v3.5.6 — bug-bounty corpus grounding + 2FA bypass agent; Trendshift badge

- Fetched & analysed real public writeup corpora (Awesome-Bugbounty-Writeups, bug-bounty-reference); the technique distribution (XSS/RCE/CSRF/SSRF/2FA/…) validates the methodology agent's priorities. Added explicit 2FA/MFA bypass and SAML/SSO sections to bugbounty_methodology. - New agent twofa_bypass_techniques (library 399): full 2FA-bypass playbook (rate-limit brute, reuse, response manipulation, step skip, null/default, backup/remember-me, race, disable-2FA IDOR, SSO side door). - README: Trendshift badge. - Version bumped 3.5.5 -> 3.5.6 across crates/app/installers/docs; RELEASE section.
2026-07-21 18:20:53 +02:00 · 2026-07-10 00:40:01 -03:00
parent f2971b6630
commit 26a8c84dc5
18 changed files with 144 additions and 32 deletions
@@ -1,4 +1,8 @@
-<h1 align="center">🧠 NeuroSploit v3.5.5</h1>
+<h1 align="center">🧠 NeuroSploit v3.5.6</h1>
+
+<p align="center">
+  <a href="https://trendshift.io/repositories/22624?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-22624" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/22624/daily?language=Python" alt="JoasASantos%2FNeuroSploit | Trendshift" width="250" height="55"/></a>
+</p>

 <p align="center">
  <a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
@@ -8,10 +12,10 @@
 </p>

 <p align="center">
-  <img src="https://img.shields.io/badge/Version-3.5.5-blue?style=flat-square">
+  <img src="https://img.shields.io/badge/Version-3.5.6-blue?style=flat-square">
  <img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
  <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
-  <img src="https://img.shields.io/badge/MD%20Agents-398-red?style=flat-square">
+  <img src="https://img.shields.io/badge/MD%20Agents-399-red?style=flat-square">
  <img src="https://img.shields.io/badge/Models-14%20providers-success?style=flat-square">
  <img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host-9cf?style=flat-square">
  <img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
@@ -24,7 +28,7 @@
 >
 > 📖 **New here? Read the [full Tutorial & User Guide →](TUTORIAL.md)** — every mode, flag, config and example explained.

-> 🆕 **New in v3.5.5 — Cloud testing + REPL navigation + deeper recon:**
+> 🆕 **New in v3.5.6 — Cloud testing + REPL navigation + deeper recon:**
 > **AWS/GCP/Azure** agents (+17 → **375** total) with credentials wired through
 > `creds.yaml`; a more navigable **REPL** — **`/timeout`** idle guardrail,
 > **multi-target** `/target a,b,c` (sequential), an interactive **`/results`**
@@ -44,7 +48,7 @@ LLMs** — via **API key** or local **subscription** (Claude Code / Codex / Gemi
 Grok) — recons the target, **intelligently selects only the agents that match the
 discovered surface**, runs them in parallel, **chains** findings into deeper
 impact, and **validates every claim by cross-model voting + tool-receipt
-grounding** before reporting. It ships **398 markdown agents** and a **Mission
+grounding** before reporting. It ships **399 markdown agents** and a **Mission
 Control TUI**.

 ### Engagement modes
@@ -1,3 +1,41 @@
+# NeuroSploit v3.5.6 — Release Notes
+
+**Release Date:** July 2026
+**Codename:** Bug-Bounty Corpus & EOL Hunting
+**License:** MIT
+**Credits:** Joas A Santos & Red Team Leaders
+
+---
+
+## TL;DR
+
+v3.5.6 folds real public bug-bounty knowledge into the agent (methodology
+meta-agent + corpus-grounded techniques), adds a full **2FA/MFA bypass** agent
+(one of the most-reported classes in the writeup corpus), and ships the EOL /
+end-of-support hunting and decision-driven exploitation from the 3.5.5 line.
+Library **399** agents.
+
+## Highlights
+
+- **Bug-bounty methodology, grounded in the real corpus.** The
+  `bugbounty_methodology` meta-agent is validated against the actual technique
+  distribution in public writeup collections (Awesome-Bugbounty-Writeups,
+  bug-bounty-reference) — XSS, RCE, CSRF, SSRF, Clickjacking, SQLi, CORS, LFI,
+  **2FA bypass**, subdomain/account takeover, OAuth, race, **SAML** — and now
+  includes explicit **2FA/MFA bypass** and **SAML/SSO** sections.
+- **New `twofa_bypass_techniques` agent** — the full 2FA-bypass playbook (missing
+  rate-limit brute, code reuse/no-expiry, response manipulation, step skipping,
+  null/default codes, backup/remember-me, race, disable-2FA IDOR, SSO side door),
+  with a control-vs-bypass proof and no account lockout.
+- **KingOfBugBounty-style recon** in `RECON_SYS` (subdomains, wayback, gf, param
+  mining, content discovery, classic exposures) — from 3.5.5, degrades to
+  installed tools.
+- Carries the 3.5.5 features: EOL/end-of-support agents, decision-driven deep
+  exploitation, multi-role `/auth`, browser-driven SPA testing, global install.
+- **README**: Trendshift badge added.
+
+---
+
 # NeuroSploit v3.5.5 — Release Notes

 **Release Date:** July 2026
@@ -1,4 +1,4 @@
-# NeuroSploit — Tutorial & User Guide (v3.5.5)
+# NeuroSploit — Tutorial & User Guide (v3.5.6)

 A complete, hands-on guide to installing, configuring and running NeuroSploit —
 the autonomous, multi-model penetration-testing harness.
@@ -40,7 +40,7 @@ You give NeuroSploit a **target** (URL, repo, app, or host/IP). It:

 1. **Recons** the target with real tools (curl/nmap/…).
 2. **Intelligently selects** only the agents whose preconditions match the recon
-   (it does *not* blindly run all 398).
+   (it does *not* blindly run all 399).
 3. **Exploits** in parallel — each agent works in a ReAct loop and must prove its
   claim with a **tool receipt** (raw output).
 4. **Validates** every candidate by **cross-model voting** (a different model
@@ -98,8 +98,8 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
 ### Verify

 ```bash
-neurosploit --version          # neurosploit 3.5.5
-neurosploit agents             # {"vulns":196,...,"chains":12,"total":398}
+neurosploit --version          # neurosploit 3.5.6
+neurosploit agents             # {"vulns":196,...,"chains":12,"total":399}
 neurosploit models             # all providers & models
 ```

@@ -535,7 +535,7 @@ built from SAST/dataflow), so uncertainty becomes *path reachability*, not state

 ## 13. The agent library

-`agents_md/` holds **398** markdown agents in categories:
+`agents_md/` holds **399** markdown agents in categories:

 | Category | Dir | Count | Purpose |
 |----------|-----|-------|---------|
@@ -48,6 +48,13 @@ proof over breadth.
  over reflected, blind XSS via a collaborator, and chaining XSS → CSRF token theft →
  account takeover. Prove execution in a real browser.
 - **Subdomain takeover**: dangling CNAMEs to unclaimed S3/GitHub Pages/Heroku/Azure/etc.
+- **2FA/MFA bypass** (very common in the corpus): missing rate-limit on the OTP (brute
+  the 4-6 digit code), code reuse / no expiry, response manipulation (`success:false`→`true`,
+  200 vs 4xx), skipping the 2FA step by going straight to the post-2FA endpoint, backup-code
+  / remember-me abuse, null/blank/`000000` codes, race on verification, and disabling 2FA on
+  another account via IDOR.
+- **SAML/SSO**: signature stripping/wrapping (XSW), unsigned-assertion acceptance, `NameID`
+  tampering to another user, audience/recipient confusion, and replay.
 - **Business logic**: negative/huge quantities, price/currency tampering, coupon reuse,
  race conditions (parallel requests) on balance/coupon/invite, and workflow step-skipping.
 - **Web cache poisoning / deception**: unkeyed headers (`X-Forwarded-Host`, `X-Forwarded-Scheme`)
@@ -0,0 +1,63 @@
+# 2FA / MFA Bypass Techniques Agent
+
+## User Prompt
+You are testing **{target}** for **two-factor / MFA bypass**. 2FA bypass is one of
+the most-reported high-impact classes in public bug-bounty writeups — try the full
+playbook, not just one trick.
+
+**Recon Context:**
+{recon_json}
+
+**METHODOLOGY:**
+
+### 1. Map the 2FA flow
+- Log in to reach the 2FA/OTP step; capture the exact requests: where the code is
+  sent, where it's verified, and the response shape for success vs failure.
+
+### 2. Try every bypass (analyse the response each time)
+- **No rate limit → brute force**: send many guesses of the 4–6 digit code; look for
+  the absence of 429/lockout/backoff (mask any account you touch, stay in scope).
+- **Code reuse / no expiry**: reuse an old/used code, or a code after its window.
+- **Response manipulation**: flip the verify response (`{"success":false}`→`true`,
+  `verified:false`→`true`, 4xx→200) via an intercepting proxy and see if the session
+  is upgraded to fully-authenticated.
+- **Step skipping**: after password (pre-2FA session), go STRAIGHT to a post-2FA
+  authenticated endpoint / the "2FA success" redirect — is the app already logged in?
+- **Null / blank / default codes**: try empty, `000000`, `123456`, removing the code
+  param entirely.
+- **Backup / remember-me abuse**: weak/guessable backup codes, or a "remember this
+  device" token that's reusable/forgeable across accounts.
+- **Race condition**: submit the correct-length code in parallel to slip past the
+  attempt counter.
+- **Disable-2FA IDOR**: call the "disable 2FA" / "reset 2FA" endpoint for ANOTHER
+  user's id, or change the bound phone/email without re-auth.
+- **OAuth/SSO side door**: does a social-login path skip 2FA entirely?
+
+### 3. Confirm
+- Show the two requests (blocked/failed control vs the bypass) and prove you reached
+  the fully-authenticated session or a post-2FA resource.
+
+### 4. Report Format
+For each CONFIRMED finding:
+```
+FINDING:
+- Title: 2FA/MFA Bypass via [technique] at [endpoint]
+- Severity: High
+- CWE: CWE-287
+- Endpoint: [verify/step endpoint]
+- Vector: [which bypass]
+- Payload: [exact request(s)]
+- Evidence: [control vs bypass request+response proving full auth]
+- Impact: Authentication bypass / account takeover
+- Remediation: [enforce rate-limit+lockout, single-use expiring codes, verify 2FA
+  server-side before any post-2FA action, authorize disable/reset by session user]
+```
+
+## System Prompt
+You are an authentication-bypass specialist. 2FA is only as strong as its weakest
+step — you methodically try rate-limit/brute, reuse, response manipulation, step
+skipping, null/default codes, backup/remember-me, race, and disable-2FA IDOR, and you
+analyse the response after each to decide the next. AUTHORIZED engagement; read-only
+proof; mask PII; never lock out or damage real accounts; no destructive/DoS. Report
+ONLY what you proved with a real receipt (control vs bypass). Credits: Joas A Santos
+and Red Team Leaders.
@@ -14,7 +14,7 @@ function Ok ($m) { Write-Host "  + $m" -ForegroundColor Green }
 function Warn($m){ Write-Host "  ! $m" -ForegroundColor Yellow }

 Write-Host ""
-Write-Host "  NeuroSploit installer (Windows) — v3.5.5" -ForegroundColor Cyan
+Write-Host "  NeuroSploit installer (Windows) — v3.5.6" -ForegroundColor Cyan

 # arch → asset arch (only x64 prebuilt today; arm64 falls back to source)
 $rawArch = $env:PROCESSOR_ARCHITECTURE
@@ -29,7 +29,7 @@ $ref  = $env:NEUROSPLOIT_REF
 if (-not $ref) {
  try { $ref = (Invoke-RestMethod "https://api.github.com/repos/$slug/releases/latest").tag_name } catch { }
 }
-if (-not $ref) { $ref = "v3.5.5" }
+if (-not $ref) { $ref = "v3.5.6" }
 Say "Release: $ref"

 New-Item -ItemType Directory -Force -Path $dir | Out-Null
@@ -871,7 +871,7 @@ dependencies = [

 [[package]]
 name = "neurosploit"
-version = "3.5.5"
+version = "3.5.6"
 dependencies = [
 "anyhow",
 "clap",
@@ -888,7 +888,7 @@ dependencies = [

 [[package]]
 name = "neurosploit-harness"
-version = "3.5.5"
+version = "3.5.6"
 dependencies = [
 "anyhow",
 "futures",
@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
 resolver = "2"

 [workspace.package]
-version = "3.5.5"
+version = "3.5.6"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/JoasASantos/NeuroSploit"
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.5.5 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
+//! NeuroSploit v3.5.6 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).

 mod repl;
 mod tui;
@@ -11,8 +11,8 @@ use std::path::{Path, PathBuf};
 #[command(
    name = "neurosploit",
    version,
-    about = "NeuroSploit v3.5.5 — multi-model autonomous pentest harness",
-    long_about = "NeuroSploit v3.5.5 — a Rust multi-model harness that drives a pool of LLMs \
+    about = "NeuroSploit v3.5.6 — multi-model autonomous pentest harness",
+    long_about = "NeuroSploit v3.5.6 — a Rust multi-model harness that drives a pool of LLMs \
 (API key or local subscription: Claude/Codex/Gemini/Grok) to autonomously test a target. \
 After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
 them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
@@ -634,7 +634,7 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
    println!("  │  ua     : {ua}");
    write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));

-    println!("  ┌─ NeuroSploit v3.5.5  ·  by Joas A Santos & Red Team Leaders");
+    println!("  ┌─ NeuroSploit v3.5.6  ·  by Joas A Santos & Red Team Leaders");
    println!("  │  run id : {run_id}");
    println!("  │  target : {}", cfg.target);
    println!("  │  models : {}", cfg.models.join(", "));
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.5.5 — interactive session (Claude-Code / Codex / Cursor-CLI style).
+//! NeuroSploit v3.5.6 — interactive session (Claude-Code / Codex / Cursor-CLI style).
 //!
 //! Launched when `neurosploit` runs with no subcommand. A persistent REPL with
 //! real line editing (arrow-key history recall, Ctrl-A/E/K, paste), model
@@ -329,7 +329,7 @@ pub async fn repl(base: &Path) -> anyhow::Result<()> {
    let backends = harness::installed_cli_backends();
    println!("\x1b[1m");
    println!("  ███╗   ██╗███████╗██╗   ██╗██████╗  ██████╗");
-    println!("  ████╗  ██║██╔════╝██║   ██║██╔══██╗██╔═══██╗   NeuroSploit v3.5.5");
+    println!("  ████╗  ██║██╔════╝██║   ██║██╔══██╗██╔═══██╗   NeuroSploit v3.5.6");
    println!("  ██╔██╗ ██║█████╗  ██║   ██║██████╔╝██║   ██║   interactive harness");
    println!("  ██║╚██╗██║██╔══╝  ██║   ██║██╔══██╗██║   ██║   by Joas A Santos");
    println!("  ██║ ╚████║███████╗╚██████╔╝██║  ██║╚██████╔╝   & Red Team Leaders");
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.5.5 — TUI "Mission Control" mode.
+//! NeuroSploit v3.5.6 — TUI "Mission Control" mode.
 //!
 //! Concurrent panels that update live while the engagement runs in the
 //! background, with a composer input that stays active during execution:
@@ -1,4 +1,4 @@
-//! POMDP belief-state world model (v3.5.5).
+//! POMDP belief-state world model (v3.5.6).
 //!
 //! The target is only partially observable, so we don't track booleans — we
 //! track a **belief**: a property graph whose nodes (host / service / vuln /
@@ -1,4 +1,4 @@
-//! Verification / grounding engine (v3.5.5).
+//! Verification / grounding engine (v3.5.6).
 //!
 //! Hard rule: **no claim enters the world model without a tool receipt** — raw
 //! tool output, not the LLM's paraphrase. This is the empirical anti-hallucination
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.5.5 harness — a robust multi-model runtime for the
+//! NeuroSploit v3.5.6 harness — a robust multi-model runtime for the
 //! markdown-driven autonomous pentest engine.
 //!
 //! The harness loads the `agents_md/` library, drives a *pool* of LLM models
@@ -1,4 +1,4 @@
-//! POMDP decision layer (v3.5.5): value-of-information planning + the
+//! POMDP decision layer (v3.5.6): value-of-information planning + the
 //! anti-hallucination gate.
 //!
 //! The choice "scan more vs exploit now" is **not** a heuristic here — it falls
@@ -1,4 +1,4 @@
-//! Deterministic HTTP request/response analysis (v3.5.5).
+//! Deterministic HTTP request/response analysis (v3.5.6).
 //!
 //! Before the LLM recon runs, the harness performs a **real** probe of the
 //! target and captures observed facts — status, headers, security headers,
@@ -97,9 +97,9 @@ pub fn html(target: &str, findings: &[Finding]) -> String {
         h4{{margin:12px 0 3px;font-size:12px;text-transform:uppercase;letter-spacing:.5px;color:#8b5cf6}}\
         .b{{color:#8b5cf6;font-weight:800}}</style></head><body>\
         <h1><span class=b>NeuroSploit</span> Penetration Test Report</h1>\
-         <div class=meta>Target: <b>{t}</b> · v3.5.5 Rust harness · multi-model validated</div>\
+         <div class=meta>Target: <b>{t}</b> · v3.5.6 Rust harness · multi-model validated</div>\
         <div>{chips}</div>{graph_block}<h2>Findings ({n})</h2>{body}\
-         <p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.5 · by <b>Joas A Santos</b> &amp; <b>Red Team Leaders</b></p></body></html>",
+         <p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.6 · by <b>Joas A Santos</b> &amp; <b>Red Team Leaders</b></p></body></html>",
        t = esc(target), chips = chips, n = sorted.len(), body = body, graph_block = graph_block,
    )
 }
@@ -135,7 +135,7 @@ pub fn typst_report(target: &str, findings: &[Finding], dir: &Path) -> std::io::
    let mut data = String::new();
    data.push_str(&format!(
        "#let meta = (target: {}, run_id: {}, generated: {}, model: {})\n",
-        tq(target), tq(&run_id), tq("NeuroSploit v3.5.5"), tq("multi-model")
+        tq(target), tq(&run_id), tq("NeuroSploit v3.5.6"), tq("multi-model")
    ));
    data.push_str("#let findings = (\n");
    for f in sorted_findings(findings) {
@@ -28,7 +28,7 @@ cat <<'BANNER'

   ███╗   ██╗███████╗██╗   ██╗██████╗  ██████╗
   ████╗  ██║██╔════╝██║   ██║██╔══██╗██╔═══██╗   NeuroSploit installer
-   ██╔██╗ ██║█████╗  ██║   ██║██████╔╝██║   ██║   v3.5.5 — Rust harness
+   ██╔██╗ ██║█████╗  ██║   ██║██████╔╝██║   ██║   v3.5.6 — Rust harness
   ██║╚██╗██║██╔══╝  ██║   ██║██╔══██╗██║   ██║   by Joas A Santos
   ██║ ╚████║███████╗╚██████╔╝██║  ██║╚██████╔╝   & Red Team Leaders
   ╚═╝  ╚═══╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝ ╚═════╝
@@ -63,7 +63,7 @@ if [ -z "$REF" ]; then
  REF="$(dl "https://api.github.com/repos/${REPO_SLUG}/releases/latest" /dev/stdout 2>/dev/null \
         | grep -m1 '"tag_name"' | sed -E 's/.*"tag_name" *: *"([^"]+)".*/\1/' || true)"
 fi
-[ -z "$REF" ] && REF="v3.5.5"
+[ -z "$REF" ] && REF="v3.5.6"
 say "Release: $REF"

 installed=0