BOLA enumeration
Sequential object access against another user's records.
Expected: D1 + D2 + D3 -> BOLA_ENUMERATION >= 90
Traffic lab
Simulator
Run a controlled scenario
Drives real traffic through Monika's proxy via POST /_monika/simulate — only one scenario runs at a time.
Credential stuffing
Repeated login failures across distinct usernames.
Expected: D3 -> CREDENTIAL_STUFFING >= 75
SQL injection
Tautology payloads sent to the search endpoint.
Expected: D4 -> SQL_INJECTION >= 60
Sensitive scrape
High-volume product reads expose configured fields.
Expected: D2 + D4 -> DATA_EXPOSURE >= 70
Function abuse
A non-admin token probes the admin surface.
Expected: D1 -> FUNCTION_LEVEL_AUTH >= 70
Benign burst
Normal traffic control with no expected incident.
Expected: No incident expected