passive test plan
test-plan passive-test-plan.yaml
This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.
Validates against the test-plan schema — try it: POST /v1/validate with {"schema": "test-plan", "document": …}.
The document (YAML original)
version: "1.0"
test_plan_id: TEST-DEMO-PASSIVE-001
authorization_id: AUTH-DEMO-2026-001
client_id: client-demo
target: https://security-demo.example.com
environment: production
mode: passive
objective: Verify public website edge controls and detect deployment drift without active attack payloads.
scope:
allowed_hosts: [security-demo.example.com]
allowed_paths: ["/"]
allowed_accounts: []
allowed_data: [public-response-metadata]
excluded_dependencies: [payment-provider, analytics-provider, shared-cdn-control-plane]
test_cases:
- test_id: WEB-PASSIVE-DNS-TLS
family: transport-and-domain
references: [OWASP-ASVS-5.0.0, OWASP-WSTG-4.2]
control_objective: DNS, certificates, protocols, and redirects resolve to the intended client service.
interaction: Bounded DNS lookup, TLS handshake, and HTTP HEAD/GET requests.
preconditions: [ownership-proof-verified, external-scope-enforcement]
permitted_methods: [dns-query, tls-handshake, http-head, http-get]
prohibited_effects: [state-change, credential-use, third-party-targeting]
expected_result: Trusted certificate, intended host routing, approved protocol policy, and deterministic HTTPS redirect behavior.
evidence_required: [dns-answer, certificate-chain, protocol-result, redirect-chain, timestamp]
cleanup: [none-required]
default_enabled: true
- test_id: WEB-PASSIVE-RESPONSE
family: headers-cookies-errors-exposure
references: [OWASP-ASVS-5.0.0, OWASP-ZAP-BASELINE]
control_objective: Public responses apply intended browser controls and reveal no obvious secret, debug, or deployment exposure.
interaction: Brief same-host crawl and passive response analysis.
preconditions: [rate-limit-enforced, redirect-boundary-enforced, kill-switch-ready]
permitted_methods: [same-host-crawl, passive-analysis]
prohibited_effects: [active-payload, form-submission, file-upload, authentication-attempt]
expected_result: No material passive finding and no scope escape.
evidence_required: [exact-command, tool-image-identity, report-json, report-html, policy-decision]
cleanup: [remove-ephemeral-container, retain-redacted-evidence]
default_enabled: true
limits:
requests_per_second: 1
concurrency: 1
duration_minutes: 5
max_error_rate: 0.05
max_latency_ms: 3000
max_test_records: 0
stop_conditions:
- target leaves approved host or path boundary
- widespread 5xx responses or material latency increase
- any third-party or cross-tenant content appears
- telemetry or rate enforcement is lost
- emergency contact requests stop
evidence:
destination: evidence://client-demo/web/passive/TEST-DEMO-PASSIVE-001
redact: [authorization, cookie, token, secret, personal-data]
integrity: sha256-plus-signed-manifest
retention_days: 90
cleanup:
- stop worker at duration limit
- remove temporary container and cache
- verify no application state was changed
- record final cleanup status
status: authorized
As JSON
{
"version": "1.0",
"test_plan_id": "TEST-DEMO-PASSIVE-001",
"authorization_id": "AUTH-DEMO-2026-001",
"client_id": "client-demo",
"target": "https://security-demo.example.com",
"environment": "production",
"mode": "passive",
"objective": "Verify public website edge controls and detect deployment drift without active attack payloads.",
"scope": {
"allowed_hosts": [
"security-demo.example.com"
],
"allowed_paths": [
"/"
],
"allowed_accounts": [],
"allowed_data": [
"public-response-metadata"
],
"excluded_dependencies": [
"payment-provider",
"analytics-provider",
"shared-cdn-control-plane"
]
},
"test_cases": [
{
"test_id": "WEB-PASSIVE-DNS-TLS",
"family": "transport-and-domain",
"references": [
"OWASP-ASVS-5.0.0",
"OWASP-WSTG-4.2"
],
"control_objective": "DNS, certificates, protocols, and redirects resolve to the intended client service.",
"interaction": "Bounded DNS lookup, TLS handshake, and HTTP HEAD/GET requests.",
"preconditions": [
"ownership-proof-verified",
"external-scope-enforcement"
],
"permitted_methods": [
"dns-query",
"tls-handshake",
"http-head",
"http-get"
],
"prohibited_effects": [
"state-change",
"credential-use",
"third-party-targeting"
],
"expected_result": "Trusted certificate, intended host routing, approved protocol policy, and deterministic HTTPS redirect behavior.",
"evidence_required": [
"dns-answer",
"certificate-chain",
"protocol-result",
"redirect-chain",
"timestamp"
],
"cleanup": [
"none-required"
],
"default_enabled": true
},
{
"test_id": "WEB-PASSIVE-RESPONSE",
"family": "headers-cookies-errors-exposure",
"references": [
"OWASP-ASVS-5.0.0",
"OWASP-ZAP-BASELINE"
],
"control_objective": "Public responses apply intended browser controls and reveal no obvious secret, debug, or deployment exposure.",
"interaction": "Brief same-host crawl and passive response analysis.",
"preconditions": [
"rate-limit-enforced",
"redirect-boundary-enforced",
"kill-switch-ready"
],
"permitted_methods": [
"same-host-crawl",
"passive-analysis"
],
"prohibited_effects": [
"active-payload",
"form-submission",
"file-upload",
"authentication-attempt"
],
"expected_result": "No material passive finding and no scope escape.",
"evidence_required": [
"exact-command",
"tool-image-identity",
"report-json",
"report-html",
"policy-decision"
],
"cleanup": [
"remove-ephemeral-container",
"retain-redacted-evidence"
],
"default_enabled": true
}
],
"limits": {
"requests_per_second": 1,
"concurrency": 1,
"duration_minutes": 5,
"max_error_rate": 0.05,
"max_latency_ms": 3000,
"max_test_records": 0
},
"stop_conditions": [
"target leaves approved host or path boundary",
"widespread 5xx responses or material latency increase",
"any third-party or cross-tenant content appears",
"telemetry or rate enforcement is lost",
"emergency contact requests stop"
],
"evidence": {
"destination": "evidence://client-demo/web/passive/TEST-DEMO-PASSIVE-001",
"redact": [
"authorization",
"cookie",
"token",
"secret",
"personal-data"
],
"integrity": "sha256-plus-signed-manifest",
"retention_days": 90
},
"cleanup": [
"stop worker at duration limit",
"remove temporary container and cache",
"verify no application state was changed",
"record final cleanup status"
],
"status": "authorized"
}