 CyberSecurityUP
|
5f1573ac7f
|
misconfig/CVE/PoC/rate-limit agents, data-safety guardrail, Burp proxy, PoC dir
Agents (+10 → library 375): absurd-misconfig hunters (exposed .git/.env/backups,
debug/actuator, default creds, dir listing, ops dashboards, permissive CORS,
verbose errors), a CVE Hunter (fingerprint → correlate → safe PoC), a PoC
Developer (writes runnable scripts to the run's pocs/), and a Rate-Limit tester.
Doctrine (pipeline):
- SAFETY_DOCTRINE injected into every exploit/chain/host prompt: no modify/delete/
exfiltrate/state-change without permission; on PII prove with a masked sample +
count, never dump.
- tool_doctrine adds: smart targeted nuclei (fingerprint-first, -tags/-id, rate/
timeouts), misconfig hunting, rate-limit control checks, authorized tool
download (git clone PoC repos / fetch scanners), Burp/ZAP proxy routing, and a
per-run PoC workspace.
Harness/CLI/REPL:
- RunConfig.proxy; spawn_engagement creates <workdir>/pocs and exports
NEUROSPLOIT_POCS + NEUROSPLOIT_PROXY (proxy from cfg or the env var).
- REPL /proxy <url> and /burp (Session.proxy); /show shows proxy.
Docs: README highlights + Cloud/counts (375), RELEASE v3.5.5 sections.
|
2026-07-01 23:40:47 -03:00 |
|
|
CyberSecurityUP
|
eb4e13efea
|
v3.5.1: live findings + /finding + Ctrl+O/expand + 3-way /stop (soft validate) + report URL + structured Typst + IIS/CMS/CVE agents
REPL interactivity & findings:
- Live findings registered during a run: /results shows them accumulating;
/finding opens a selection menu with FULL details (PoC, command, evidence,
CVSS, OWASP/CWE, remediation). Past runs too.
- /expand (and Ctrl+O) dump the last full, untruncated commands.
- Findings colored by severity in the feed (not all-yellow); confirmed vote = green.
Stop & report:
- CRITICAL: /stop no longer kills validation. New SOFT stop (pool.soft) halts
launching new agents but lets in-flight + VALIDATION finish — so confirmed
findings are kept. /stop now asks 3 ways: [1] validate then report,
[2] report raw (no validation), [3] discard.
- Report file:// URL printed on completion/stop.
Report:
- Typst report restructured: executive summary, a Vulnerability Summary TABLE
(#, vuln, severity, CVSS, OWASP/CWE), and per-finding sections with criticality,
CVSS, OWASP/CWE, description/impact, PoC, evidence, remediation. owasp passed through.
Agents: +14 app-stack/CVE (IIS tilde/WebDAV/ViewState/debug/handler-bypass,
CMS fingerprint + WordPress/Joomla/Drupal/default-admin, app-server consoles,
exposed VCS, known-CVE & outdated-component exploitation) → 343 total.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-06-24 23:21:43 -03:00 |
|
|
CyberSecurityUP
|
55af0d4634
|
NeuroSploit v3.3.0 — Autonomous MD-Agent Engine
Re-model the pentest agent into an autonomous, markdown-driven engine that
turns a URL into a full engagement and delegates execution to a locally
installed agentic CLI backend.
Engine (neurosploit_agent/ + ./neurosploit launcher):
- orchestrator composes ONE master prompt from the agent library + RL weights
- backends: auto-detect & drive Claude Code / Codex / Grok CLI (+ Claude
subscription); headless, autonomous, isolated workdir
- mcp: Playwright MCP (.mcp.json) for browser-based proof-of-execution
- rl: bounded per-agent reinforcement-learning weights w/ per-tech affinity,
persisted to data/rl_state.json
- models: latest registry incl. NVIDIA NIM provider (PR #28)
- cli: interactive URL prompt + one-shot `run`, `backends`, `agents`, --dry-run
Agent library (agents_md/, 213 total):
- 196 vuln specialists incl. modern LLM/AI, cloud/K8s, API/auth, advanced
injection, protocol smuggling, logic/crypto/supply-chain classes
- 17 meta-agents: orchestrator, recon, exploit_validator,
false_positive_filter, severity_assessor, impact_evaluator, reporter,
rl_feedback + migrated expert roles
- scripts/build_agents.py data-driven builder; REGISTRY.md index
Docs: rewritten README.md, v3.3.0 RELEASE.md, .env.example (NVIDIA NIM, xAI,
engine vars).
Retire legacy Python orchestration (neurosploit.py + agent classes) to legacy/.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-06-14 20:57:38 -03:00 |
|