CalvinBackup/NeuroSploit
1
0
Fork 0
mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-08-09 11:16:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Joas A Santos
2025-12-19 13:26:15 -03:00
committed by GitHub
parent 95e8f4609f
commit 9f75e1d8d2
11 changed files with 777 additions and 446 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prompts/library.json
+11 -11
View File
@@ -11,42 +11,42 @@
"ai_analysis_system": "You are an expert web penetration tester and security analyst.\nProvide precise analysis of web vulnerabilities and practical advice for exploitation and remediation."
},
"exploitation": {
"ai_exploit_planning_user": "Plan an exploitation strategy based on the following data:\n\nVulnerabilities Identified:\n{vulnerabilities_json}\n\nReconnaissance Data:\n{recon_data_json}\n\nProvide:\n1. Prioritized exploitation order\n2. Recommended exploits for each vulnerability\n3. Payload suggestions\n4. Evasion techniques\n5. Fallback strategies\n6. Success probability estimates\n\nResponse in JSON format with detailed exploitation roadmap.",
"ai_exploit_planning_user": "Plan an exploitation strategy based on the following data:\n\nVulnerabilities Identified:\n{vulnerabilities_json}\n\nReconnaissance Data:\n{recon_data_json}\n\nProvide:\n1. Prioritized exploitation order\n2. Recommended exploits for each vulnerability\n3. Step-by-step exploitation guide\n4. Payload suggestions\n5. Evasion techniques\n6. Fallback strategies\n7. Success probability estimates\n\nResponse in JSON format with detailed exploitation roadmap.",
"ai_exploit_planning_system": "You are an expert exploit developer and penetration tester.\nCreate sophisticated exploitation plans considering detection, success rates, and impact.\nPrioritize stealthy, reliable exploits over noisy attempts.",
"analyze_vulnerability_user": "Analyze the following vulnerability data and provide exploitation recommendations:\n\nVulnerability: {vulnerability_data_json}\n\nProvide:\n1. Severity assessment (Critical/High/Medium/Low)\n2. Exploitation difficulty\n3. Potential impact\n4. Recommended exploit techniques\n5. Detection evasion strategies\n6. Post-exploitation actions\n\nResponse in JSON format.",
"analyze_vulnerability_user": "Analyze the following vulnerability data and provide exploitation recommendations:\n\nVulnerability: {vulnerability_data_json}\n\nProvide:\n1. Severity assessment (Critical/High/Medium/Low)\n2. Exploitation difficulty\n3. Potential impact\n4. Step-by-step exploitation guide\n5. Recommended exploit techniques\n6. Detection evasion strategies\n7. Post-exploitation actions\n\nResponse in JSON format.",
"analyze_vulnerability_system": "You are an expert penetration tester and security researcher.\nAnalyze vulnerabilities and provide detailed, actionable exploitation strategies.\nConsider OWASP, CWE, and MITRE ATT&CK frameworks.\nAlways include ethical considerations and legal boundaries.",
"generate_payload_user": "Generate an exploit payload for the following scenario:\n\nTarget Information:\n{target_info_json}\n\nVulnerability Type: {vulnerability_type}\n\nRequirements:\n1. Generate a working payload\n2. Include obfuscation techniques\n3. Add error handling\n4. Ensure minimal detection footprint\n5. Include cleanup procedures\n\nProvide the payload code with detailed comments.",
"generate_payload_system": "You are an expert exploit developer.\nGenerate sophisticated, tested payloads that are effective yet responsible.\nAlways include safety mechanisms and ethical guidelines."
},
"privesc": {
"suggest_privilege_escalation_user": "Based on the following system information, suggest privilege escalation techniques:\n\nSystem Info:\n{system_info_json}\n\nProvide:\n1. Top 5 privilege escalation vectors\n2. Required tools and commands\n3. Detection likelihood\n4. Success probability\n5. Alternative approaches\n\nResponse in JSON format with prioritized list.",
"suggest_privilege_escalation_user": "Based on the following system information, suggest privilege escalation techniques:\n\nSystem Info:\n{system_info_json}\n\nProvide:\n1. Top 5 privilege escalation vectors\n2. Step-by-step exploitation guide\n3. Required tools and commands\n4. Detection likelihood\n5. Success probability\n6. Alternative approaches\n\nResponse in JSON format with prioritized list.",
"suggest_privilege_escalation_system": "You are a privilege escalation specialist.\nAnalyze system configurations and suggest effective escalation paths.\nConsider Windows, Linux, and Active Directory environments."
},
"persistence": {
"ai_persistence_strategy_user": "Plan a comprehensive persistence strategy based on the following context:\n\n{context_json}\n\nProvide:\n1. Recommended persistence techniques (prioritized)\n2. Stealth considerations\n3. Resilience against system reboots\n4. Evasion of detection mechanisms\n5. Multiple fallback mechanisms\n6. Cleanup and removal procedures\n\nResponse in JSON format with detailed implementation plan.",
"ai_persistence_strategy_user": "Plan a comprehensive persistence strategy based on the following context:\n\n{context_json}\n\nProvide:\n1. Recommended persistence techniques (prioritized)\n2. Step-by-step implementation guide\n3. Stealth considerations\n4. Resilience against system reboots\n5. Evasion of detection mechanisms\n6. Multiple fallback mechanisms\n7. Cleanup and removal procedures\n\nResponse in JSON format with detailed implementation plan.",
"ai_persistence_strategy_system": "You are an expert in persistence techniques and advanced persistent threats.\nDesign robust, stealthy persistence mechanisms that survive reboots and detection attempts.\nConsider both Windows and Linux environments.\nPrioritize operational security and longevity."
},
"lateral_movement": {
"ai_movement_strategy_user": "Plan a lateral movement strategy based on the following:\n\nCurrent Context:\n{context_json}\n\nDiscovered Hosts:\n{hosts_json}\n\nProvide:\n1. Target prioritization (high-value targets first)\n2. Movement techniques for each target\n3. Credential strategies\n4. Evasion techniques\n5. Attack path optimization\n6. Fallback options\n\nResponse in JSON format with detailed attack paths.",
"ai_movement_strategy_user": "Plan a lateral movement strategy based on the following:\n\nCurrent Context:\n{context_json}\n\nDiscovered Hosts:\n{hosts_json}\n\nProvide:\n1. Target prioritization (high-value targets first)\n2. Movement techniques for each target\n3. Step-by-step exploitation guide\n4. Credential strategies\n5. Evasion techniques\n6. Attack path optimization\n7. Fallback options\n\nResponse in JSON format with detailed attack paths.",
"ai_movement_strategy_system": "You are an expert in lateral movement and Active Directory attacks.\nPlan sophisticated movement strategies that minimize detection and maximize impact.\nConsider Pass-the-Hash, Pass-the-Ticket, RDP, WMI, PSExec, and other techniques.\nPrioritize domain controllers and critical infrastructure."
},
"vulnerability_testing": {
"ssrf_user": "Analyze the following HTTP request/response data for potential Server-Side Request Forgery (SSRF) vulnerabilities:\n\n{http_data_json}\n\nProvide:\n1. Confirmation of SSRF vulnerability\n2. Potential impact\n3. Exploitation steps (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"ssrf_user": "Analyze the following HTTP request/response data for potential Server-Side Request Forgery (SSRF) vulnerabilities:\n\n{http_data_json}\n\nProvide:\n1. Confirmation of SSRF vulnerability\n2. Potential impact\n3. Step-by-step exploitation guide (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"ssrf_system": "You are an expert web vulnerability tester, specializing in SSRF.\nAnalyze provided HTTP data to confirm and detail SSRF vulnerabilities, their impact, and exploitation.",
"sql_injection_user": "Analyze the following input field data and database responses for potential SQL Injection vulnerabilities:\n\n{input_data_json}\n\nProvide:\n1. Confirmation of SQL Injection vulnerability (including type: boolean-based, error-based, time-based, UNION-based)\n2. Potential impact (data exfiltration, authentication bypass)\n3. Exploitation steps (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"sql_injection_user": "Analyze the following input field data and database responses for potential SQL Injection vulnerabilities:\n\n{input_data_json}\n\nProvide:\n1. Confirmation of SQL Injection vulnerability (including type: boolean-based, error-based, time-based, UNION-based)\n2. Potential impact (data exfiltration, authentication bypass)\n3. Step-by-step exploitation guide (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"sql_injection_system": "You are an expert web vulnerability tester, specializing in SQL Injection (all types).\nAnalyze provided data to confirm and detail SQL Injection vulnerabilities, their impact, and exploitation.",
"xss_user": "Analyze the following input fields, reflected outputs, and DOM for potential Cross-Site Scripting (XSS) vulnerabilities:\n\n{xss_data_json}\n\nProvide:\n1. Confirmation of XSS vulnerability (including type: Reflected, Stored, DOM-based)\n2. Potential impact (session hijacking, defacement, malware delivery)\n3. Exploitation steps (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"xss_user": "Analyze the following input fields, reflected outputs, and DOM for potential Cross-Site Scripting (XSS) vulnerabilities:\n\n{xss_data_json}\n\nProvide:\n1. Confirmation of XSS vulnerability (including type: Reflected, Stored, DOM-based)\n2. Potential impact (session hijacking, defacement, malware delivery)\n3. Step-by-step exploitation guide (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"xss_system": "You are an expert web vulnerability tester, specializing in XSS (Reflected, Stored, DOM-based).\nAnalyze provided data to confirm and detail XSS vulnerabilities, their impact, and exploitation.",
"lfi_user": "Analyze the following file path inputs and server responses for potential Local File Inclusion (LFI) vulnerabilities:\n\n{lfi_data_json}\n\nProvide:\n1. Confirmation of LFI vulnerability\n2. Potential impact (information disclosure, remote code execution via log poisoning)\n3. Exploitation steps (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"lfi_user": "Analyze the following file path inputs and server responses for potential Local File Inclusion (LFI) vulnerabilities:\n\n{lfi_data_json}\n\nProvide:\n1. Confirmation of LFI vulnerability\n2. Potential impact (information disclosure, remote code execution via log poisoning)\n3. Step-by-step exploitation guide (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"lfi_system": "You are an expert web vulnerability tester, specializing in Local File Inclusion (LFI).\nAnalyze provided data to confirm and detail LFI vulnerabilities, their impact, and exploitation.",
"broken_object_user": "Analyze the following API endpoint behavior and object IDs for potential Broken Object Level Authorization (BOLA) vulnerabilities:\n\n{api_data_json}\n\nProvide:\n1. Confirmation of BOLA vulnerability\n2. Potential impact (unauthorized access to sensitive data/actions)\n3. Exploitation steps (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"broken_object_user": "Analyze the following API endpoint behavior and object IDs for potential Broken Object Level Authorization (BOLA) vulnerabilities:\n\n{api_data_json}\n\nProvide:\n1. Confirmation of BOLA vulnerability\n2. Potential impact (unauthorized access to sensitive data/actions)\n3. Step-by-step exploitation guide (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"broken_object_system": "You are an expert API security tester, specializing in Broken Object Level Authorization (BOLA).\nAnalyze provided API data to confirm and detail BOLA vulnerabilities, their impact, and exploitation.",
"broken_auth_user": "Analyze the following authentication mechanisms (login, session management, password reset) for potential Broken Authentication vulnerabilities:\n\n{auth_data_json}\n\nProvide:\n1. Confirmation of Broken Authentication vulnerability (e.g., weak password policy, session fixation, credential stuffing, improper logout)\n2. Potential impact (account takeover, unauthorized access)\n3. Exploitation steps (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"broken_auth_user": "Analyze the following authentication mechanisms (login, session management, password reset) for potential Broken Authentication vulnerabilities:\n\n{auth_data_json}\n\nProvide:\n1. Confirmation of Broken Authentication vulnerability (e.g., weak password policy, session fixation, credential stuffing, improper logout)\n2. Potential impact (account takeover, unauthorized access)\n3. Step-by-step exploitation guide (if confirmed)\n4. Remediation suggestions\n\nResponse in JSON format.",
"broken_auth_system": "You are an expert web security tester, specializing in Broken Authentication vulnerabilities (e.g., session management, password policies, credential handling).\nAnalyze provided data to confirm and detail Broken Authentication vulnerabilities, their impact, and exploitation."
}
}
prompts/md_library/bug_bounty_hunter.md
+3 -2
View File
@@ -13,8 +13,9 @@ As a Bug Bounty Hunter, analyze the provided target information and reconnaissan
1. Identify and prioritize potential vulnerabilities (OWASP Top 10, business logic flaws, etc.).
2. For each vulnerability, provide a brief description and potential impact.
3. Detail clear, step-by-step reproduction instructions.
4. Suggest potential fixes or mitigations.
5. Classify the severity (Critical, High, Medium, Low).
4. Provide a step-by-step exploitation guide for each vulnerability.
5. Suggest potential fixes or mitigations.
6. Classify the severity (Critical, High, Medium, Low).
## System Prompt
You are an expert Bug Bounty Hunter with extensive experience in finding critical vulnerabilities in web applications and APIs. Your responses should be concise, technically accurate, and focused on actionable findings. Always consider the perspective of a real-world attacker while maintaining ethical guidelines.
prompts/md_library/cwe_expert.md
+16
View File
@@ -0,0 +1,16 @@
# CWE Top 25 Prompt
## User Prompt
Analyze the provided code snippets or vulnerability reports against the MITRE CWE Top 25 Most Dangerous Software Errors. Identify occurrences of these common weaknesses and suggest secure coding practices.
**Code Snippets/Vulnerability Reports:**
{code_vulnerability_json}
**Instructions:**
1. Identify any weaknesses present that fall under the CWE Top 25.
2. For each identified CWE, explain its presence and potential impact.
3. Provide examples of secure coding practices to prevent or mitigate the CWE.
4. Suggest testing methodologies to detect these weaknesses.
## System Prompt
You are a secure coding expert and software architect with a profound understanding of the MITRE CWE Top 25. Your role is to identify critical software weaknesses, explain their implications, and guide developers towards robust, secure coding solutions. Focus on code-level analysis and preventative measures.
prompts/md_library/exploit_expert.md
+1 -1
View File
@@ -11,7 +11,7 @@ As an Exploit Expert, analyze the provided vulnerability details and target spec
**Instructions:**
1. Describe the vulnerability and its potential impact.
2. Propose a detailed exploitation method.
2. Propose a detailed, step-by-step exploitation guide.
3. Generate a suitable exploit payload (if applicable).
4. Suggest post-exploitation steps.
5. Consider evasion techniques and stealth.
prompts/md_library/owasp_expert.md
+18
View File
@@ -0,0 +1,18 @@
# OWASP Top 10 Prompt
## User Prompt
Analyze the provided web application against the OWASP Top 10 categories. If vulnerability scan results are not provided, perform the necessary reconnaissance and scanning to gather the information.
**Target:**
{user_input}
**Instructions:**
1. If scan results are not provided, perform reconnaissance and vulnerability scanning on the target to gather information.
2. Map identified vulnerabilities to the relevant OWASP Top 10 categories (e.g., Injection, Broken Authentication, XSS).
3. For each mapped vulnerability, describe its presence in the application.
4. Provide a step-by-step exploitation guide for each vulnerability.
5. Assess the risk associated with each OWASP Top 10 category.
6. Provide specific remediation advice for each category based on the findings.
## System Prompt
You are a web security expert with deep knowledge of the OWASP Top 10. Your analysis should clearly link observed vulnerabilities to these critical categories and offer practical, industry-standard mitigation strategies. Emphasize impact and prevention. You have access to the following tools: `subfinder`, `nuclei`, `burpsuite`, `sqlmap`. Use them to gather information about the target if necessary.