/**
 * OWASP-aligned attack scenarios for auth forms. Each attack is a
 * pure async function that takes a `DetectedAuthForm` (+ a context
 * bag) and returns the findings it produced.
 *
 * Why one file rather than one-per-attack: each routine is ~30-60
 * lines, the OWASP refs naturally live as a table at the top of the
 * file, and the attacks share helpers (resetForm, submit, etc.) that
 * would otherwise need their own module.
 *
 * Each attack is responsible for **not** leaving the form in a
 * half-submitted state — subsequent attacks expect the page to be
 * fresh-ish. We call `resetForm()` before each attack and after
 * navigations.
 */
import type { Page } from "playwright";
import type { AuthAttackName, AuthFinding, DetectedAuthForm } from "./types.js";
export interface AttackContext {
    page: Page;
    startUrl: string;
    testCredentials: {
        username: string;
        password: string;
    };
    verbose: boolean;
}
export declare function runAttack(attack: AuthAttackName, form: DetectedAuthForm, ctx: AttackContext): Promise<AuthFinding[]>;
//# sourceMappingURL=attacks.d.ts.map