":"inline","tags":["password","javascript"],"title":"Password field reader"}]},{"blurb":"Calls to Island APIs. Need keys in .env.","icon":"\ud83c\udfdd","id":"island","name":"Island Integrations","pages":[{"added":"Thu, 08 May 2025 00:00:00 GMT","desc":"Looks up a user's devices through the Island management API.","method":"GET/POST","notes":"Needs ISLAND_MGMT_API_KEY in .env","path":"/submit-email","show":true,"source":"submit_email.html","tags":["island","api","devices"],"title":"Device lookup by email"},{"added":"Tue, 29 Apr 2025 00:00:00 GMT","desc":"Receives bypass requests (POST JSON) and lets you approve or deny them.","method":"GET/POST","notes":"Needs ISLAND_WORKFLOW_API_KEY in .env. Data in data/requests.jsonl","path":"/requestApproval","show":true,"source":"inline","tags":["island","api","approval"],"title":"Approval workflow"},{"added":"Mon, 21 Apr 2025 00:00:00 GMT","desc":"Embedded third-party agent-finder page.","method":"GET","path":"/agent-finder","show":true,"source":"agent-finder.html","tags":["embed","third-party"],"title":"Agent finder (embedded)"}]},{"blurb":"Encoding checks and policy pages.","icon":"\ud83d\udcc4","id":"misc","name":"Misc & Legal","pages":[{"desc":"Non-Latin page to check encoding handling.","method":"GET","path":"/error","show":true,"source":"inline","tags":["encoding","utf-8"],"title":"UTF-8 page (Chinese)"},{"added":"Wed, 05 Aug 2026 00:00:00 GMT","desc":"Privacy policy for the Badam HeadMod browser extension.","method":"GET","path":"/privacy-policy-badam-modheader","show":true,"source":"privacy-policy-modheader.md","tags":["policy","extension"],"title":"Privacy policy: HeadMod extension"},{"desc":"The original Confused Cat Coder homepage.","method":"GET","path":"/classic","show":true,"source":"index.html","tags":["legacy"],"title":"Classic homepage"}]}]}