puppys.click KB Sensor Test Fixture
All 4 sensors scoped to puppys.click only — eval_hook, shadow_dom_patch_research, shadow_dom_kb_collection_test, shadow_dom_image_hashes_test.
uid_pattern: ^uid_fefe · url: puppys\.click
eval #1 — ClickFix payload fire
>300 chars and keywords: powershell, curl, iex, frombase64string, verify you are human, Win+R.
eval #2 — short benign no fire
<300 chars, no keywords.
eval #3 — long benign no fire
>300 chars but zero malicious keywords → keyword gate blocks.
eval #4 — short malicious no fire
Has keywords but <300 chars → length gate blocks.
eval #5 — ClickFix with ✅ emoji fire
>300 chars, contains the actual ✅ checkmark emoji + verify + captcha. Tests the Unicode emoji match in payloadMatcher.
shadow #1 — >100 chars, clean text fire
innerText >100 chars, no \n\n\n runs. Extractor captures textContent + URLs + id + className.
shadow #2 — nested, long clean text fire
Nested shadow hosts, each >100 chars innerText, no triple-newline.
shadow #3 — long but triple-newline spam no fire
innerText >100 chars but contains \n\n\n → negation gate blocks.
shadow #4 — short text (<100 chars) no fire
innerText is only ~30 chars → length gate blocks.
shadow #5 — CLOSED root no fire
Closed shadow roots are invisible to the patch.
shadow #6 — extension-origin stack no fire
Shadow host created by a Chrome extension (filtered by shadowDomFilter.stackTrace). Simulated via comment in log.
form#practice-login inside shadow fire
A <form id="practice-login"> inside an open shadow root. The tab sensor with shadowDom: "on" should reach in and extract outerHTML.
wrong form id inside shadow no fire
<form id="other-form"> — selector form#practice-login won't match.
image hash — img[src] inside shadow fire
An <img src="..."> inside an open shadow root (>5KB). The asset_collection sensor with shadowDom: "on" should hash it.
image negative — tiny image no fire
1x1 pixel image inside shadow — below minSize: 5000 filter.
HTML Extraction Targets
Practice writing CSS selectors, matchers, and extractors against real HTML structures. No Shadow DOM here — just regular DOM elements.
Login Form
Classic phishing target. Try extracting action attribute, input names, or the form's outerHTML.
Credit Card Form
Payment skimmer target. Multiple input types, autocomplete attributes, and a nested fieldset.
Search Form
Benign form. Try distinguishing it from phishing forms by method="GET", role="search", and absence of sensitive input types.
Suspicious Links
Various link patterns. Practice matching by href regex, target, rel, data-* attributes, or text content.
Navigation Bar
A <nav> with a list of links. Practice targeting by semantic tag, aria-label, or child selectors.
Data-Attribute Rich Element
Element packed with data-* attributes. Practice extracting specific data attributes by name or pattern.
Meta Tags (visible mirror)
Common <meta> patterns rendered as text. Real meta tags exist in <head> — these show what to look for.
Transaction Table
Tabular data with different cell types. Practice extracting by th/td position, row class, or cell content regex.
| Date | Description | Amount | Status |
|---|---|---|---|
| 2026-07-15 | Wire Transfer - Ref #TXN-88201 | $4,250.00 | Completed |
| 2026-07-18 | Crypto Purchase - BTC 0.05 | $3,100.00 | Pending |
| 2026-07-19 | Gift Card Redeem - CODE-XXXX-YYYY | $500.00 | Failed |
Inline Script Tags
Script elements with different types and content. Practice matching <script> by src, type, or inline content patterns.
Iframes
Iframe elements with various attributes. Practice extracting src, detecting sandbox presence, or matching by name/id.
Image Variants
Different image loading patterns. Practice matching src, srcset, loading, alt text, and size attributes.
lazy + alt
empty alt
no alt
data: SVG
Background Image (CSS)
Content loaded via CSS background-image instead of <img>. Not reachable by img[src] selector — needs a different approach.
Urgency / Scam Language
Common scam text patterns. Practice textContent regex matching for urgency, threats, and fake authority.
WARNING: Your account has been compromised! Verify your identity within 24 hours or your account will be permanently suspended.
Congratulations! You've been selected as today's winner. Claim your $1,000 gift card now. Only 3 remaining!
Microsoft Alert: Trojan_Spyware detected. Call 1-800-555-0199 immediately. Do NOT restart your computer.
Welcome back! Your last login was 2 days ago. Check your dashboard for recent updates.
Obfuscated Text
Text with zero-width characters, HTML entities, and Unicode tricks. Practice normalizing before matching.
Password (zero-width joiners between letters)
Account (hex entities spelling "Account")
Аppеl (Cyrillic А and е mixed with Latin)
kcilc ot erehilC (right-to-left override)
CTA Buttons
Different button styles and types. Practice matching by textContent, class, type, data-*, or parent context.
Notification Banner
Cookie consent / notification permission bar. Practice identifying overlay patterns by role, aria-*, position:fixed, and z-index.
This website uses cookies to ensure you get the best experience. By continuing, you agree to our cookie policy.