PTK passive DAST fixtures

This suite is the passive counterpart to the SAST and IAST playgrounds. It is built around real browser-visible traffic: exact routes, response headers, content types, JSON specs, cookies, attachment downloads, SSE, and HTTPS-only cases that passive DAST modules key off.

Start the route-aware fixture server with node DOM-based-test-cases/passive/server.mjs, then open this page from the same server. The links below are representative routes, not just static files.

Back to main

Representative coverage: headers, sensitive data, well-known metadata, Swagger/OpenAPI/GraphQL, stack traces, client secrets, workflow and tenant boundaries, framework/admin surfaces, realtime routes, and deserialization indicators.

HTTPS

Headers, CORS, cache, and trust boundaries

Weak security headers, cookies, CSP trust, cache posture, wildcard postMessage, origin allowlists, and an insecure ws:// literal from an HTTPS response.

/passive/fixtures/headers/weak-security.html

JS asset

Client config and secret-like values

Representative key, token, webhook, DSN, and private-material patterns embedded in a JavaScript asset.

/passive/assets/client-config.js

HTML

Errors, stack traces, and internal hints

Node, Java, .NET, Python, and PHP traces together with internal IPs, service names, cluster DNS, and environment hints.

/passive/fixtures/errors/stacktraces.html

API docs

Swagger, OpenAPI, ReDoc, and GraphQL

API documentation, GraphQL consoles, specs, persisted-query shapes, and GraphQL schema/error terms.

/passive/swagger-ui/index.html

Metadata

.well-known and metadata files

Security metadata, OIDC/OAuth configuration, JWKS, change-password, robots, humans, and mobile-association files.

/.well-known/openid-configuration

Workflow

Forms, workflows, and high-risk parameters

Hidden redirect, role, tenant, token, callback, and finance/support fields plus sensitive form actions and dangerous query names.

/passive/checkout/payment.html

Tenant

Tenant-boundary surfaces

Tenant routes, scope headers/cookies, tenant slug fields, and switch-org or switch-tenant workflow hints.

/orgs/acme/workspaces/red-team/settings.html

Realtime

Realtime and upgrade surfaces

Socket.IO, SockJS, SSE, WebSocket upgrade paths, realtime literals, and token placement patterns.

/passive/realtime/overview.html

Frameworks

Framework and console surfaces

WordPress, Drupal, DWR, database consoles, product consoles, queue dashboards, and debug/admin routes.

/wp-admin/index.html

Data

Sensitive data and serialized indicators

Credit cards, SSNs, serialized-object markers, unsafe blobs, and helper links that place secrets in URLs.

/passive/fixtures/data/sensitive-data.html

Suggested manual sweep

Family	Suggested routes
Headers and cache	`https://localhost:3443/passive/fixtures/headers/weak-security.html`, `http://localhost:3080/passive/fixtures/headers/hsts-over-http.html`
API docs and GraphQL	`/passive/swagger-ui/index.html`, `/passive/openapi.json`, `/passive/graphql`, `/passive/graphiql`
.well-known metadata	`/.well-known/openid-configuration`, `/.well-known/security.txt`, `/.well-known/jwks.json`
Workflows, tenant, and auth	`/passive/checkout/payment.html`, `/login`, `/mfa/verify`, `/orgs/acme/workspaces/red-team/settings.html`
Realtime	`/passive/realtime/overview.html`, `/socket.io/?EIO=4&transport=websocket`, `/passive/realtime/events`