Robindude LabSite catalog
Every route on the site, including hidden ones. Edit site_catalog.yaml, then run sudo systemctl restart robindude.
⬇ Files & Downloads 8
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/dlp/generate |
Sensitive file generator | Build CSV, XLSX, JSON, TXT or HTML files of fake customers, optionally zipped or Base64. | GET | lab/generate.html |
shown | 2026-10-26 | |
/dlp/dragdrop |
Drag & drop files | Drag-and-drop upload and drag-out download, separate from the file picker. | GET | lab/dragdrop.html |
shown | 2026-10-26 | |
/files/eicar |
EICAR antivirus test file | The harmless standard test file every antivirus flags; plain or zipped. | GET | inline (lab.py) |
shown | 2026-10-26 | |
/files |
Files download | Lists test files (PDF, ZIP, TXT, no-extension) for one-click download. | GET | files.html |
shown | 2025-03-10 | Files live in static/files_for_test/ |
/download-methods |
Download methods | Many ways to trigger a download (anchor, blob, data URI, fetch, form…). | GET | download_methods.html |
shown | 2025-04-04 | |
/upload-form |
Upload (≤ 5 MB) | File upload form; saved to uploads/. Larger files are rejected. | GET → POST /upload | upload.html |
shown | 2025-04-03 | |
/streaming |
Chunked stream | Response streamed in chunks without Content-Length. | GET | inline |
shown | 2025-03-28 | |
/streaming2/sample.zip |
Stream a file, no length | Streams a test file as attachment with no Content-Length header. | GET | inline |
shown | 2025-03-28 | Any file name from static/files_for_test/ works. |
🛡 DLP & Data Protection 11
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/dlp/patterns |
Sensitive data patterns | Copy-ready SSNs, test cards, IBAN, cloud keys and labels for DLP rule checks. | GET | lab/patterns.html |
shown | 2026-10-26 | |
/dlp/clipboard |
Clipboard copy & paste | Copy via API, execCommand or keyboard; paste and read back, with an event log. | GET | lab/clipboard.html |
shown | 2026-10-26 | |
/dlp/exfil |
Exfiltration channels | Send one fake record via form, fetch, XHR, beacon, image, upload and Base64; compare what arrives. | GET | lab/exfil.html |
shown | 2026-10-26 | Results in /api/echo/log |
/dlp/sensitive-view |
Confidential report view | Fake confidential table for screenshot, print, save-as, screen-share and watermark tests. | GET | lab/sensitive_view.html |
shown | 2026-10-26 | |
/modal-dlp |
Modal DLP test | Modal dialog showing fake SSNs and emails for masking/copy tests. | GET | modal_dlp.html |
shown | 2025-03-12 | |
/print-zorder-test |
Print z-order test | Reproduces print overlay / z-index layering behaviour. | GET | inline |
shown | — | |
/test-modal |
Test modal | Simple in-page modal. | GET | inline |
shown | — | |
/test-overlay |
Test overlay | Full-page overlay layer. | GET | inline |
shown | — | |
/workday |
Referral form (Workday style) | Form that mimics a referral page for detection tests. | GET | Workday.html |
shown | — | |
/workday2 |
Referral form v2 | Shorter variant of the referral form. | GET | Workday2.html |
shown | — | |
/cropguide |
Cropguide test | Third-party script injection test (Cropguide widget). | GET | cropguide-test-20250618.html |
shown | 2025-06-18 |
🧬 Browser Identity 6
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/browser/capabilities |
Browser capabilities | Which web APIs are exposed: clipboard, capture, WebRTC, WebGL, storage, client hints. | GET | lab/capabilities.html |
shown | 2026-10-26 | |
/browser/storage |
Cookies & storage | SameSite, HttpOnly and session cookies plus local storage and IndexedDB persistence. | GET | lab/storage.html |
shown | 2026-10-26 | |
/what-is-my-user-agent |
User-agent mirror | Echoes your user agent and all request headers; sets a test cookie. | GET | inline |
shown | — | |
/fingerprint |
Browser fingerprint | FingerprintJS2 hash of this browser. | GET | fingerprint.html |
shown | 2025-03-31 | |
/fingerprint-diffs |
Fingerprint diff detector | Shows which fingerprint components change between visits. | GET | fingerprint-diffs.html |
shown | 2025-03-31 | |
/show_cookies |
Cookie viewer | Lists cookies and sets a 300-day test cookie on first visit. | GET | inline |
shown | 2025-04-22 |
🌐 Network & HTTP 5
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/net/whoami |
Who am I | Your IP, client hints, fetch metadata and privacy headers as the server sees them. | GET | lab/whoami.html |
shown | 2026-10-26 | |
/net/dns |
DNS lookup | Resolve a hostname with the server's DNS and see addresses and timing. | GET | lab/dns.html |
shown | 2026-10-26 | |
/net/tools |
HTTP behaviour tools | Pick a status code, delay, redirect chain, download size or mismatched file type. | GET | lab/nettools.html |
shown | 2026-10-26 | |
/net/sse |
Server-sent events | Long-lived event stream to check proxy buffering. | GET | lab/sse.html |
shown | 2026-10-26 | |
/api/echo/log |
Echo log | What /api/echo received from the exfiltration and drag & drop tests. | GET | lab/echo_log.html |
shown | 2026-10-26 |
⚡ Performance 1
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/random-images |
Random images | Loads ~70 images, no caching, to measure page load. | GET | random_images.html |
shown | 2025-03-26 |
🪟 Tabs, Frames & Popups 6
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/browser/popups |
Popups & dialogs | window.open with and without a click, alert/confirm/prompt, fullscreen, notifications, leave-page warning. | GET | lab/popups.html |
shown | 2026-10-26 | |
/iframe |
Iframe with CORS | Embeddable page that sends open CORS headers. | GET | iframe.html |
shown | — | |
/iframe-content |
Iframe content | Small content page meant to be framed. | GET | inline |
shown | — | |
/button_page |
Self-closing tab | Button opens a tab that closes itself after 5 seconds. | GET | inline |
shown | 2025-05-29 | |
/dummy |
Dummy page | Placeholder test page. | GET | inline |
hidden | 2025-07-21 | |
/dummy2 |
Dummy page 2 | Placeholder page that fetches content. | GET | inline |
hidden | 2025-07-21 |
🔑 Credentials & Forms 2
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/username |
Two-step login | Username → password → /hello shows what was entered. | GET → POST | username.html, password.html |
shown | — | Displays the password back. Never use real credentials. |
/passpop |
Password field reader | Button reads a password field via JavaScript. | GET | inline |
shown | — |
🏝 Island Integrations 3
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/submit-email |
Device lookup by email | Looks up a user's devices through the Island management API. | GET/POST | submit_email.html |
shown | 2025-05-08 | Needs ISLAND_MGMT_API_KEY in .env |
/requestApproval |
Approval workflow | Receives bypass requests (POST JSON) and lets you approve or deny them. | GET/POST | inline |
shown | 2025-04-29 | Needs ISLAND_WORKFLOW_API_KEY in .env. Data in data/requests.jsonl |
/agent-finder |
Agent finder (embedded) | Embedded third-party agent-finder page. | GET | agent-finder.html |
shown | 2025-04-21 |
📄 Misc & Legal 3
| Path | Title | What it tests | Method | Source | Listed | Added | Notes |
|---|---|---|---|---|---|---|---|
/error |
UTF-8 page (Chinese) | Non-Latin page to check encoding handling. | GET | inline |
shown | — | |
/privacy-policy-badam-modheader |
Privacy policy: HeadMod extension | Privacy policy for the Badam HeadMod browser extension. | GET | privacy-policy-modheader.md |
shown | 2026-08-05 | |
/classic |
Classic homepage | The original Confused Cat Coder homepage. | GET | index.html |
shown | — |