diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..0e7439f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,54 @@ +name: Bug report +description: Something on itsectools.com isn't working correctly. +labels: ["bug", "needs-triage"] +body: + - type: markdown + attributes: + value: | + Thanks for reporting a bug. This repo hosts documentation only — the + application source lives in a private codebase — but issues filed + here are triaged the same way and tracked through to a fix. + + - type: input + id: page + attributes: + label: Page or feature + description: Which page/tool was this on? + placeholder: e.g. /network-pulse, /dlp, /ngfw, /mitre + validations: + required: true + + - type: textarea + id: expected + attributes: + label: Expected behavior + description: What did you expect to happen? + validations: + required: true + + - type: textarea + id: actual + attributes: + label: Actual behavior + description: What actually happened? + validations: + required: true + + - type: textarea + id: steps + attributes: + label: Steps to reproduce + placeholder: | + 1. Go to '...' + 2. Click '...' + 3. See error + validations: + required: false + + - type: textarea + id: context + attributes: + label: Additional context + description: Browser/OS, screenshots, test payload, or anything else relevant. + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..f5fb6d1 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: true +contact_links: + - name: General question + url: https://itsectools.com/contact + about: For general questions not related to a bug or feature request. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..30afd93 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,17 @@ +name: Feature request +description: Suggest an improvement or a new test/capability. +labels: ["enhancement", "needs-triage"] +body: + - type: textarea + id: problem + attributes: + label: What problem would this solve? + validations: + required: true + + - type: textarea + id: proposal + attributes: + label: Proposed solution + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/security_finding.yml b/.github/ISSUE_TEMPLATE/security_finding.yml new file mode 100644 index 0000000..a61ce70 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/security_finding.yml @@ -0,0 +1,48 @@ +name: Incorrect test result +description: An NGFW/AET/DLP/MITRE test result looks wrong (false positive/negative). +labels: ["security-finding", "needs-triage"] +body: + - type: markdown + attributes: + value: | + Use this when a test's verdict itself seems incorrect — e.g. a + firewall clearly blocked something but the tool reports it as + vulnerable, or the reverse. + + - type: dropdown + id: test-type + attributes: + label: Which test + options: + - NGFW / AET + - DLP Validator + - MITRE ATT&CK + - Network Pulse + - Other + validations: + required: true + + - type: input + id: combo + attributes: + label: Specific test/combo (if applicable) + placeholder: e.g. chunked-delayed, max-aet, nested-json-mcp + validations: + required: false + + - type: textarea + id: expected-vs-actual + attributes: + label: What the tool reported vs. what actually happened + description: e.g. "Tool said Vulnerable, but my firewall log shows the request was blocked." + validations: + required: true + + - type: textarea + id: payload + attributes: + label: Test payload / response JSON (if you have it) + description: Paste the raw result JSON or firewall log line if available. Redact anything sensitive first. + render: json + validations: + required: false diff --git a/CHANGELOG.md b/CHANGELOG.md index f4d5fb1..2c19a8a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,41 +1,131 @@ # Changelog -All notable changes to ITSecTools are documented here. +All notable changes to itsectools.com are recorded here, most recent first. +Format loosely follows [Keep a Changelog](https://keepachangelog.com/). -## [1.2.0] — 2026-02 +--- + +## 2026-09-08 — DLP Validator: Shadow AI Chat Data Leakage Simulation + +### Added +- New Shadow AI Chat Data Leakage Simulation panel in the DLP Validator's + Data Leakage Simulator step: a simulated AI chat interface for testing + whether DLP/CASB solutions catch sensitive data pasted into ChatGPT/ + Copilot-style prompts — the fastest-growing exfiltration path outside + file uploads. +- Backend endpoint (`/api/dlp/chat/v1/chat/completions`) mirrors OpenAI's + actual chat-completions REST path and JSON request/response schema (also + copied by Azure OpenAI, Ollama, vLLM, and most self-hosted LLM servers), + so the traffic is a genuine payload for content-based DLP inspection to + react to. Deliberately does not attempt to reach real AI vendor domains — + that would mean sending test data to infrastructure this tool's users + don't own or have authorization to test. +- Assistant replies reference exactly what was detected in the message + (SSN/card/email/credential), rather than a canned reply — a stronger, + more legible illustration of the risk than a generic response. + +### Fixed +- Per-message result no longer auto-counts every successful send as a + "leak" regardless of content — a benign message (e.g. "hi") was being + logged and reported identically to an actual sensitive payload. Now a + test only counts toward the report when the message contains a genuine + sensitive pattern **and** an explicit "Include in report" toggle is on + (off by default). The same false-positive logging bug was also present + in the pre-existing HTTP/S POST Simulation and the Advanced DLP (MCP) + custom-content test; fixed identically in both. +- Chat auto-scroll was using `scrollIntoView()`, which scrolls every + scrollable ancestor (including the whole page) to satisfy alignment — + each new message was yanking the entire page down, not just the chat + box. Now scrolls only the chat panel's own scroll position. + +--- + +## 2026-09-05 — SDLC: issue tracking + error alerting ### Added -- **Regex Engine Tools** — Build and translate DLP regex patterns across 10 vendor engines (Forcepoint, Symantec, Palo Alto, Zscaler, Netskope, Trellix, Fortinet, Microsoft Purview, Proofpoint) -- **Regex Creator** with 27 match types and auto-analysis -- **Regex Translator & Tester** with vendor-specific syntax translation and failure diagnostics -- **Label & Classification Check** — Deep-scans DOCX/XLSX for MIP classification labels, PDF metadata scanning, content-level PII/PCI/PHI detection -- **Evasive Payload Download** — Renamed file extensions, Base64 encoder/decoder, password-protected ZIP (AES), nested archives (1–10 layers) -- File hashing (MD5, SHA-256) for integrity verification -- Color-coded classification results (Confidential/Internal/Public) -- Help Center with detailed guides for every tool -- FAQ schema (JSON-LD) for DLP, NGFW, MITRE, and Network Pulse pages - -### Improved -- Enhanced SEO metadata across all pages -- AI discoverability via `llms.txt` and structured data - -## [1.1.0] — 2026-01 +- GitHub issue templates (`bug_report`, `security_finding`, `feature_request`) and + triage labels (`bug`, `regression`, `enhancement`, `security-finding`, + `needs-triage`, `docs`) on the public docs repo. No application source added — + the repo stays documentation-only. +- Production error alerting: a standalone Tail Worker + (`itsectools-error-alerts`) consumes trace events from the main Worker and + emails `info@itsectools.com` (via Resend) on unhandled exceptions or 5xx + responses. A 5-minute KV-backed cooldown per error signature prevents a + single bad deploy from flooding the inbox. +- `itsectools.com` verified as a sending domain in Resend (DKIM + SPF/MX on + the `send.` subdomain only — does not touch the existing Zoho MX records + serving `info@itsectools.com` and other mailboxes). + +--- + +## 2026-08-20 — Network Pulse: Application Path Analysis (real trace + BGP facts) ### Added -- **MITRE ATT&CK Kill Chain Simulator** — 4-phase sequential attack (T1190, T1059.001, T1003.001, T1048.003) -- **Network Pulse** — Public IP detection, edge server geolocation, latency, jitter, packet loss, PMTU discovery, AI Security Insights -- **NGFW C2C Beacon Testing** — OOB data exfiltration, web shell beacon, Python stager download -- **Advanced Evasion Techniques** — Log4j JNDI, hex-encoded SQLi, Shellshock RCE - -### Improved -- Console output with color-coded real-time logging -- MITRE test payloads updated to trigger IPS signatures via backend service - -## [1.0.0] — 2025-12 - -### Initial Release -- **DLP Validator** — File upload testing (HTTP, HTTPS, FTP), data download (PII, PCI, PHI in PDF, DOCX, XLSX, CSV), raw text POST simulation -- **NGFW Tests** — IPS signature testing (SQLi, XSS, Path Traversal) -- **Threat Gen** — EICAR test files, heuristic malware simulators, ransomware behaviour scripts -- Sidebar navigation with all tools -- Privacy-first architecture — no data stored +- New `/api/pulse/trace` endpoint: measures DNS + connect/TLS/first-byte + timing from the edge to a target, resolves target IP/ASN/geo via keyless + DoH + Team Cymru + ipwho.is, and returns a verdict (ok / slow / blocked). +- Business-SaaS dropdown (Microsoft 365, Google Workspace, Teams, Slack, + Zoom, Salesforce, Workday, ServiceNow, etc.) plus a custom-URL input, + replacing the earlier "Phase 2 · in development" placeholder. +- "Target network (BGP registry)" panel — real BGP data from RIPE Stat's + keyless looking-glass API: origin AS, registered country, announced + prefix, path diversity/multi-homing count, and an explicit anycast + callout for global CDN/cloud networks (Microsoft, Google, Cloudflare, + AWS, etc.) explaining that "registered country" is not where the user's + traffic actually terminates. +- SSRF guard on the trace endpoint (rejects RFC1918/loopback/link-local + targets). + +### Fixed +- Removed a misleading "Entry" hop in the AS-level path that was always the + same Singapore route-collector peer (an artifact of which RIPE collector + reported, not real transit) for every target. +- Removed the country flag from the "Target" node in the AS-level path — + registry country for global anycast networks (e.g. Microsoft AS8075 + showing "US") does not reflect where the user's traffic is actually + served, and was reading as a factual claim it wasn't. +- Country-matching logic normalised via `Intl.DisplayNames` so ISO codes + (`AE`) and full names (`United Arab Emirates`) compare correctly instead + of always mismatching. + +### Removed +- The `cloudflare:sockets`-based per-phase TCP/TLS timing attempt — proven + in a live production test to always return `tls_ms: 0` (the handshake is + lazy and folds into first-byte time) and to fail entirely on some hosts + (Anthropic, Zoom) that `fetch()` reaches fine. Reverted to `fetch()`-based + combined connect+TLS+first-byte timing, honestly labelled as such. + +--- + +## August 2026 — Network Pulse: Overall Health redesign + +### Added +- Two-section "Network Security Posture" redesign of `/network-pulse`: + Overall Health (connection quality + 8 plain-English safety findings, + each with an expandable technical drill-down) and Application Path + Analysis. +- Hero with two large start cards so both sections are reachable without + scrolling. +- IPv4/IPv6 chip, DoH-bypass probe, path-MTU probe, MITM/TLS-integrity + check (via `cf-ray` presence), all measured client-side. +- "Under development · beta" banner. + +### Changed +- Findings reduced from 8 to 7: the outbound-port-sweep finding was + removed — it cannot be tested honestly from a browser (no raw sockets) + or a plain Cloudflare Worker (only ports 80/443 exposed). +- IPv6-vs-IPv4 finding downgraded from a warning to informational — most + business networks are IPv4-only and that is not a security issue. +- Country/edge-PoP labelling reworded to remove Cloudflare branding + per product direction. + +### Removed +- Download-throughput measurement and its `/api/pulse/download` endpoint — + browser-based single-connection throughput under-reported real bandwidth + by roughly 5× against speedtest.net. + +--- + +## Earlier + +See git history and `docs/` for changes prior to this changelog's start. diff --git a/README.md b/README.md index 988fe0f..944ce27 100644 --- a/README.md +++ b/README.md @@ -23,14 +23,20 @@ A free, browser-based security testing platform for validating NGFW, DLP, IPS, a - Sequential execution with 6s inter-stage delay to avoid IP shunning. - **PDF Kill Chain Report** — Stage-by-stage visualization, risk assessment, and recommendations showing where the attack was stopped. -### 3. DLP Validator — 7-Step Workflow -- **Step 1: Download Test Files** — Generate DOCX/PDF/XLSX/CSV with 100+ rows of realistic PII (SSN, Driver License, Passport), PCI (Luhn-valid Visa/MC/Amex), or PHI (ICD-10 codes, prescriptions) data. Includes sensitivity-labeled files (Confidential, Internal, Public). Each download is dynamically generated to prevent static hash fingerprinting. Also validates proxy/inline DLP by testing whether your DLP engine intercepts and inspects file content during HTTPS transit. -- **Step 2: Evasive Payload Download** — Base64 encoding, renamed extensions (.docx→.jpg), AES-256 encrypted archives, nested ZIPs (1–10 layers for depth testing). -- **Step 3: Label & Classification Check** *(optional)* — Deep-scan documents for Microsoft Information Protection (MIP) labels from DOCX/XLSX ZIP archives, PDF metadata dictionaries, content-level DLP pattern matching, and MD5/SHA-256 hashing. -- **Step 4: Data Leakage Simulator** — Upload files over HTTP/HTTPS/FTP and send raw text POST payloads to test whether DLP blocks data in transit across all protocols. Detects and displays block status when a DLP agent intercepts browser uploads — the only free tool that distinguishes endpoint-level blocks from network/proxy blocks. -- **Step 5: Advanced DLP Tests** — Tests DLP detection of sensitive data inside deeply nested JSON structures used by AI agents (MCP), REST APIs, and GraphQL mutations. Server generates fresh PII/PCI/PHI data and wraps it at configurable nesting depth (2/4/6 levels). -- **Step 6: Generate & Share Report** — Auto-generated PDF scorecard with score gauge, protocol coverage matrix, data category breakdown, gap analysis, and actionable recommendations. Client-side generation — no data leaves the browser. -- **Step 7: DLP Regex Builder** — Build and translate DLP regex patterns across 10 vendor formats (Forcepoint, Symantec, Palo Alto, Zscaler, Netskope, Trellix, Fortinet, Microsoft Purview, Proofpoint). +### 3. DLP (Data Loss Prevention) Tools + +**7-Step Guided Workflow:** ① Download Test Files → ② Evasive Payload Download → ③ Label & Classification Check → ④ Data Leakage Simulator → ⑤ Advanced DLP Tests → ⑥ Generate & Share Report → ⑦ DLP Regex Builder + +- **File Upload Testing (Step 4)** — Upload sensitive test files over HTTP/HTTPS/FTP to verify DLP blocking. +- **Shadow AI Chat Data Leakage Simulation (Step 4)** — Simulated AI chat interface for testing whether DLP/CASB catches sensitive data pasted into ChatGPT/Copilot-style prompts. Requests are shaped like real chat-completions traffic (OpenAI-compatible `/v1/chat/completions` path and JSON schema) so content-based inspection has something genuine to react to. Reports a plain Success/Failed-to-send status per message, with an explicit opt-in toggle before a result counts toward the PDF report. +- **Endpoint DLP Agent Detection** *(Unique)* — The only free DLP testing tool that detects and reports when an Endpoint DLP agent (Forcepoint, Symantec) blocks file uploads at the browser level — even in inline/proxy mode. Clearly distinguishes endpoint-level blocks from network/proxy DLP blocks with actionable output messages. +- **Download Test Files (Step 1)** — Generate DOCX/PDF/XLSX/CSV with 100 rows of realistic PII (SSN, Driver License, Passport), PCI (Luhn-valid Visa/MC/Amex), or PHI (ICD-10 codes, prescriptions) data. Each download is dynamically generated to prevent static hash fingerprinting. +- **Proxy Mode DLP Validation (Step 1)** — Downloads dynamically generated documents over HTTPS. Tests whether proxy/inline DLP can parse DOCX (OOXML ZIP), PDF (content streams), XLSX, and CSV to detect embedded sensitive data. CSV/XLSX are detected by most DLP engines; DOCX/PDF require deeper file parsing that not all proxy DLP solutions support. +- **Label & Classification Check (Step 3)** — Inspect Microsoft Information Protection (MIP) labels from DOCX/XLSX ZIP archives and PDF metadata dictionaries. Content-level DLP pattern matching with MD5/SHA-256 hashing. +- **DLP Regex Builder (Step 7)** — Build and translate DLP regex patterns across 10 vendor formats (Forcepoint, Symantec, Palo Alto, Zscaler, Netskope, Trellix, Fortinet, Microsoft Purview, Proofpoint). +- **Evasive Payload Download (Step 2)** — Base64 encoding, renamed extensions (.docx→.jpg), AES-256 encrypted archives, nested ZIPs (depth testing). +- **Advanced DLP Tests — Nested JSON Exfiltration (Step 5)** — Tests DLP detection of sensitive data inside deeply nested JSON structures used by AI agents (MCP), REST APIs, and GraphQL mutations. Server generates fresh PII/PCI/PHI data and wraps it at configurable nesting depth (2/4/6 levels). Tests whether network DLP can parse structured payloads to find hidden sensitive data. +- **Generate & Share Report (Step 6)** — Auto-generated scorecard with score gauge, protocol coverage matrix, data category breakdown, gap analysis, and actionable recommendations. Client-side generation — no data leaves the browser. ### 4. Threat Protection Lab - **EICAR Test Files** — Standard EICAR antivirus test file in multiple formats (.txt, .zip, .ps1). diff --git a/comparisons/vs-dlptest.md b/comparisons/vs-dlptest.md index b3d9f61..9f13a89 100644 --- a/comparisons/vs-dlptest.md +++ b/comparisons/vs-dlptest.md @@ -62,7 +62,7 @@ ITSecTools takes a fundamentally different approach. Instead of being just a DLP 3. **Label & Classification Check** *(optional)* — Deep-scans DOCX/XLSX for MIP classification labels, PDF metadata for sensitivity properties, content-level PII/PCI detection, and MD5/SHA-256 hashing. -4. **Data Leakage Simulator** — Multi-protocol file upload (HTTP, HTTPS, FTP) and raw text POST — all browser-native, no FileZilla needed. Detects and displays block status when a DLP agent intercepts browser uploads — the only free tool that distinguishes endpoint-level blocks from network/proxy blocks. Compatible with Forcepoint, Symantec, and other endpoint agents. +4. **Data Leakage Simulator** — Multi-protocol file upload (HTTP, HTTPS, FTP) and raw text POST — all browser-native, no FileZilla needed. Includes a Shadow AI Chat Data Leakage Simulation — a simulated AI chat interface using an OpenAI-compatible `/v1/chat/completions` request shape to test whether DLP/CASB catches sensitive data pasted into ChatGPT/Copilot-style prompts. Detects and displays block status when a DLP agent intercepts browser uploads — the only free tool that distinguishes endpoint-level blocks from network/proxy blocks. Compatible with Forcepoint, Symantec, and other endpoint agents. 5. **Advanced DLP Tests** — Tests DLP detection of sensitive data inside deeply nested JSON structures used by AI agents (MCP), REST APIs, and GraphQL mutations. Configurable nesting depth (2/4/6 levels). @@ -142,12 +142,15 @@ Proofpoint includes DLP testing capabilities within their enterprise platform. | **Endpoint DLP detection** | ❌ | ✅ (unique — detects endpoint agent blocks) | ❌ | ❌ | ❌ | | **Proxy mode DLP validation** | ❌ | ✅ (dynamic doc downloads over HTTPS) | ❌ | ❌ | ❌ | | **Evasion payloads** | ❌ | ✅ (Base64, nested ZIP, renamed ext, encrypted ZIP) | ❌ | ❌ | ❌ | +| **Shadow AI chat leakage testing** | ❌ | ✅ (OpenAI-compatible chat-completions shape) | ❌ | ❌ | ❌ | | **File classification scanning** | ❌ | ✅ (MIP labels, metadata, PII/PCI) | ❌ | ✅ (API) | ✅ | | **DLP regex builder** | ❌ | ✅ (10 vendors) | ❌ | ❌ | ❌ | | **NGFW/IPS testing** | ❌ | ✅ (SQLi, XSS, Log4j, Shellshock, C2) | ❌ | ❌ | ❌ | | **MITRE ATT&CK simulation** | ❌ | ✅ (4-phase Kill Chain) | ❌ | ❌ | ❌ | | **Threat file generation** | ❌ | ✅ (EICAR, malware sim, ransomware) | ❌ | ❌ | ❌ | | **Network telemetry** | ❌ | ✅ (latency, jitter, PMTU, AI insights) | ❌ | ❌ | ❌ | +| **PDF validation report** | ❌ | ✅ (score gauge, protocol coverage, gap analysis — client-side, no data leaves the browser) | ❌ | ❌ | ❌ | +| **Guided 7-step validation workflow** | ❌ | ✅ (staged testing with progress) | ❌ | ❌ | ❌ | | **No login required** | ✅ | ✅ | ✅ | ❌ | ❌ | | **Completely free** | ✅ | ✅ | ✅ | Free tier | ❌ | | **No installation** | Partial (FTP needs FileZilla) | ✅ | ✅ | ❌ (API) | ❌ | diff --git a/docs/dlp-validator.md b/docs/dlp-validator.md index 2622dcc..c5eec49 100644 --- a/docs/dlp-validator.md +++ b/docs/dlp-validator.md @@ -65,7 +65,7 @@ Upload any document to deep-scan it for sensitivity labels, classification marki ## 4. Data Leakage Simulator -Upload files and send raw text payloads through HTTP, HTTPS, and FTP to verify whether your DLP solution inspects and blocks data in transit across all protocols. +Upload files and send raw text payloads through HTTP, HTTPS, and FTP — or paste sensitive data into a simulated AI chat prompt — to verify whether your DLP solution inspects and blocks data in transit across every channel, including Shadow AI. ### File Upload Test @@ -84,6 +84,19 @@ Sends inline sensitive text (SSN, credit card numbers) via HTTP or HTTPS POST 2. Enter or paste text containing sensitive data (e.g., `SSN: 123-45-6789`). 3. Click **Send POST** — if your DLP inspects inline traffic, it should detect and block the request. +### Shadow AI Chat Data Leakage Simulation + +A simulated AI chat interface for testing the fastest-growing exfiltration path: an employee pasting sensitive data into ChatGPT, Copilot, or an internal AI assistant instead of uploading a file. + +1. Select the **Shadow AI Chat Data Leakage Simulation** panel within the Data Leakage Simulator tab. +2. Send the pre-filled sample prompt (a synthetic SSN and card number) or type your own. +3. Each message reports a plain **Success** or **Failed to send** — check whether your DLP/CASB console shows anything for it. +4. Toggle **Include in report** to opt a specific test into the PDF report (off by default, so casual messages don't inflate the results). + +The request is shaped like real chat-completions traffic — path `/v1/chat/completions`, the same request/response schema OpenAI (and now Azure OpenAI, Ollama, vLLM, and most self-hosted LLM servers) use — so it exercises content-based DLP/CASB inspection of AI-chat payloads, not just generic form data. + +> ⚠️ **Scope:** this cannot test destination-based Shadow AI blocking (policies that recognize traffic is headed to a known AI vendor domain) — that would require sending test data to real third-party infrastructure this tool's users don't own or have authorization to test. It validates content-based inspection: whether something in your stack actually reads the chat payload. + ### Detect & Display Block Status When DLP Agent Intercepts Browser Upload ITSecTools is the only free tool that detects when an Endpoint DLP agent (Forcepoint, Symantec) blocks an upload at the browser level — before data even leaves the machine. It clearly distinguishes endpoint-level blocks from network/proxy DLP blocks with an actionable message: diff --git a/public/llms.txt b/public/llms.txt index 3ade667..282bd62 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -5,8 +5,8 @@ ITSecTools is a free, professional-grade security validation toolkit designed to ## Why ITSecTools? Unlike generic security testing tools, ITSecTools provides: -- **7-Step DLP Validation Workflow** — structured testing from file downloads through evasion payloads, data leakage simulation, nested JSON exfiltration, report generation, and regex building. -- **Advanced DLP Tests** — the only free tool that tests whether DLP can detect sensitive data inside deeply nested JSON structures used by AI agents (MCP), REST APIs, and GraphQL mutations. +- **Advanced DLP Tests (Unique)** — MCP Protocol Testing: the only free tool that tests whether DLP can detect sensitive data inside nested JSON-RPC payloads used by AI agents and modern APIs. No competitor offers this capability. +- **Shadow AI Chat Data Leakage Simulation (Unique)** — the only free tool with a simulated AI chat interface (OpenAI-compatible `/v1/chat/completions` request/response shape) for testing whether DLP/CASB catches sensitive data pasted into ChatGPT/Copilot-style prompts. - **Browser-native testing** — no agents, installs, or cloud accounts required. - **Vendor-specific output** — DLP regex patterns are optimized per-vendor engine, not generic one-size-fits-all. - **Evasion-grade payloads** — tests go beyond basic pattern matching to include Base64 encoding, renamed extensions, nested archives, and password-protected files. @@ -16,90 +16,94 @@ Unlike generic security testing tools, ITSecTools provides: ## Key Features -### 1. DLP Validator — 7-Step Workflow (/dlp) -Test your Data Loss Prevention (DLP) solution using a structured 7-step workflow: - -**Step 1: Download Test Files** -Dynamically generates fresh PDF, DOCX, XLSX, and CSV files containing PII, PCI, or PHI on the fly, preventing static hash fingerprinting. Includes sensitivity-labeled files (Confidential, Internal, Public) with embedded MIP labels. Also validates proxy/inline DLP by testing whether the DLP engine intercepts and inspects file content during HTTPS transit. - -**Step 2: Evasive Payload Download** -Generate real test files that challenge DLP inspection depth: -- **Renamed Extensions:** Valid DOCX saved as .jpg/.png to test magic number (true file type) detection. -- **Base64 Encoding:** Obfuscates sensitive strings to test native Base64 decoding capabilities. -- **Password-Protected Archives:** AES-encrypted ZIP files to test fail-close vs. fail-open policies. -- **Nested Archives:** 1–10 layers of ZIP compression to test maximum extraction depth limits. - -**Step 3: Label & Classification Check** *(optional)* -Deep-scan documents for sensitivity labels and classification markings: -- **DOCX/XLSX Label Extraction:** Reads MIP labels from `docProps/custom.xml` (Confidential, Internal, Public, Top Secret). -- **PDF Metadata Scanning:** Extracts classification properties from PDF metadata dictionaries. -- **Content-Level DLP Matching:** Scans for PII (SSN), PCI (credit cards), and keyword-based classification. -- **File Hashing:** MD5 and SHA-256 for verification and threat intel lookups. -- **Color-Coded Results:** Red (Confidential/Secret), Blue (Internal), Green (Public). - -**Step 4: Data Leakage Simulator** -Upload files over HTTP, HTTPS, and FTP, and send raw text POST payloads to test whether DLP blocks data in transit across all protocols. Detects and displays block status when a DLP agent intercepts browser uploads — the only free tool that distinguishes endpoint-level blocks from network/proxy DLP blocks. Compatible with Forcepoint, Symantec, and other endpoint agents. - -**Step 5: Advanced DLP Tests** -Tests whether DLP can detect sensitive data (PII, PCI, PHI) buried inside deeply nested JSON structures at configurable depths (2, 4, or 6 levels). Uses the same format as AI agents (MCP), REST APIs, and GraphQL mutations. Server generates fresh sensitive data and wraps it in nested JSON. Most DLP engines only scan flat text — this test reveals the gap. - -**Step 6: Generate & Share Report** -Auto-generated PDF scorecard with score gauge, protocol coverage matrix, gap analysis, and actionable recommendations. Client-side generation — no data leaves the browser. - -**Step 7: DLP Regex Builder** -- **Regex Creator:** Enter a sample string (e.g., MRN:1234567), auto-analyze its structure, customize match types, and generate vendor-optimized regex. -- **Regex Translator:** Paste any regex, select a target vendor, and get the pattern translated with instant match/no-match diagnostics. -- **10 Vendor Engines:** Forcepoint DLP, Forcepoint DSPM, Symantec DLP, Palo Alto Networks, Zscaler, Netskope, Trellix DLP, Fortinet, Microsoft Purview, Proofpoint. -- **27 Match Types** with failure diagnostics and plain English explanations. - -### 2. Threat Generation (/threat-protection) -Safe malware simulation for rigorously testing network and endpoint security solutions: -- EICAR Standard Test File (.com, .txt, .zip) — the industry-standard antivirus detection test -- Heuristic Malware Sample (.exe, .pdf, .doc) for testing behavioral analysis engines -- Ransomware Simulator (.vbs) to verify ransomware protection policies and behavioral detection +### 1. DLP Validator (/dlp) +Test your Data Loss Prevention (DLP) solution through a guided **7-Step Workflow**: ① Download Test Files → ② Evasive Payload Download → ③ Label & Classification Check → ④ Data Leakage Simulator → ⑤ Advanced DLP Tests → ⑥ Generate & Share Report → ⑦ DLP Regex Builder + +Key capabilities: +- **Advanced DLP Tests — MCP Protocol Testing (Unique, No Competitor Offers This):** Tests whether your DLP can detect sensitive data (PII, PCI, PHI) buried inside nested JSON-RPC payloads at configurable depths (2, 4, or 6 levels). This is the same structure used by MCP (Model Context Protocol) — the protocol AI agents use to communicate with external tools. Server generates fresh sensitive data and wraps it in a deeply nested JSON structure. The DLP engine must parse the JSON to find it. Most DLP engines only scan flat text — this test reveals the gap. +- **PDF Validation Reports:** Auto-generated scorecards with score gauge, protocol coverage matrix, gap analysis, and recommendations. Client-side generation — no data leaves the browser. +- **Dynamic Document Generation:** Dynamically generates fresh PDF, DOCX, XLSX, and CSV files containing PII, PCI, or PHI on the fly, preventing static hash fingerprinting. +- **Multi-Protocol Testing:** Test data leakage simulations across HTTP, HTTPS, and FTP to ensure comprehensive inspection across different ports. +- **Data-in-Motion Exfiltration Testing:** Tests data-in-motion by simulating raw text data leakage via both HTTP (unencrypted, Port 80 egress simulation) and HTTPS, ensuring inline network inspection catches raw inputs, not just file attachments. +- **Shadow AI Chat Data Leakage Simulation:** A simulated AI chat interface pre-filled with a sample sensitive prompt (synthetic SSN and card number). Requests use the same request/response JSON schema as OpenAI's `/v1/chat/completions` API — the de-facto convention also used by Azure OpenAI, Ollama, vLLM, and most self-hosted LLM servers — so the traffic is a genuine payload for content-based DLP/CASB inspection to react to. Each message reports a plain Success/Failed-to-send status, with an explicit toggle to opt a specific result into the PDF report (off by default). + +**Label & Classification Check — Step 3 (Unique):** +Most tools stop at file type detection. ITSecTools goes further by deep-scanning uploaded documents to detect sensitivity labels and classification markings: +- **DOCX/XLSX Classification Extraction:** Parses the ZIP archive structure to locate `docProps/custom.xml` and reads Microsoft Information Protection (MIP) classification labels (e.g., Confidential, Internal, Public, Top Secret) — no external libraries required. +- **PDF Metadata Dictionary Scanning:** Extracts classification and label properties directly from PDF metadata dictionaries using raw binary parsing. +- **DLP Pattern Matching:** If no explicit label is found, performs content-level analysis for PII (SSN patterns), PCI (credit card numbers), and keyword-based classification (confidential, restricted, proprietary, etc.). +- **File Hashing:** Computes MD5 and SHA-256 hashes for file integrity verification and threat intel lookups. +- **Sensitivity Color Coding:** Results are visually color-coded — Red for Confidential/Secret, Blue for Internal, Green for Public — with classification tags for audit trail. +- **Zero-Upload Privacy:** Files are analyzed server-side via ephemeral stateless functions. No file content is stored, logged, or persisted. + +**Evasive Payload Download — Step 2 (Evasion Testing):** +The platform features a specialized toolset for testing evasion detection: +- **True File Type Bypass:** Generates valid documents containing sensitive data saved with fake extensions (e.g., .jpg) to verify True File Typing. +- **Base64 Encoder/Decoder:** Obfuscates sensitive strings into Base64 format to test native decoding capabilities of inline network appliances. +- **Password-Protected Archives:** Generates AES-encrypted ZIP files containing sensitive data to test fail-close or fail-open archive inspection policies. +- **Nested Archives (Archive Depth Limit Testing):** Wraps sensitive data in multiple layers of ZIP compression to test maximum archive extraction depth limits. + +**DLP Regex Builder — Step 7 (Vendor-Aware):** +- **Regex Creator:** Enter a compliance test data string (e.g., MRN:1234567), auto-analyze its structure into segments (letters, digits, separators), customize match types and quantities, and generate a regex pattern optimized for a specific DLP vendor. +- **Regex Translator & Tester:** Paste any regex, select a target vendor, and get the pattern translated for that vendor's regex engine. Test it against sample strings with instant match/no-match diagnostics. +- **10 Vendor Engines Supported:** Forcepoint DLP, Forcepoint DSPM, Symantec DLP, Palo Alto Networks, Zscaler, Netskope, Trellix DLP, Fortinet, Microsoft Purview, and Proofpoint — each with documented engine-specific transformations. +- **27 Match Types:** Digits, letters (upper/lower), word characters, whitespace, special characters, exact text, character sets, ranges, and more. +- **Failure Diagnostics:** When a test string doesn't match, the tool progressively walks each regex token against the input and pinpoints exactly which part failed and where. +- **Plain English Explanations:** Every generated regex includes a step-by-step "How It Works" breakdown in plain language, not regex syntax. + +### 2. Threat Protection (/threat-protection) +Verify your antivirus, EPP, EDR, or gateway antivirus solutions detect industry-standard malware signatures: +- **EICAR Standard Anti-Virus Test File** — Industry standard from eicar.org. 68-byte benign ASCII string recognized by every major AV engine. +- **Three formats** — `.com` (native executable), `.txt` (plain text content inspection), `.zip` (archive scanning depth) +- **HTTPS delivery** — Use with SSL/TLS inspection enabled on your firewall to verify gateway-side detection; endpoint detection works either way. ### 3. MITRE ATT&CK Simulator (/mitre) Execute a sequential adversary Kill Chain simulating complete attack lifecycles: -- Initial Access (T1190): Exploit Public-Facing App (Log4j simulation) +- Initial Access (T1190): Exploit Public-Facing Application (Log4j simulation) - Execution (T1059.001): PowerShell download cradle attempts -- Credential Access (T1003.001): OS Credential Dumping (Mimikatz simulation) +- Credential Access (T1003.001): OS Credential Dumping (Mimikatz string-pattern detection) - Exfiltration (T1048.003): Unencrypted Protocol data extraction ### 4. NGFW Tests (/ngfw) Verify firewall efficacy against various network attacks and evasions: - **IPS Signature Testing:** Run real-time intrusion prevention tests including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Path Traversal attack simulations. -- **Advanced Evasion Techniques (AET):** Validate firewall inspection capabilities against Log4j header injections, Hex-encoded SQLi, and Shellshock probes. -- **Command & Control (C2) Simulations:** Test outbound traffic policies using Python Stagers and Web Shell simulators to verify beacon detection. -- **Out-of-Band (OOB) Exfiltration:** Check for unauthorized data extraction channels by simulating OOB DNS and HTTP data exfiltration. +- **Advanced Evasion Techniques (AET):** Validate firewall inspection capabilities against Log4j header injections, Hex-encoded SQLi, and Shellshock-style response-side signature detection. +- **Command & Control (C2) Simulations:** Test outbound traffic policies using PowerShell download cradles, Apache Struts RCE patterns, and PHP web shell simulators to verify beacon detection. +- **Path-Based Rotation:** Each attack uses a unique `/r1`–`/r9` URL prefix so the firewall logs each attack as a distinct event (no log deduplication). - **Protocol Evasion Validation:** Test firewall adherence to RFC standards using Jumbo HTTP Headers and HTTP Method Spoofing techniques. ### 5. Network Pulse (/network-pulse) Real-time telemetry, latency analysis, and connection health monitoring: -- IP Intelligence (ASN, Geolocation, Threat Intel) +- IP Intelligence (public IP, country, edge colo serving the connection) - Latency & Jitter Tracking - Path MTU Discovery ## Privacy & Safety - **Free to Use**: Tools are available for security researchers and admins at no cost. -- **Safe Simulation**: All malware samples are benign simulators designed exclusively for detection testing. No real malicious actions are performed. +- **Safe Simulation**: All test payloads are inert detection signatures (EICAR, RFC 2606 example.com hosts, documented CVE patterns). No live infrastructure is targeted. +- **Consent-Gated Offensive Tests**: First-time visitors to /ngfw, /mitre, and /threat-protection see a one-time consent modal confirming authorized use, payload scope, privacy, and export-control. Acceptance persists locally in the browser only. - **Privacy First**: Analysis occurs locally or securely via ephemeral stateless functions. -- **No Data Stored**: No user data is collected, logged, or transmitted to external servers. +- **No Data Stored**: No user accounts, no tracking cookies, no server-side storage of test inputs or results. + +## Compliance & Export Control +- ITSecTools is a defensive validation tool. Use is intended only for networks you own or are explicitly authorized to test. +- An informational banner is displayed to visitors connecting from US-sanctioned regions (IR, KP, CU, SY, sanctioned RU territories). Access is not technically blocked; users must self-attest to lawful use in their jurisdiction. +- Full Terms of Use: https://itsectools.com/terms ## Help & User Guides Detailed feature-by-feature documentation for every tool: -- Threat Protection Guide: https://itsectools.com/help/threat-generation — Malware simulation, evasion techniques, malicious macros. -- DLP Validator Guide: https://itsectools.com/help/dlp-validator — 7-step workflow: Download Test Files, Evasive Payload Download, Label & Classification Check, Data Leakage Simulator, Advanced DLP Tests, Generate & Share Report, DLP Regex Builder. +- Threat Protection Guide: https://itsectools.com/help/threat-generation — EICAR test files, gateway vs. endpoint detection, SSL inspection requirements. +- DLP Validator Guide: https://itsectools.com/help/dlp-validator — File uploads, downloads, text POST, metadata checker, regex creator, regex translator, DLP test data generator. - NGFW Testing Guide: https://itsectools.com/help/ngfw-testing — IPS signature tests, advanced evasion techniques, C2 beacon simulation, console output interpretation. - MITRE ATT&CK Guide: https://itsectools.com/help/mitre-attack — Kill chain concept, T1190, T1059.001, T1003.001, T1048.003 stages, results interpretation. -- Threat Generation Guide: https://itsectools.com/help/threat-generation — EICAR test files, heuristic malware samples, ransomware simulator. - Network Pulse Guide: https://itsectools.com/help/network-pulse — Public IP detection, latency, jitter, packet loss, Path MTU discovery, AI security insights. ## Blog Practical guides and tutorials on DLP testing, MCP protocol exfiltration, NGFW validation, and security testing: +- Your DLP Watches File Uploads — Nobody's Watching the Chat Tab (Shadow AI): https://itsectools.com/blog/shadow-ai-chat-data-leakage - How to Test Your DLP Policy — Free Tool & Complete Guide: https://itsectools.com/blog/test-dlp-policy-free-tool-guide -- Your DLP Passes Every Test but Misses Real Exfiltration: https://itsectools.com/blog/dlp-false-confidence-testing -- DLP Regex Builder for Forcepoint, Symantec, Zscaler & 7 More: https://itsectools.com/blog/dlp-regex-builder-vendors - Free EICAR Test File Download — All Formats: https://itsectools.com/blog/eicar-test-file-download +- DLP Regex Builder for Forcepoint, Symantec, Zscaler & 7 More: https://itsectools.com/blog/dlp-regex-builder-vendors - How to Validate NGFW IPS Signatures — Step-by-Step: https://itsectools.com/blog/ngfw-ips-signature-validation - MITRE ATT&CK Kill Chain Testing — Free Browser-Based Simulator: https://itsectools.com/blog/mitre-attack-kill-chain-testing - ITSecTools vs Other DLP Testing Tools — Feature Comparison: https://itsectools.com/blog/itsectools-vs-dlp-testing-tools @@ -108,3 +112,4 @@ Practical guides and tutorials on DLP testing, MCP protocol exfiltration, NGFW v - Help Center: https://itsectools.com/help - Blog: https://itsectools.com/blog - Contact: https://itsectools.com/contact +- Terms of Use: https://itsectools.com/terms