Phase 2 — Attack

Phase 2 generates authorized browser behavior against the protected application. Phase 1 must be complete. This phase does not create, update, or delete infrastructure.

Caution

Browser execution and CSD telemetry are separate gates. Prove immediate behavior from the sanitized receipt first. Correlate CSD telemetry separately without promising a fixed detection delay.

Step 8: Run the deterministic browser generator

8.1 Start Chrome for loopback CDP

open -na "Google Chrome" --args \
  --remote-debugging-port=9222 \
  --user-data-dir="$TMPDIR/csd-demo-chrome"

Node.js 22 or newer is required. The runner owns an isolated context/page and leaves Chrome running.

8.2 Confirm the scenario contract

node scripts/csd-traffic.mjs --list

The output must list exactly: login-credential-skimmer, registration-harvester, payment-overlay-card-skimmer, obfuscated-loader, multi-cdn-injection, tag-manager-hijack, multi-channel-exfiltration, high-volume-domain-exfiltration, form-overlay, keylogger-simulation, and maximum-detection.

8.3 Run a focused check

mkdir -p .artifacts/csd
node scripts/csd-traffic.mjs \
  --scenario login-credential-skimmer \
  --cdp-endpoint http://127.0.0.1:9222 \
  --timeout 30s \
  --settle 10s \
  --receipt .artifacts/csd/phase-2-login-credential-skimmer.json

--scenario is repeatable when a focused run needs more than one scenario. An execution accepts one selector form only: repeated --scenario or --all. There is no default execution selector.

8.4 Run composed or complete coverage

node scripts/csd-traffic.mjs \
  --scenario maximum-detection \
  --receipt .artifacts/csd/phase-2-maximum-detection.json

Use --all only when every independent scenario is required:

node scripts/csd-traffic.mjs \
  --all \
  --receipt .artifacts/csd/phase-2-all.json

--timeout bounds runner operations. --settle only collects late browser events; neither option promises platform timing. A custom target requires --target plus exact repeatable --allow-host values. Unsafe redirects and final origins fail closed.

To stream a receipt, use --receipt -. Stdout contains only JSON and human logs use stderr:

node scripts/csd-traffic.mjs \
  --scenario maximum-detection \
  --receipt - \
  | jq '{schema_version, run_id, requested_scenarios, success, eventual_csd_evidence}'

8.5 Inspect the file receipt

jq '{
  schema_version, run_id, started_at, ended_at, duration_ms,
  tool, requested_scenarios, target, allowlist, cdp_endpoint,
  scenarios: [.scenarios[] | {
    name, target, status, immediate_evidence, dom_cleanup, console, network,
    protected_document, instrumentation, cleanup, error, success, eventual_csd_evidence
  }],
  success, caveats, error, eventual_csd_evidence
}' .artifacts/csd/phase-2-maximum-detection.json

Immediate check	Required result
Target/document	Exact authorized HTTPS top-frame origin and expected route
Protected page	Ready, with __imp_apg__ present
Scenario execution	Required assertions, synthetic native-setter markers where applicable, and terminal Log/console markers
Candidate requests	Actual response, loading failure, or timed-out terminal state retained per attempt
High-volume scenario	Exactly five script attempts plus two POST attempts
Overlay/keylogger	Geometry/removal or aggregate periodic POST-count evidence only; no entered values
Cleanup	DOM artifacts, listeners, timers, target, and context cleaned up
Aggregate	success, caveats, and error independent from eventual_csd_evidence

A requested destination receives an atomic receipt even after execution or cleanup failure. The primary error remains in error; runner cleanup failures remain in cleanup.errors. A candidate CDN failure remains observed browser evidence and is never converted to a successful load.

Manual fallback

node scripts/csd-traffic.mjs \
  --print-script maximum-detection \
  > .artifacts/csd/maximum-detection.browser.js

Review the generated file and paste it into DevTools Console on the documented route. --print-script is the only manual payload source. Manual execution cannot prove the automated receipt or cleanup contract.

Step 9: Run explicit post-receipt CSD reads

The runner has no embedded/raw API client. Begin only after the immediate receipt passes. Use separate read-only xcsh_api operations scoped to the receipt’s start/end window, protected origin, and exact reviewed Network hosts. Keep the result under eventual_csd_evidence and label each surface OBSERVED, NOT_OBSERVED, PENDING, or ERROR.

State	Meaning
OBSERVED	A matching reviewed record is present in the queried window.
NOT_OBSERVED	The completed query returned no matching record.
PENDING	More observation is planned; no timing promise is implied.
ERROR	The API read failed or returned unusable evidence.

The browser run remains successful when correlation is pending, empty, or unavailable. Correlation does not prove deterministic latency, complete coverage, or causation.

Phase 2 evidence summary

Test ID	Check	Gate
BROWSER-1	Authorized final HTTPS origin and protected document ready	Required
BROWSER-2	__imp_apg__ present	Required
BROWSER-3	Immediate assertions plus Page/Runtime/Network/Log evidence in receipt	Required
BROWSER-4	Deterministic cleanup completed	Required
BROWSER-5	Browser dip request observed	Record PASS/PENDING; investigate absence before customer claims
DET-1	Matching script records	OBSERVED / NOT_OBSERVED / PENDING / ERROR
DET-2	Observed subset of candidate domains	Never require every candidate
DET-3	Matching detected-domain entry	Required only by the Phase 3 mitigation workflow
DET-4	Matching form-field entries	Optional; overlay/keylogger claims remain browser-limited

Proceed to Phase 3 — Mitigate only when its explicit detected-domain prerequisite is satisfied. Otherwise Phase 2 can still be a successful browser run with platform evidence pending.