26a8c84dc5
v3.5.6 — bug-bounty corpus grounding + 2FA bypass agent; Trendshift badge
...
- Fetched & analysed real public writeup corpora (Awesome-Bugbounty-Writeups,
bug-bounty-reference); the technique distribution (XSS/RCE/CSRF/SSRF/2FA/…)
validates the methodology agent's priorities. Added explicit 2FA/MFA bypass and
SAML/SSO sections to bugbounty_methodology.
- New agent twofa_bypass_techniques (library 399): full 2FA-bypass playbook
(rate-limit brute, reuse, response manipulation, step skip, null/default,
backup/remember-me, race, disable-2FA IDOR, SSO side door).
- README: Trendshift badge.
- Version bumped 3.5.5 -> 3.5.6 across crates/app/installers/docs; RELEASE section.
2026-07-10 00:40:01 -03:00
a50178ae71
agents: +8 EOL / end-of-support exploitation agents (library 397)
...
Detect components past their vendor end-of-life/end-of-support window and exploit
the accumulated, unpatched CVEs (pin exact version → check endoflife.date + CVE
feeds → safe PoC):
- vulns: eol_stack_detection, eol_runtime_exploitation, eol_framework_exploitation,
eol_cms_exploitation, eol_client_library
- infra: eol_webserver_exploitation, eol_os_service, eol_tls_protocol
Docs: counts 389->397, RELEASE note.
2026-07-09 19:19:21 -03:00
39c28b541b
decision-driven deep exploitation: DECISION doctrine, multi-role /auth, +6 agents
...
- DECISION_DOCTRINE injected into exploit/grey/chain prompts: analyse responses to
pick the technique; map & connect routes (endpoint output → next endpoint input);
hunt sensitive flows; mine parameters (incl. hidden from JS/source maps) and test
per-param; mock realistic (non-PII) data to reach deeper logic; exploit the
authenticated surface after login and compare roles; build PoCs when a proof
needs an artifact; bypass 401/403/redirect controls.
- REPL /auth now supports multiple named identities (/auth admin <hdr>, /auth user
<hdr>; bare token → Bearer). With >=2 roles the run gets the access-control
directive (IDOR/BOLA/BFLA/privesc, authorized-vs-unauthorized) and tests both.
- +6 decision agents (library 389): param_miner, endpoint_flow_linker,
authenticated_surface_exploit, clickjacking_poc (HTML PoC), csrf_poc (HTML PoC),
access_control_bypass.
- Docs: counts 383->389, RELEASE + /auth help updated.
2026-07-06 10:52:40 -03:00
d931ce09a6
browser-driven testing doctrine + 8 SPA/API agents (Juice Shop-ready)
...
- tool_doctrine: agents now actively DRIVE the browser on JS/SPA targets — use
the Playwright MCP (render, read live DOM, click client-side routes, watch the
network to find the real API, screenshot proof); when no MCP, use the Playwright
CLI (write+run a small script / npx playwright screenshot) to render and capture
XHR/fetch traffic — complementing curl (which only sees the empty shell).
- probe: detect SPAs (<app-root>, ng-version, near-empty body + linked scripts →
Angular/React/Vue/SPA) and note in recon that the browser is required, so the
SPA agents get selected.
- +8 SPA/API agents (library 383): spa_api_discovery, spa_hidden_admin,
login_sqli_bypass, dom_xss_spa, api_bola_numeric_ids,
register_privilege_mass_assign, jwt_forgery_spa, spa_business_logic.
- Docs: README/RELEASE/TUTORIAL counts + notes.
2026-07-05 16:25:34 -03:00
5f1573ac7f
misconfig/CVE/PoC/rate-limit agents, data-safety guardrail, Burp proxy, PoC dir
...
Agents (+10 → library 375): absurd-misconfig hunters (exposed .git/.env/backups,
debug/actuator, default creds, dir listing, ops dashboards, permissive CORS,
verbose errors), a CVE Hunter (fingerprint → correlate → safe PoC), a PoC
Developer (writes runnable scripts to the run's pocs/), and a Rate-Limit tester.
Doctrine (pipeline):
- SAFETY_DOCTRINE injected into every exploit/chain/host prompt: no modify/delete/
exfiltrate/state-change without permission; on PII prove with a masked sample +
count, never dump.
- tool_doctrine adds: smart targeted nuclei (fingerprint-first, -tags/-id, rate/
timeouts), misconfig hunting, rate-limit control checks, authorized tool
download (git clone PoC repos / fetch scanners), Burp/ZAP proxy routing, and a
per-run PoC workspace.
Harness/CLI/REPL:
- RunConfig.proxy; spawn_engagement creates <workdir>/pocs and exports
NEUROSPLOIT_POCS + NEUROSPLOIT_PROXY (proxy from cfg or the env var).
- REPL /proxy <url> and /burp (Session.proxy); /show shows proxy.
Docs: README highlights + Cloud/counts (375), RELEASE v3.5.5 sections.
2026-07-01 23:40:47 -03:00
eb4e13efea
v3.5.1: live findings + /finding + Ctrl+O/expand + 3-way /stop (soft validate) + report URL + structured Typst + IIS/CMS/CVE agents
...
REPL interactivity & findings:
- Live findings registered during a run: /results shows them accumulating;
/finding opens a selection menu with FULL details (PoC, command, evidence,
CVSS, OWASP/CWE, remediation). Past runs too.
- /expand (and Ctrl+O) dump the last full, untruncated commands.
- Findings colored by severity in the feed (not all-yellow); confirmed vote = green.
Stop & report:
- CRITICAL: /stop no longer kills validation. New SOFT stop (pool.soft) halts
launching new agents but lets in-flight + VALIDATION finish — so confirmed
findings are kept. /stop now asks 3 ways: [1] validate then report,
[2] report raw (no validation), [3] discard.
- Report file:// URL printed on completion/stop.
Report:
- Typst report restructured: executive summary, a Vulnerability Summary TABLE
(#, vuln, severity, CVSS, OWASP/CWE), and per-finding sections with criticality,
CVSS, OWASP/CWE, description/impact, PoC, evidence, remediation. owasp passed through.
Agents: +14 app-stack/CVE (IIS tilde/WebDAV/ViewState/debug/handler-bypass,
CMS fingerprint + WordPress/Joomla/Drupal/default-admin, app-server consoles,
exposed VCS, known-CVE & outdated-component exploitation) → 343 total.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-24 23:21:43 -03:00
55af0d4634
NeuroSploit v3.3.0 — Autonomous MD-Agent Engine
...
Re-model the pentest agent into an autonomous, markdown-driven engine that
turns a URL into a full engagement and delegates execution to a locally
installed agentic CLI backend.
Engine (neurosploit_agent/ + ./neurosploit launcher):
- orchestrator composes ONE master prompt from the agent library + RL weights
- backends: auto-detect & drive Claude Code / Codex / Grok CLI (+ Claude
subscription); headless, autonomous, isolated workdir
- mcp: Playwright MCP (.mcp.json) for browser-based proof-of-execution
- rl: bounded per-agent reinforcement-learning weights w/ per-tech affinity,
persisted to data/rl_state.json
- models: latest registry incl. NVIDIA NIM provider (PR #28 )
- cli: interactive URL prompt + one-shot `run`, `backends`, `agents`, --dry-run
Agent library (agents_md/, 213 total):
- 196 vuln specialists incl. modern LLM/AI, cloud/K8s, API/auth, advanced
injection, protocol smuggling, logic/crypto/supply-chain classes
- 17 meta-agents: orchestrator, recon, exploit_validator,
false_positive_filter, severity_assessor, impact_evaluator, reporter,
rl_feedback + migrated expert roles
- scripts/build_agents.py data-driven builder; REGISTRY.md index
Docs: rewritten README.md, v3.3.0 RELEASE.md, .env.example (NVIDIA NIM, xAI,
engine vars).
Retire legacy Python orchestration (neurosploit.py + agent classes) to legacy/.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-14 20:57:38 -03:00
CyberSecurityUP