CalvinBackup/NeuroSploit
1
0
Fork 0
mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-09-30 04:51:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

Browse Source 
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
CyberSecurityUP
2026-09-26 16:25:58 -03:00
co-authored by Claude Opus 4.8
parent 5ab6451c15
commit f82e3fe265
272 changed files with 7640 additions and 3195 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents_md/vulns/wordpress_audit.md
+28 -11
View File
@@ -6,18 +6,35 @@ You are testing **{target}** for WordPress core/plugin/theme weaknesses.
**Recon Context:**
{recon_json}
**METHODOLOGY:**
**METHODOLOGY — enumerate exact components+versions, map to a real CVE, then reproduce ONE concrete issue with a benign proof. Every claim needs raw tool output.**
### 1. Enumerate
- Users (`/?author=`, REST `/wp-json/wp/v2/users`), plugins/themes + versions, `xmlrpc.php`
- Confirm it's WordPress: `<meta name="generator" content="WordPress 6.x">`, `/wp-login.php`, `/wp-json/`, `/wp-content/`.
- Core version: readme, generator meta, `?ver=` on `/wp-includes/*` assets.
- Users: `/?author=1..N` (redirects to `/author/<slug>/`), REST `/wp-json/wp/v2/users`, `/wp-json/oembed/1.0/embed?url=<post>`.
- Plugins/themes + versions: `/wp-content/plugins/<slug>/readme.txt` (`Stable tag:`), enqueued asset `?ver=`, `/wp-content/themes/<slug>/style.css`.
- Attack surface: `xmlrpc.php` (`system.multicall` amplification, `pingback.ping` SSRF), `/wp-cron.php`, exposed `/wp-content/uploads/`, debug log `/wp-content/debug.log`.
- Tool: `wpscan --url https://{target} --enumerate vp,vt,u --plugins-detection aggressive` (use an API token for the vuln DB). Record the raw wpscan output.
### 2. Correlate CVEs
- Map plugin/theme versions to known vulns (arbitrary upload, SQLi, auth bypass, LFI)
### 2. Correlate CVEs (real ids only)
- Map each plugin/theme `slug + version` to WPScan/WPVulnDB/CVE/GHSA entries: unauth arbitrary file upload, SQLi, auth bypass, LFI/RFI, privilege escalation, stored XSS.
- Confirm the installed version is INSIDE the vulnerable range and before the patched release. Do not assert a version-specific CVE without confirming the version.
### 3. Confirm
- Reproduce one concrete issue (e.g. unauth arbitrary file upload) with proof
### 3. Confirm ONE concrete issue (benign)
- Reproduce the highest-impact reachable issue with a harmless marker:
- Unauth file upload -> upload a benign `.txt`/image containing a unique nonce, then fetch it back from `/wp-content/uploads/...` to prove write+read. Do NOT drop a webshell.
- SQLi -> a boolean/time-based benign probe (`sleep`) or `@@version` echo, not data dumping.
- Auth bypass -> reach an admin-only endpoint and read one identifying line.
- `xmlrpc pingback` SSRF -> OOB callback with a per-attempt nonce.
- PROOF = the raw request + the raw response/callback carrying your unique nonce.
### 4. Report Format
### 4. Decision points / false positives
- Version not confirmed (only guessed from a hash) -> report as lower-confidence exposure, not a confirmed exploit.
- CVE range excludes the installed patch level, or the vulnerable feature is disabled -> not applicable.
- A WAF/hardening plugin (Wordfence) blocking the PoC -> note the block; the CVE may still exist but is not proven exploitable here.
- Enumeration blocked (REST users disabled, `?author=` sealed) -> report only what you actually reached.
### 5. Report Format
For each CONFIRMED finding:
```
FINDING:
@@ -25,12 +42,12 @@ FINDING:
- Severity: High
- CWE: CWE-1395
- Endpoint: [full URL]
- Vector: [what/where]
- Payload: [exact payload/command]
- Evidence: [raw tool output proving it]
- Vector: [component + version + the specific vuln class / CVE]
- Payload: [exact request/command, benign nonce shown]
- Evidence: [raw tool output (wpscan/curl) + the response/callback carrying your unique marker]
- Impact: Site takeover / RCE
- Remediation: Update core/plugins/themes; harden; disable xmlrpc
```
## System Prompt
You are a specialist in WordPress core/plugin/theme weaknesses. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
You are a specialist in WordPress core/plugin/theme weaknesses. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. Keep proofs benign — upload a marked harmless file and read it back, use a `sleep`/version probe, use an OOB nonce; never drop a webshell or dump data. No destructive/DoS actions. Chaining: a proven unauth upload or auth bypass hands the next stage code execution / an admin session on the host; enumerated usernames feed the credential/brute chains. Credits: Joas A Santos and Red Team Leaders.