mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-14 21:50:21 +02:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CyberSecurityUPandClaude Opus 4.8
|
d4bd6d4877 | ||
|
CyberSecurityUPandClaude Opus 4.8
|
702f22a87a | ||
|
CyberSecurityUPandClaude Opus 4.8
|
1be053c4a2 | ||
|
CyberSecurityUPandClaude Opus 4.8
|
d864ea8b8a | ||
|
CyberSecurityUPandClaude Opus 4.8
|
e8df48af9e | ||
|
CyberSecurityUPandClaude Opus 4.8
|
f21b96e8c1 | ||
|
CyberSecurityUPandClaude Opus 4.8
|
ae3e49f133 | ||
|
CyberSecurityUPandClaude Opus 4.8
|
7b1be0b424 | ||
|
CyberSecurityUPandClaude Opus 4.8
|
435463979b | ||
|
CyberSecurityUPandClaude Opus 4.8
|
5d83e8848e | ||
|
CyberSecurityUPandClaude Opus 4.8
|
deca20d11f | ||
|
CyberSecurityUPandClaude Opus 4.8
|
0a2cf58d9e | ||
|
CyberSecurityUPandClaude Opus 4.8
|
96f00c1c68 |
@@ -100,3 +100,5 @@ runs/
|
||||
data/rl_state_rs.json
|
||||
neurosploit-rs/runs/
|
||||
v34_gui.png
|
||||
data/repl_runs.json
|
||||
data/repl_history.txt
|
||||
|
||||
-289
@@ -1,289 +0,0 @@
|
||||
# NeuroSploit v3 - Quick Start Guide
|
||||
|
||||
Get NeuroSploit running in under 5 minutes.
|
||||
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
| Requirement | Minimum | Recommended |
|
||||
|-------------|---------|-------------|
|
||||
| **Python** | 3.10+ | 3.12 |
|
||||
| **Node.js** | 18+ | 20 LTS |
|
||||
| **Docker** | 24+ | Latest (for Kali sandbox) |
|
||||
| **RAM** | 4 GB | 8 GB+ |
|
||||
| **Disk** | 2 GB | 5 GB (with Kali image) |
|
||||
| **LLM API Key** | 1 provider | Claude recommended |
|
||||
|
||||
---
|
||||
|
||||
## Step 1: Clone & Configure
|
||||
|
||||
```bash
|
||||
git clone https://github.com/your-org/NeuroSploitv2.git
|
||||
cd NeuroSploitv2
|
||||
|
||||
# Create your environment file
|
||||
cp .env.example .env
|
||||
```
|
||||
|
||||
Edit `.env` and add at least one API key:
|
||||
|
||||
```bash
|
||||
# Pick one (or more):
|
||||
ANTHROPIC_API_KEY=sk-ant-... # Claude (recommended)
|
||||
OPENAI_API_KEY=sk-... # GPT-4
|
||||
GEMINI_API_KEY=AI... # Gemini Pro
|
||||
OPENROUTER_API_KEY=sk-or-... # OpenRouter (any model)
|
||||
```
|
||||
|
||||
> **No API key?** Use a local LLM (Ollama or LM Studio) -- see [Local LLM Setup](#local-llm-setup) below.
|
||||
|
||||
---
|
||||
|
||||
## Step 2: Install Dependencies
|
||||
|
||||
### Backend
|
||||
|
||||
```bash
|
||||
pip install -r backend/requirements.txt
|
||||
```
|
||||
|
||||
### Frontend
|
||||
|
||||
```bash
|
||||
cd frontend
|
||||
npm install
|
||||
cd ..
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 3: Build Kali Sandbox Image (Optional but Recommended)
|
||||
|
||||
The Kali sandbox enables isolated tool execution (Nuclei, Nmap, SQLMap, etc.) in Docker containers.
|
||||
|
||||
```bash
|
||||
# Requires Docker Desktop running
|
||||
./scripts/build-kali.sh --test
|
||||
```
|
||||
|
||||
This builds a Kali Linux image with 28 pre-installed security tools. Takes ~5 min on first build.
|
||||
|
||||
> **No Docker?** NeuroSploit works without it -- the agent uses HTTP-only testing. Docker adds tool-based scanning (Nuclei, Nmap, etc.).
|
||||
|
||||
---
|
||||
|
||||
## Step 4: Start NeuroSploit
|
||||
|
||||
### Option A: Development Mode (hot reload)
|
||||
|
||||
Terminal 1 -- Backend:
|
||||
```bash
|
||||
uvicorn backend.main:app --host 0.0.0.0 --port 8000 --reload
|
||||
```
|
||||
|
||||
Terminal 2 -- Frontend:
|
||||
```bash
|
||||
cd frontend
|
||||
npm run dev
|
||||
```
|
||||
|
||||
Open: **http://localhost:5173**
|
||||
|
||||
### Option B: Production Mode
|
||||
|
||||
```bash
|
||||
# Build frontend
|
||||
cd frontend && npm run build && cd ..
|
||||
|
||||
# Start backend (serves frontend too)
|
||||
uvicorn backend.main:app --host 0.0.0.0 --port 8000
|
||||
```
|
||||
|
||||
Open: **http://localhost:8000**
|
||||
|
||||
### Option C: Quick Start Script
|
||||
|
||||
```bash
|
||||
./start.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Step 5: Verify Setup
|
||||
|
||||
### Check API Health
|
||||
|
||||
```bash
|
||||
curl http://localhost:8000/api/health
|
||||
```
|
||||
|
||||
Expected response:
|
||||
```json
|
||||
{
|
||||
"status": "healthy",
|
||||
"app": "NeuroSploit",
|
||||
"version": "3.0.0",
|
||||
"llm": {
|
||||
"status": "configured",
|
||||
"provider": "claude",
|
||||
"message": "AI agent ready"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Check Swagger Docs
|
||||
|
||||
Open **http://localhost:8000/api/docs** for interactive API documentation.
|
||||
|
||||
---
|
||||
|
||||
## Your First Scan
|
||||
|
||||
### Option 1: Auto Pentest (Recommended)
|
||||
|
||||
1. Open the web interface
|
||||
2. Click **Auto Pentest** in the sidebar
|
||||
3. Enter a target URL (e.g., `http://testphp.vulnweb.com`)
|
||||
4. Click **Start Auto Pentest**
|
||||
5. Watch the 3-stream parallel scan in real-time
|
||||
|
||||
### Option 2: Via API
|
||||
|
||||
```bash
|
||||
curl -X POST http://localhost:8000/api/v1/agent/run \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"target": "http://testphp.vulnweb.com",
|
||||
"mode": "auto_pentest"
|
||||
}'
|
||||
```
|
||||
|
||||
### Option 3: Vuln Lab (Single Type)
|
||||
|
||||
1. Click **Vuln Lab** in the sidebar
|
||||
2. Pick a vulnerability type (e.g., `xss_reflected`)
|
||||
3. Enter target URL
|
||||
4. Click **Run Test**
|
||||
|
||||
---
|
||||
|
||||
## Pages Overview
|
||||
|
||||
| Page | What it does |
|
||||
|------|-------------|
|
||||
| **Dashboard** (`/`) | Stats, severity charts, recent activity |
|
||||
| **Auto Pentest** (`/auto`) | One-click full autonomous pentest |
|
||||
| **Vuln Lab** (`/vuln-lab`) | Test specific vuln types (100 available) |
|
||||
| **Terminal Agent** (`/terminal`) | AI chat + command execution |
|
||||
| **Sandboxes** (`/sandboxes`) | Monitor Kali containers in real-time |
|
||||
| **Scheduler** (`/scheduler`) | Schedule recurring scans |
|
||||
| **Reports** (`/reports`) | View/download generated reports |
|
||||
| **Settings** (`/settings`) | Configure LLM providers, features |
|
||||
|
||||
---
|
||||
|
||||
## Local LLM Setup
|
||||
|
||||
### Ollama (Easiest)
|
||||
|
||||
```bash
|
||||
# Install Ollama
|
||||
curl -fsSL https://ollama.ai/install.sh | sh
|
||||
|
||||
# Pull a model
|
||||
ollama pull llama3.1
|
||||
|
||||
# Add to .env
|
||||
echo "OLLAMA_BASE_URL=http://localhost:11434" >> .env
|
||||
```
|
||||
|
||||
### LM Studio
|
||||
|
||||
1. Download from [lmstudio.ai](https://lmstudio.ai)
|
||||
2. Load any model (e.g., Mistral, Llama)
|
||||
3. Start the server on port 1234
|
||||
4. Add to `.env`:
|
||||
```
|
||||
LMSTUDIO_BASE_URL=http://localhost:1234
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Kali Sandbox Commands
|
||||
|
||||
```bash
|
||||
# Build image
|
||||
./scripts/build-kali.sh
|
||||
|
||||
# Rebuild from scratch
|
||||
./scripts/build-kali.sh --fresh
|
||||
|
||||
# Build + verify tools work
|
||||
./scripts/build-kali.sh --test
|
||||
|
||||
# Check running containers (via API)
|
||||
curl http://localhost:8000/api/v1/sandbox/
|
||||
|
||||
# Monitor via web UI
|
||||
# Open http://localhost:8000/sandboxes
|
||||
```
|
||||
|
||||
### Pre-installed tools (28)
|
||||
|
||||
nuclei, naabu, httpx, subfinder, katana, dnsx, uncover, ffuf, gobuster, dalfox, waybackurls, nmap, nikto, sqlmap, masscan, whatweb, curl, wget, git, python3, pip3, go, jq, dig, whois, openssl, netcat, bash
|
||||
|
||||
### On-demand tools (28 more)
|
||||
|
||||
Installed inside the container automatically when first needed:
|
||||
|
||||
wpscan, dirb, hydra, john, hashcat, testssl, sslscan, enum4linux, dnsrecon, amass, medusa, crackmapexec, gau, gitleaks, anew, httprobe, dirsearch, wfuzz, arjun, wafw00f, sslyze, commix, trufflehog, retire, fierce, nbtscan, responder
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### "AI agent not configured"
|
||||
|
||||
Check your `.env` has at least one valid API key:
|
||||
```bash
|
||||
curl http://localhost:8000/api/health | python3 -m json.tool
|
||||
```
|
||||
|
||||
### "Kali sandbox image not found"
|
||||
|
||||
Build the Docker image:
|
||||
```bash
|
||||
./scripts/build-kali.sh
|
||||
```
|
||||
|
||||
### "Docker daemon not running"
|
||||
|
||||
Start Docker Desktop, then retry.
|
||||
|
||||
### "Port 8000 already in use"
|
||||
|
||||
```bash
|
||||
lsof -i :8000
|
||||
kill <PID>
|
||||
```
|
||||
|
||||
### Frontend not loading
|
||||
|
||||
Dev mode: ensure frontend is running (`npm run dev` in `/frontend`).
|
||||
Production: ensure `frontend/dist/` exists (`cd frontend && npm run build`).
|
||||
|
||||
---
|
||||
|
||||
## What's Next
|
||||
|
||||
- Read the full [README.md](README.md) for architecture details
|
||||
- Explore the **100 vulnerability types** in Vuln Lab
|
||||
- Set up **scheduled scans** for continuous monitoring
|
||||
- Try the **Terminal Agent** for interactive AI-guided testing
|
||||
- Check the **Sandbox Dashboard** to monitor container health
|
||||
|
||||
---
|
||||
|
||||
**NeuroSploit v3** - *AI-Powered Autonomous Penetration Testing Platform*
|
||||
@@ -1,253 +1,259 @@
|
||||
# NeuroSploit v3.4.0
|
||||
<h1 align="center">🧠 NeuroSploit v3.5.0</h1>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
|
||||
<a href="https://github.com/JoasASantos/NeuroSploit/network/members"><img src="https://img.shields.io/github/forks/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=a855f7" alt="Forks"></a>
|
||||
<a href="https://github.com/JoasASantos/NeuroSploit/issues"><img src="https://img.shields.io/github/issues/JoasASantos/NeuroSploit?style=for-the-badge&color=22d3ee" alt="Issues"></a>
|
||||
<img src="https://img.shields.io/github/last-commit/JoasASantos/NeuroSploit?style=for-the-badge&color=34d399" alt="Last commit">
|
||||
</p>
|
||||
|
||||
**Autonomous, markdown-driven AI penetration testing — now with a Rust multi-model harness.**
|
||||
<p align="center">
|
||||
<img src="https://img.shields.io/badge/Version-3.5.0-blue?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/MD%20Agents-303-red?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/Models-12%20providers-success?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
|
||||
</p>
|
||||
|
||||
NeuroSploit turns a URL (or a code repository) into an autonomous security
|
||||
engagement. A high-performance **Rust harness** (`tokio` + `axum`) drives a
|
||||
**pool of LLM models** with concurrency, **provider failover**, and **N-model
|
||||
validator voting** — multiple models must independently agree a finding is real
|
||||
before it is reported. After recon, the harness **intelligently selects** which
|
||||
of the **249 markdown agents** match the target instead of running them blindly,
|
||||
learns across runs via a **reinforcement-learning** reward loop, and serves its
|
||||
own polished web dashboard.
|
||||
<p align="center"><b>Autonomous, multi-model penetration-testing harness — Rust, CLI-only.</b><br>
|
||||
<i>by Joas A Santos & Red Team Leaders</i></p>
|
||||
|
||||
> The Python engine (v3.3.0) and the original monolith live in
|
||||
> [`legacy/`](legacy/README.md); the v3.3.0 stdlib dashboard remains in `webgui/`.
|
||||
|
||||
## 🦀 The Rust harness (`neurosploit-rs/`)
|
||||
|
||||
```bash
|
||||
cd neurosploit-rs && cargo build --release
|
||||
|
||||
# Web dashboard (black-box + white-box modes)
|
||||
./target/release/neurosploit serve # → http://127.0.0.1:8788
|
||||
|
||||
# Black-box: recon → intelligent agent selection → parallel exploit → vote → report
|
||||
./target/release/neurosploit run https://target.example \
|
||||
--model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --vote-n 3
|
||||
|
||||
# White-box: analyse a repository's source for vulnerabilities
|
||||
./target/release/neurosploit whitebox /path/to/repo --subscription --model anthropic:claude-opus-4-8
|
||||
|
||||
# Subscription (no API key) + real browser proof via Playwright MCP
|
||||
./target/release/neurosploit run https://t.example --subscription --mcp --model anthropic:claude-opus-4-8
|
||||
|
||||
# Pipeline self-test, no keys/login required
|
||||
./target/release/neurosploit run https://t.example --offline
|
||||
```
|
||||
|
||||
**What it does**
|
||||
|
||||
- **Two modes** — *black-box* (URL recon → exploit) and *white-box* (walk a repo,
|
||||
run code-review/SAST agents on the source).
|
||||
- **Intelligent selection** — the model picks the agents whose preconditions match
|
||||
the recon, then runs that subset (not top-N).
|
||||
- **Multi-model pool** — bounded concurrency, **provider failover**, and the same
|
||||
panel forms the **N-model validator jury** that cuts false positives.
|
||||
- **Two auth paths** — **model APIs** (provider key) *or* **subscription**: drive
|
||||
your local **Claude Code / Codex / Grok / Gemini** logins directly, no API key.
|
||||
- **12 providers / 40+ models** (Claude, GPT, Grok, **Gemini**, NVIDIA NIM,
|
||||
DeepSeek, Mistral, Qwen, Groq, Together, OpenRouter, Ollama).
|
||||
- **RL rewards** persisted to `data/rl_state_rs.json` — validated findings reward
|
||||
an agent, biasing the next run.
|
||||
- **Artifacts for reuse** — every run writes `runs/<target>-<ts>/`:
|
||||
`recon.json/md`, `exploitation.md`, `findings.json/md`, `report.html`.
|
||||
- **Playwright MCP** on the subscription path for real browser-based proof.
|
||||
|
||||
### Agent library — 249 agents
|
||||
|
||||
| Category | Dir | Count | Purpose |
|
||||
|----------|-----|-------|---------|
|
||||
| Vulnerability specialists | `agents_md/vulns/` | 196 | Exploit a specific vuln class |
|
||||
| Recon | `agents_md/recon/` | 12 | Information gathering / attack surface |
|
||||
| Code (white-box SAST) | `agents_md/code/` | 24 | Source-code vulnerability review |
|
||||
| Meta | `agents_md/meta/` | 17 | Orchestrator, validator, scorers, reporter, RL |
|
||||
> ⭐ If this is useful, **star the repo** — it helps a lot.
|
||||
|
||||
---
|
||||
|
||||
## Why this architecture
|
||||
**Autonomous, multi-model penetration-testing harness — Rust, CLI-only.**
|
||||
|
||||
| Old (≤ v3.2.4) | New (v3.3.0) |
|
||||
|----------------|-------------|
|
||||
| 2,500-line Python orchestrator + hand-coded agent classes | Markdown agents + thin engine |
|
||||
| One embedded LLM loop | Pluggable agentic CLI backends (Claude/Codex/Grok) |
|
||||
| Provider SDK juggling | Backend owns the agent loop; engine just composes & collects |
|
||||
| Static agent list | RL-weighted, recon-aware agent selection |
|
||||
| Reflection-based "evidence" | Playwright MCP proof-of-execution + adversarial validation |
|
||||
This branch is the **slim, Rust-only** distribution: the `neurosploit-rs/` workspace
|
||||
plus the `agents_md/` agent library. It turns a URL (black-box) or a code
|
||||
repository (white-box) into an autonomous engagement that drives a pool of LLMs
|
||||
— via **API key** or local **subscription** (Claude Code / Codex / Gemini / Grok)
|
||||
— recons the target, **intelligently selects only the agents matching the
|
||||
discovered surface**, runs them in parallel, then validates every finding by
|
||||
**cross-model voting** before reporting.
|
||||
|
||||
> The full project (Python engine, web GUIs, history) lives on the `main` branch.
|
||||
|
||||
---
|
||||
|
||||
## 📦 Install (one line)
|
||||
|
||||
```bash
|
||||
curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
|
||||
```
|
||||
|
||||
The installer auto-installs Rust if needed, clones the repo to `~/.neurosploit`,
|
||||
builds the release binary, and links `neurosploit` into `~/.local/bin`. Re-run it
|
||||
any time to update. Tweak with env vars: `NEUROSPLOIT_REF` (branch/tag),
|
||||
`NEUROSPLOIT_DIR`, `PREFIX`.
|
||||
|
||||
Prefer to build by hand?
|
||||
|
||||
```bash
|
||||
git clone https://github.com/JoasASantos/NeuroSploit && cd NeuroSploit/neurosploit-rs
|
||||
cargo build --release # → target/release/neurosploit
|
||||
```
|
||||
|
||||
## ⚡ Quick start (60 seconds)
|
||||
|
||||
```bash
|
||||
# easiest path — just run it; the interactive session asks everything:
|
||||
neurosploit
|
||||
|
||||
# or one-liner (subscription login, no API key needed):
|
||||
neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v
|
||||
```
|
||||
|
||||
No login? Use an **API key** instead — see [Authentication](#authentication--run-via-api-key-or-subscription).
|
||||
|
||||
---
|
||||
|
||||
## Build
|
||||
|
||||
```bash
|
||||
cd neurosploit-rs
|
||||
cargo build --release # → target/release/neurosploit
|
||||
```
|
||||
|
||||
Requires a Rust toolchain (`rustup`). **Recommended: run on Kali Linux** (or the
|
||||
Kali Docker image) so the offensive tools the agents use are already present:
|
||||
|
||||
```bash
|
||||
docker run -it --rm kalilinux/kali-rolling
|
||||
apt update && apt install -y curl nmap ffuf nodejs npm
|
||||
# rustscan (faster port scan): cargo install rustscan (or grab a release from GitHub)
|
||||
```
|
||||
|
||||
The agents degrade gracefully: if `rustscan` isn't installed they use `nmap`; if
|
||||
neither, they probe with `curl`. If a Playwright MCP browser is available they use
|
||||
it for JS-heavy pages, otherwise they fall back to `curl`.
|
||||
|
||||
---
|
||||
|
||||
## Usage
|
||||
|
||||
Run with **no arguments** for an interactive wizard:
|
||||
|
||||
```bash
|
||||
./target/release/neurosploit
|
||||
```
|
||||
|
||||
Or drive it directly:
|
||||
|
||||
```bash
|
||||
# Black-box — subscription (no API key), Opus, browser via Playwright if present, verbose
|
||||
./target/release/neurosploit run http://testphp.vulnweb.com/ \
|
||||
--subscription --model anthropic:claude-opus-4-8 --mcp -v
|
||||
|
||||
# Black-box — API keys, multi-model voting panel (1st finds, others adjudicate)
|
||||
./target/release/neurosploit run http://testphp.vulnweb.com/ \
|
||||
--model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --vote-n 3
|
||||
|
||||
# White-box — clone a vulnerable app and review its source
|
||||
git clone https://github.com/digininja/DVWA /tmp/DVWA
|
||||
./target/release/neurosploit whitebox /tmp/DVWA \
|
||||
--subscription --model anthropic:claude-opus-4-8 -v
|
||||
|
||||
# Offline pipeline self-test (no keys/login needed)
|
||||
./target/release/neurosploit run http://testphp.vulnweb.com/ --offline
|
||||
|
||||
# Utilities
|
||||
./target/release/neurosploit agents # library counts
|
||||
./target/release/neurosploit models # providers & models
|
||||
./target/release/neurosploit --help # full help with examples
|
||||
```
|
||||
|
||||
### Options (`run` / `whitebox`)
|
||||
|
||||
| Flag | Meaning |
|
||||
|------|---------|
|
||||
| `--model provider:model` | Repeatable. First = primary; the rest fail over **and** form the voting jury. |
|
||||
| `--subscription` | Use the local CLI login (Claude/Codex/Gemini/Grok) instead of an API key. |
|
||||
| `--mcp` | Enable Playwright MCP (auto-provisioned via `npx`; backends without MCP use built-in tools). |
|
||||
| `--vote-n N` | How many models must agree a finding is real (default 3 / 2 for whitebox). |
|
||||
| `--max-agents N` | Cap agents run (`0` = all matching the recon). |
|
||||
| `--offline` | Exercise the full pipeline without calling any model. |
|
||||
| `-v, --verbose` | Log each agent as it launches, recon, and votes. |
|
||||
|
||||
### Authentication — run via API key *or* subscription
|
||||
|
||||
You can run NeuroSploit two ways. They're independent: pick per run.
|
||||
|
||||
#### 1) Via API (provider API key)
|
||||
|
||||
Export the key(s) for the providers in your model panel, then run **without**
|
||||
`--subscription`. Any OpenAI-compatible provider works.
|
||||
|
||||
```bash
|
||||
# pick one or more, depending on the models you select
|
||||
export ANTHROPIC_API_KEY=sk-ant-... # anthropic:claude-*
|
||||
export OPENAI_API_KEY=sk-... # openai:gpt-*
|
||||
export GEMINI_API_KEY=AIza... # gemini:gemini-*
|
||||
export XAI_API_KEY=xai-... # xai:grok-*
|
||||
export NVIDIA_NIM_API_KEY=nvapi-... # nvidia_nim:*
|
||||
export DEEPSEEK_API_KEY=... # deepseek:*
|
||||
export MISTRAL_API_KEY=... # mistral:*
|
||||
export DASHSCOPE_API_KEY=... # qwen:* (Alibaba DashScope)
|
||||
export GROQ_API_KEY=... # groq:*
|
||||
export TOGETHER_API_KEY=... # together:*
|
||||
export OPENROUTER_API_KEY=... # openrouter:*
|
||||
# ollama needs no key (local)
|
||||
|
||||
# then run via API (note: NO --subscription)
|
||||
./target/release/neurosploit run http://testphp.vulnweb.com/ \
|
||||
--model anthropic:claude-opus-4-8 --vote-n 3 -v
|
||||
|
||||
# multi-provider voting panel via API (1st finds, the others adjudicate)
|
||||
./target/release/neurosploit run http://testphp.vulnweb.com/ \
|
||||
--model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --model gemini:gemini-2.5-pro
|
||||
```
|
||||
|
||||
Or put the keys in a `.env` and source it (`cp .env.example .env`; edit; `set -a; . ./.env; set +a`).
|
||||
|
||||
**Provider → env var → endpoint** (all OpenAI-compatible):
|
||||
|
||||
| `--model` prefix | Env var | Base URL |
|
||||
|------------------|---------|----------|
|
||||
| `anthropic:` | `ANTHROPIC_API_KEY` | api.anthropic.com |
|
||||
| `openai:` | `OPENAI_API_KEY` | api.openai.com |
|
||||
| `gemini:` | `GEMINI_API_KEY` | generativelanguage.googleapis.com |
|
||||
| `xai:` | `XAI_API_KEY` | api.x.ai |
|
||||
| `nvidia_nim:` | `NVIDIA_NIM_API_KEY` | integrate.api.nvidia.com |
|
||||
| `deepseek:` | `DEEPSEEK_API_KEY` | api.deepseek.com |
|
||||
| `mistral:` | `MISTRAL_API_KEY` | api.mistral.ai |
|
||||
| `qwen:` | `DASHSCOPE_API_KEY` | dashscope-intl.aliyuncs.com |
|
||||
| `groq:` | `GROQ_API_KEY` | api.groq.com |
|
||||
| `together:` | `TOGETHER_API_KEY` | api.together.xyz |
|
||||
| `openrouter:` | `OPENROUTER_API_KEY` | openrouter.ai |
|
||||
| `ollama:` | _(none)_ | localhost:11434 |
|
||||
|
||||
Run `./target/release/neurosploit models` for the full provider/model list.
|
||||
|
||||
#### 2) Via subscription (no API key)
|
||||
|
||||
`--subscription` drives your local agentic-CLI login instead of an API key —
|
||||
install and log into one of the CLIs first:
|
||||
|
||||
| `--model` prefix | CLI used | Login |
|
||||
|------------------|----------|-------|
|
||||
| `anthropic:` | `claude` (Claude Code) | `claude` then `/login` |
|
||||
| `openai:` | `codex` | `codex` login |
|
||||
| `gemini:` | `gemini` | `gemini` login |
|
||||
| `xai:` | `grok` | `grok` login |
|
||||
|
||||
```bash
|
||||
./target/release/neurosploit run http://testphp.vulnweb.com/ \
|
||||
--subscription --model anthropic:claude-opus-4-8 --mcp -v
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## How it works
|
||||
|
||||
```
|
||||
┌──────────────────────────────────────────────────────────────┐
|
||||
URL ──▶ │ neurosploit (terminal) │
|
||||
│ │ │
|
||||
│ ▼ │
|
||||
│ orchestrator ── loads agents_md/ (213) ── applies RL weights │
|
||||
│ │ │
|
||||
│ ▼ composes ONE master prompt │
|
||||
│ backend (Claude Code | Codex | Grok) ◀── Playwright MCP │
|
||||
│ │ autonomously runs the pipeline below │
|
||||
│ ▼ │
|
||||
│ recon → select agents → exploit → VALIDATE → filter FPs │
|
||||
│ → severity → impact → report → RL feedback │
|
||||
└──────────────────────────────────────────────────────────────┘
|
||||
│ │
|
||||
▼ ▼
|
||||
results/findings.json data/rl_state.json (learns)
|
||||
target ─▶ recon (curl/nmap/…) ─▶ INTELLIGENT agent selection (recon-aware)
|
||||
─▶ parallel exploitation ─▶ cross-model validation vote
|
||||
─▶ severity/score ─▶ report (HTML + Typst PDF) ─▶ RL reward update
|
||||
```
|
||||
|
||||
The engine never fabricates findings: every candidate is independently
|
||||
re-exploited (`meta/exploit_validator`), run through an adversarial skeptic
|
||||
(`meta/false_positive_filter`), and only then scored and reported.
|
||||
Every run writes a self-contained folder `runs/ns-<ts>-<target>/`:
|
||||
|
||||
| File | Contents |
|
||||
|------|----------|
|
||||
| `status.json` | `running` → `complete` with a summary |
|
||||
| `recon.json` / `recon.md` | mapped attack surface |
|
||||
| `exploitation.md` | raw per-agent transcript |
|
||||
| `findings.json` / `findings.md` | validated findings (reuse by other tools/AIs) |
|
||||
| `report.html`, `report.typ`, `report.pdf` | final report (PDF via the Typst engine) |
|
||||
|
||||
A reinforcement-learning reward store (`data/rl_state_rs.json`) biases agent
|
||||
selection on future runs.
|
||||
|
||||
## Agent library — `agents_md/` (303)
|
||||
|
||||
| Category | Count | Purpose |
|
||||
|----------|-------|---------|
|
||||
| `vulns/` | 196 | Exploit a specific vulnerability class |
|
||||
| `recon/` | 12 | Information gathering / attack surface |
|
||||
| `code/` | 78 | White-box source-code (SAST) review |
|
||||
| `meta/` | 17 | Orchestrator, validator, scorers, reporter, RL |
|
||||
|
||||
Each agent is a self-contained markdown playbook (`## User Prompt` methodology +
|
||||
`## System Prompt` strict anti-false-positive rules). Drop a new `.md` into the
|
||||
matching folder and the harness picks it up.
|
||||
|
||||
---
|
||||
|
||||
## The agent library (`agents_md/`)
|
||||
## Safety
|
||||
|
||||
**213 agents** — see [`agents_md/REGISTRY.md`](agents_md/REGISTRY.md).
|
||||
For **authorized** testing only. Agents are instructed to stay in scope, never run
|
||||
destructive/DoS actions, and require proof-of-exploitation. You are responsible for
|
||||
having permission for any target.
|
||||
|
||||
- **196 vulnerability specialists** (`agents_md/vulns/`) — each a self-contained
|
||||
playbook with a real methodology, payloads, CWE mapping, and a strict
|
||||
anti-false-positive `## System Prompt`. Coverage includes the classic OWASP
|
||||
web set **plus modern classes**:
|
||||
- **LLM/AI security** (OWASP LLM Top 10): prompt injection (direct/indirect),
|
||||
jailbreak, system-prompt leak, insecure output handling, RAG poisoning,
|
||||
tool-invocation/function-calling abuse, excessive agency, PII leakage…
|
||||
- **Cloud/K8s/containers**: IMDS SSRF (AWS/GCP/Azure), kubelet/dashboard
|
||||
exposure, container & docker-socket escape, bucket takeover, IAM privesc…
|
||||
- **Modern API/auth**: JWT alg/kid/jwk confusion, OAuth PKCE downgrade, SAML
|
||||
XSW, OIDC, CSWSH, refresh-token & MFA bypass, account-takeover chains…
|
||||
- **Advanced injection**: SSTI (Jinja2/FreeMarker/Velocity/Thymeleaf), SSPP,
|
||||
XXE OOB, YAML/pickle deserialization, JNDI, XSLT…
|
||||
- **Protocol/cache/smuggling**: HTTP/2 & CL.TE/TE.CL desync, h2c, web cache
|
||||
deception/poisoning, response splitting, path-confusion…
|
||||
- **Logic/crypto/supply-chain**: dependency confusion, padding oracle, weak
|
||||
JWT secret, price/coupon/workflow abuse, exposed `.git`/`.env`/CI secrets…
|
||||
## Credits
|
||||
|
||||
- **17 meta-agents** (`agents_md/meta/`): `orchestrator`, `recon`,
|
||||
`exploit_validator`, `false_positive_filter`, `severity_assessor`,
|
||||
`impact_evaluator`, `reporter`, `rl_feedback`, plus migrated expert roles.
|
||||
|
||||
Add your own by dropping a `.md` into `agents_md/vulns/` (or extend the
|
||||
data-driven builder, `scripts/build_agents.py`). It is picked up automatically.
|
||||
|
||||
---
|
||||
|
||||
## Quickstart
|
||||
|
||||
```bash
|
||||
# 1. Have at least one agentic CLI installed: Claude Code, Codex, or Grok CLI
|
||||
# (Playwright MCP needs Node/npx)
|
||||
./neurosploit backends # show what's detected
|
||||
./neurosploit agents # {'vulns': 196, 'meta': 17, 'total': 213}
|
||||
|
||||
# 2. Interactive: enter a URL, pick a backend + model, go
|
||||
./neurosploit
|
||||
|
||||
# 3. Or one-shot:
|
||||
./neurosploit run https://target.example \
|
||||
--backend claude --model claude-opus-4-8 \
|
||||
--collaborator oob.your-collab.net
|
||||
|
||||
# 4. Preview the composed master prompt without executing the backend:
|
||||
./neurosploit run https://target.example --dry-run
|
||||
```
|
||||
|
||||
Outputs land in `results/<target>/findings.json` and `reports/`, and the RL
|
||||
state updates in `data/rl_state.json`.
|
||||
|
||||
### Web dashboard
|
||||
|
||||
A zero-dependency (Python stdlib only) dashboard — no npm, no build step:
|
||||
|
||||
```bash
|
||||
python3 webgui/server.py # → http://127.0.0.1:8787
|
||||
```
|
||||
|
||||
Tabs:
|
||||
- **Run** — multi-target input, backend + provider + model pickers (40 models
|
||||
across CLI and API providers), verbosity, RL/MCP toggles, a live execution
|
||||
console (shows the exact backend command and per-task activity), and findings
|
||||
with screenshots.
|
||||
- **Agents** — browse all 213 agents and **add new `.md` agents** from the UI;
|
||||
the main orchestrator picks them up on the next run.
|
||||
- **Insights** — interactive chart of RL agent weights + findings by severity.
|
||||
- **Reports** — download/preview the **PDF + HTML** reports (Typst engine).
|
||||
- **Settings · API** — execution mode (CLI vs API), per-provider API keys,
|
||||
orchestrator selection, default verbosity.
|
||||
|
||||
It calls `neurosploit_agent` directly. The previous React app and FastAPI backend
|
||||
were retired to `legacy/` (`frontend_react/`, `backend_fastapi/`).
|
||||
|
||||
### Backends
|
||||
|
||||
| Backend | Binary | Autonomy flag | Subscription |
|
||||
|---------|--------|---------------|--------------|
|
||||
| Claude Code | `claude` | `--dangerously-skip-permissions` | ✅ via Claude login |
|
||||
| Codex CLI | `codex` | `--dangerously-bypass-approvals-and-sandbox` | — |
|
||||
| Grok CLI | `grok` | `--yolo` | — |
|
||||
|
||||
The engine auto-detects installed backends and only offers those. In the
|
||||
interactive flow, answering **yes** to "Use Claude subscription" runs Claude Code
|
||||
against your logged-in subscription instead of an API key.
|
||||
|
||||
### Models
|
||||
|
||||
Latest models per provider live in `neurosploit_agent/models.py`, including the
|
||||
**NVIDIA NIM** provider (PR #28, OpenAI-compatible at
|
||||
`https://integrate.api.nvidia.com/v1`, `nvapi-` keys), Anthropic Claude 4.x,
|
||||
OpenAI, xAI Grok, Gemini, OpenRouter, and local Ollama.
|
||||
|
||||
---
|
||||
|
||||
## Reinforcement learning
|
||||
|
||||
Every run produces per-agent reward signals (`meta/rl_feedback` +
|
||||
`neurosploit_agent/rl.py`): validated findings reward an agent (weighted by
|
||||
severity), rejected false positives penalize it, correct skips stay neutral.
|
||||
Weights are bounded `[0.05, 1.0]` and carry per-tech-stack affinity, so the
|
||||
engine learns, e.g., to prioritize `ssti_jinja2` on Flask targets. State is
|
||||
explainable and persisted to `data/rl_state.json`.
|
||||
|
||||
---
|
||||
|
||||
## Safety & authorization
|
||||
|
||||
NeuroSploit is for **authorized** security testing only. Every agent's system
|
||||
prompt enforces scope and proof-of-exploitation; DoS-class agents refuse to
|
||||
flood and require explicit rules-of-engagement. You are responsible for having
|
||||
written permission for any target you point it at.
|
||||
|
||||
---
|
||||
|
||||
## Repository layout
|
||||
|
||||
```
|
||||
neurosploit # launcher (./neurosploit)
|
||||
neurosploit_agent/ # the v3.3.0 engine
|
||||
cli.py orchestrator.py agent_loader.py backends.py rl.py mcp.py models.py config.py
|
||||
agents_md/
|
||||
vulns/ (196) # vulnerability specialist agents
|
||||
meta/ (17) # orchestrator, recon, validator, scorers, reporter, RL, roles
|
||||
REGISTRY.md # generated index
|
||||
scripts/build_agents.py # data-driven agent builder
|
||||
legacy/ # retired pre-v3.3.0 Python orchestration
|
||||
```
|
||||
|
||||
See [`RELEASE.md`](RELEASE.md) for the full v3.3.0 changelog.
|
||||
|
||||
---
|
||||
**Joas A Santos** & **Red Team Leaders**.
|
||||
|
||||
## License
|
||||
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
HTTP/1.1 404 Not Found
|
||||
Content-Type: text/html
|
||||
Server: Microsoft-IIS/8.5
|
||||
X-Powered-By: ASP.NET
|
||||
Date: Tue, 23 Jun 2026 21:13:25 GMT
|
||||
Content-Length: 1245
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
|
||||
<title>404 - File or directory not found.</title>
|
||||
<style type="text/css">
|
||||
<!--
|
||||
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
|
||||
fieldset{padding:0 15px 10px 15px;}
|
||||
h1{font-size:2.4em;margin:0;color:#FFF;}
|
||||
h2{font-size:1.7em;margin:0;color:#CC0000;}
|
||||
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
|
||||
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
|
||||
background-color:#555555;}
|
||||
#content{margin:0 0 0 2%;position:relative;}
|
||||
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
|
||||
-->
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div id="header"><h1>Server Error</h1></div>
|
||||
<div id="content">
|
||||
<div class="content-container"><fieldset>
|
||||
<h2>404 - File or directory not found.</h2>
|
||||
<h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
|
||||
</fieldset></div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Committed-Secret Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for secrets committed to the repository in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Keys/tokens/passwords in source, configs, .env, history
|
||||
- High-entropy literals on credential-named vars
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Committed-Secret Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-540
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Credential compromise
|
||||
- Remediation: Remove and rotate; use a vault; scan in CI
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in secrets committed to the repository. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source CORS-with-Credentials Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for permissive CORS with credentials in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Reflecting Origin + `Access-Control-Allow-Credentials: true`
|
||||
- Wildcard origin with cookies
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source CORS-with-Credentials Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-942
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Cross-origin data theft
|
||||
- Remediation: Strict origin allowlist; never reflect with creds
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in permissive CORS with credentials. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source CSRF-Disabled Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for CSRF protection disabled in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `@csrf_exempt`, `csrf: false`, protection globally off
|
||||
- State-changing routes without tokens
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source CSRF-Disabled Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-352
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Unauthorized state-changing actions
|
||||
- Remediation: Enable anti-CSRF tokens / SameSite
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in CSRF protection disabled. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Debug-Mode Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for debug mode enabled in production in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `DEBUG=True`, `app.debug=True`, verbose error pages
|
||||
- Stack traces / interactive debuggers exposed
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Debug-Mode Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-489
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Info disclosure, possible RCE (e.g. Werkzeug console)
|
||||
- Remediation: Disable debug in production; generic errors
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in debug mode enabled in production. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source DOM XSS Sink Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for client-side DOM XSS in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `innerHTML`, `document.write`, `eval`, `location` from user-controlled `location`/`postMessage`
|
||||
- jQuery `.html()` with tainted data
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source DOM XSS Sink Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-79
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Client-side code execution
|
||||
- Remediation: Use textContent/safe APIs; sanitize; CSP
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in client-side DOM XSS. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source .NET Deserialization Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for unsafe .NET deserialization in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `BinaryFormatter`/`LosFormatter`/`NetDataContractSerializer` on input
|
||||
- TypeNameHandling.All in JSON.NET
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source .NET Deserialization Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-502
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Avoid insecure formatters; restrict types
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in unsafe .NET deserialization. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source .NET SQLi Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for SQL injection in ADO.NET/EF in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- String-concatenated `SqlCommand`/`FromSqlRaw`
|
||||
- Interpolated SQL with request data
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source .NET SQLi Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-89
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Database compromise
|
||||
- Remediation: Use parameters / FromSqlInterpolated
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in SQL injection in ADO.NET/EF. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source JS eval/Function Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for dynamic code execution in JS in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `eval`, `new Function`, `setTimeout(string)` on user input
|
||||
- Dynamic `require`/`import` of user names
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source JS eval/Function Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-95
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: RCE / arbitrary JS execution
|
||||
- Remediation: Remove dynamic eval; use safe dispatch
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in dynamic code execution in JS. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Insecure File Permissions Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for insecure file/dir permissions in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `chmod 0777`, world-writable paths, umask 0
|
||||
- Secrets written with broad permissions
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Insecure File Permissions Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-732
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Local tampering/disclosure
|
||||
- Remediation: Least-privilege permissions; restrict secrets
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in insecure file/dir permissions. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Go Command-Exec Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Go command injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `exec.Command("sh","-c", userInput)`
|
||||
- Shell strings built from request data
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Go Command-Exec Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-78
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Pass arg slices; avoid shell
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Go command injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Go SSRF Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Go server-side request forgery in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `http.Get`/`http.NewRequest` with user URL
|
||||
- No host allowlist; follows redirects
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Go SSRF Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-918
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Internal access, metadata theft
|
||||
- Remediation: Allowlist hosts; block internal ranges
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Go server-side request forgery. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source GraphQL Complexity Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for missing GraphQL depth/complexity limits in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- No depth/complexity/cost limit on resolvers
|
||||
- Introspection + nested queries unrestricted
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source GraphQL Complexity Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-770
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: DoS via expensive queries
|
||||
- Remediation: Add depth/cost limits; disable prod introspection
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in missing GraphQL depth/complexity limits. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source GraphQL Introspection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for introspection enabled in production in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Introspection not disabled in prod config
|
||||
- Schema fully exposed to clients
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source GraphQL Introspection Reviewer at [file:line]
|
||||
- Severity: Low
|
||||
- CWE: CWE-200
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Schema disclosure aiding attacks
|
||||
- Remediation: Disable introspection in production
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in introspection enabled in production. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Hardcoded Crypto Key Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for hardcoded cryptographic keys/IVs in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Symmetric keys / IVs / salts as string literals
|
||||
- Keys committed in config/source
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Hardcoded Crypto Key Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-321
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Decryption/forgery of protected data
|
||||
- Remediation: Load keys from a secrets manager; rotate
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in hardcoded cryptographic keys/IVs. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source HTTP Header Injection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for response header/CRLF injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User input written to response headers without stripping CR/LF
|
||||
- Set-Cookie/Location built from input
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source HTTP Header Injection Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-113
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Response splitting, cache poisoning
|
||||
- Remediation: Strip CR/LF; use safe header APIs
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in response header/CRLF injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source IDOR Ownership Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for missing object ownership checks in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- DB lookup by `req.id` without scoping to current user
|
||||
- No tenant/owner filter on fetch/update
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source IDOR Ownership Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-639
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Cross-account data access
|
||||
- Remediation: Enforce per-object ownership in queries
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in missing object ownership checks. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Insecure Cookie Flags Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for missing cookie security flags in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Cookies set without Secure/HttpOnly/SameSite
|
||||
- Session cookies readable by JS
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Insecure Cookie Flags Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-614
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Session theft via XSS/MITM
|
||||
- Remediation: Set Secure, HttpOnly, SameSite on sensitive cookies
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in missing cookie security flags. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Insecure Token Randomness Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for predictable security tokens in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `Math.random`/`rand`/`random` for tokens, OTPs, session ids
|
||||
- Time-seeded RNG for secrets
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Insecure Token Randomness Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-330
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Token/session prediction
|
||||
- Remediation: Use a CSPRNG (secrets, crypto.randomBytes)
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in predictable security tokens. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source TLS Verification Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for disabled TLS certificate verification in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `verify=False`, `rejectUnauthorized:false`, `InsecureSkipVerify:true`
|
||||
- Custom trust-all cert handlers
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source TLS Verification Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-295
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: MITM, credential interception
|
||||
- Remediation: Verify certificates; pin where appropriate
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in disabled TLS certificate verification. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Java Deserialization Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for unsafe Java deserialization in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `ObjectInputStream.readObject` on untrusted data
|
||||
- Gadget-prone libraries on the classpath
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Java Deserialization Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-502
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Avoid native deserialization; allowlist classes
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in unsafe Java deserialization. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source JWT alg=none Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for JWT 'none'/unverified algorithm acceptance in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `algorithms` not pinned; `verify=False`; accepting `none`
|
||||
- decode without signature verification
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source JWT alg=none Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-347
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Token forgery, auth bypass
|
||||
- Remediation: Pin algorithm allowlist; always verify signature
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in JWT 'none'/unverified algorithm acceptance. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source LDAP Injection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for LDAP injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User input concatenated into LDAP filters `(uid=...)`
|
||||
- No escaping of `*()\` in filter components
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source LDAP Injection Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-90
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Auth bypass, directory disclosure
|
||||
- Remediation: Escape LDAP metacharacters; use safe filter builders
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in LDAP injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Rails Mass-Assignment Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for mass assignment / strong-params bypass in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `permit!`, `params.permit(...)` missing, `update(params[:x])`
|
||||
- Binding whole params to models
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Rails Mass-Assignment Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-915
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Privilege escalation via hidden attributes
|
||||
- Remediation: Strong parameters allowlist; explicit fields
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in mass assignment / strong-params bypass. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Function-Level Authorization Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for missing function-level authorization in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Sensitive routes/handlers lacking auth/role checks
|
||||
- Admin actions reachable without verification
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Function-Level Authorization Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-862
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Privilege escalation
|
||||
- Remediation: Enforce server-side authorization on every sensitive action
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in missing function-level authorization. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Missing Rate-Limit Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for absent rate limiting on sensitive endpoints in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Login/OTP/reset endpoints without throttling
|
||||
- No lockout/backoff on auth attempts
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Missing Rate-Limit Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-307
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Brute force, credential stuffing
|
||||
- Remediation: Add per-identity rate limits + lockout
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in absent rate limiting on sensitive endpoints. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Node child_process Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Node.js command injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `child_process.exec`/`execSync` with user input
|
||||
- Template/concatenated shell commands
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Node child_process Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-78
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Use execFile/spawn with arg arrays
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Node.js command injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Node Path-Traversal Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Node.js path traversal in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `fs.readFile(path.join(base, req.param))` without normalize
|
||||
- `res.sendFile` with user path
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Node Path-Traversal Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-22
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Arbitrary file read
|
||||
- Remediation: Resolve+confine to base; reject `..`
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Node.js path traversal. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source NoSQL Injection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for NoSQL injection (Mongo/etc.) in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User input in query objects: `{$where: ...}`, `$gt`/`$ne` operators from request
|
||||
- find/aggregate built from req body without casting
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source NoSQL Injection Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-943
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Auth bypass, data exfiltration
|
||||
- Remediation: Cast/validate types; use parameterized query builders
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in NoSQL injection (Mongo/etc.). Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Open Redirect Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for open redirect in code in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `redirect(request.param)` without allowlist
|
||||
- `res.redirect(req.query.url)`
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Open Redirect Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-601
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Phishing, OAuth token theft
|
||||
- Remediation: Allowlist destinations; relative paths only
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in open redirect in code. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source ORM Raw-Query Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for unsafe raw ORM queries in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Django `.raw()`/`.extra()`, SQLAlchemy `text()` with interpolation
|
||||
- Knex/Sequelize raw with template strings
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source ORM Raw-Query Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-89
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: SQL injection via ORM
|
||||
- Remediation: Bind parameters even in raw queries
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in unsafe raw ORM queries. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source PHP assert/eval Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for PHP code injection via assert/eval/preg_replace-e in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `eval`, `assert`, `preg_replace('/e')`, `create_function` on input
|
||||
- Dynamic callbacks from request data
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source PHP assert/eval Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-95
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Remove dynamic eval; static dispatch
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in PHP code injection via assert/eval/preg_replace-e. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source PHP File-Inclusion Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for PHP LFI/RFI via include in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `include`/`require` with user input
|
||||
- `allow_url_include`; unfiltered path params
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source PHP File-Inclusion Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-98
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: LFI/RFI to RCE
|
||||
- Remediation: Allowlist includable files; disable url include
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in PHP LFI/RFI via include. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source PHP Type-Juggling Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for loose-comparison auth flaws in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `==` comparing secrets/hashes (`0e...` magic hashes)
|
||||
- strcmp misuse returning null
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source PHP Type-Juggling Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-697
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Authentication bypass
|
||||
- Remediation: Use strict `===` / hash_equals
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in loose-comparison auth flaws. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source PHP Unserialize Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for PHP object injection via unserialize in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `unserialize($_GET/_POST/cookie)`
|
||||
- Magic methods (__wakeup/__destruct) gadgets present
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source PHP Unserialize Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-502
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Object injection to RCE
|
||||
- Remediation: Use json_decode; allowed_classes=false
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in PHP object injection via unserialize. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Prototype Pollution Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for JS prototype pollution in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Recursive merge/clone of user JSON into objects
|
||||
- Keys `__proto__`/`constructor`/`prototype` not filtered
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Prototype Pollution Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-1321
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: RCE/DoS/logic bypass via gadgets
|
||||
- Remediation: Use null-proto objects; block dangerous keys; Object.freeze
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in JS prototype pollution. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Flask Debug/SSTI Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Flask debug console / render_template_string in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `app.run(debug=True)` in prod; Werkzeug PIN reachable
|
||||
- `render_template_string(user)`
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Flask Debug/SSTI Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-94
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: RCE via debugger/SSTI
|
||||
- Remediation: Disable debug; never template user input
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Flask debug console / render_template_string. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Python Pickle Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Python pickle deserialization in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `pickle.loads`/`cPickle` on untrusted data
|
||||
- Pickled cookies/params/files
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Python Pickle Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-502
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Avoid pickle on untrusted data; sign/JSON
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Python pickle deserialization. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Python subprocess(shell) Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for Python command injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `subprocess(..., shell=True)`, `os.system`, `os.popen` with input
|
||||
- Shell string concatenation
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Python subprocess(shell) Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-78
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Use arg lists; shell=False; validate
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in Python command injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Python YAML Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for unsafe yaml.load in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `yaml.load(data)` without SafeLoader
|
||||
- Loading untrusted YAML with full loader
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Python YAML Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-502
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Use yaml.safe_load
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in unsafe yaml.load. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source React dangerouslySetInnerHTML Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for DOM XSS via dangerouslySetInnerHTML in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `dangerouslySetInnerHTML={{__html: userInput}}`
|
||||
- Unsanitized HTML rendered in React
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source React dangerouslySetInnerHTML Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-79
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Stored/reflected XSS
|
||||
- Remediation: Sanitize with DOMPurify or avoid raw HTML
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in DOM XSS via dangerouslySetInnerHTML. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source ReDoS Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for catastrophic-backtracking regex in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Nested quantifiers `(a+)+`, `(.*)*` on user input
|
||||
- Regex validating untrusted strings
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source ReDoS Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-1333
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: CPU exhaustion / DoS
|
||||
- Remediation: Use linear-time engines (RE2); bound input
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in catastrophic-backtracking regex. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Session Fixation Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for session fixation in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Session id not regenerated after login
|
||||
- Accepting session id from URL/param
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Session Fixation Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-384
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Account hijacking
|
||||
- Remediation: Regenerate session on auth state change
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in session fixation. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Spring EL Injection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for SpEL expression injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User input into `SpelExpressionParser.parseExpression`
|
||||
- `@Value`/`#{}` evaluated on tainted data
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Spring EL Injection Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-917
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Never evaluate user input as SpEL
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in SpEL expression injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source SQL Format-String Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for SQL injection via format strings in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `cursor.execute(f"...{x}...")`, `% `/`.format()`/`+` into SQL
|
||||
- Template-built queries with request data
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source SQL Format-String Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-89
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Database compromise
|
||||
- Remediation: Use parameter binding / placeholders
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in SQL injection via format strings. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Webhook SSRF Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for SSRF via user-defined webhooks/callbacks in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User-provided webhook/callback URLs fetched server-side
|
||||
- No allowlist; internal ranges reachable
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Webhook SSRF Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-918
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Internal network access, metadata theft
|
||||
- Remediation: Allowlist + block internal ranges; no redirects
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in SSRF via user-defined webhooks/callbacks. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Server-Side Template Injection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for SSTI in server templates in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User input concatenated into template source then rendered
|
||||
- Jinja/Twig/Freemarker/Velocity dynamic templates
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Server-Side Template Injection Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-1336
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Never render user input as templates; sandbox
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in SSTI in server templates. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source TOCTOU/Race Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for time-of-check/time-of-use & race conditions in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Check-then-act on files/balances without locking
|
||||
- Non-atomic read-modify-write on shared state
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source TOCTOU/Race Reviewer at [file:line]
|
||||
- Severity: Medium
|
||||
- CWE: CWE-367
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Privilege/state corruption, double-spend
|
||||
- Remediation: Atomic ops/locks/transactions
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in time-of-check/time-of-use & race conditions. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Upload Content-Type Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for insecure file-upload validation in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Trusting client Content-Type/extension only
|
||||
- Executable upload dirs; user-controlled names
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Upload Content-Type Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-434
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Webshell upload, RCE
|
||||
- Remediation: Validate magic bytes; random names; non-exec storage
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in insecure file-upload validation. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Weak JWT Secret Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for weak/guessable JWT signing secret in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Short/dictionary HS256 secret in source/config
|
||||
- Default 'secret'/'changeme' keys
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Weak JWT Secret Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-326
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Token forgery
|
||||
- Remediation: Use long random secrets / RS256; rotate
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in weak/guessable JWT signing secret. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Weak Password Hashing Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for weak password hashing in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- MD5/SHA1/SHA256 (unsalted) used for passwords
|
||||
- No bcrypt/argon2/scrypt; no per-user salt
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Weak Password Hashing Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-916
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Mass credential cracking on breach
|
||||
- Remediation: Use bcrypt/argon2id with salt
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in weak password hashing. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source XPath Injection Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for XPath injection in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- User input concatenated into XPath expressions
|
||||
- `selectNodes`/`evaluate` with string interpolation
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source XPath Injection Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-643
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Auth bypass, XML data extraction
|
||||
- Remediation: Parameterize XPath; validate input
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in XPath injection. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source XStream Deserialization Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for unsafe XStream/XML deserialization in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `XStream.fromXML` on untrusted XML without allowlist
|
||||
- Default permissive type permissions
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source XStream Deserialization Reviewer at [file:line]
|
||||
- Severity: Critical
|
||||
- CWE: CWE-502
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Remote code execution
|
||||
- Remediation: Configure strict type permissions/allowlist
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in unsafe XStream/XML deserialization. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source XXE (parser config) Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for XXE via permissive XML parser config in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- `resolve_entities=True`, `no_network=False`, DTD loading enabled
|
||||
- Default-config XML parsers on untrusted input
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source XXE (parser config) Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-611
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: File disclosure, SSRF
|
||||
- Remediation: Disable DTD/external entities; harden parser
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in XXE via permissive XML parser config. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -0,0 +1,42 @@
|
||||
# Source Zip Slip Reviewer Agent
|
||||
|
||||
## User Prompt
|
||||
You are reviewing the source code of **{target}** for path traversal during archive extraction in the source code.
|
||||
|
||||
**Recon Context:**
|
||||
{recon_json}
|
||||
|
||||
The relevant source files are provided to you below the methodology.
|
||||
|
||||
**METHODOLOGY:**
|
||||
|
||||
### 1. Locate sources & sinks
|
||||
- Extracting archive entry names without normalization
|
||||
- `os.path.join(dest, entry.name)` with `../`
|
||||
|
||||
### 2. Trace dataflow
|
||||
- Trace untrusted input from its source to the dangerous sink
|
||||
- Confirm the path is reachable and lacks effective sanitization/validation
|
||||
- Use grep/ripgrep across the provided files to find every call site
|
||||
|
||||
### 3. Confirm exploitability
|
||||
- Quote the exact vulnerable lines (file:line)
|
||||
- Give a concrete exploit/PoC and explain why existing controls fail
|
||||
|
||||
### 4. Report Format
|
||||
For each CONFIRMED finding:
|
||||
```
|
||||
FINDING:
|
||||
- Title: Source Zip Slip Reviewer at [file:line]
|
||||
- Severity: High
|
||||
- CWE: CWE-22
|
||||
- Endpoint: [file:line]
|
||||
- Vector: [tainted source → sink]
|
||||
- Payload: [PoC / vulnerable code snippet]
|
||||
- Evidence: [exact code quoted]
|
||||
- Impact: Arbitrary file write, RCE
|
||||
- Remediation: Canonicalize and confine extracted paths
|
||||
```
|
||||
|
||||
## System Prompt
|
||||
You are a white-box source reviewer specialized in path traversal during archive extraction. Report ONLY issues you can prove in the PROVIDED code by quoting exact vulnerable lines (file:line) with a reachable dataflow from untrusted input. Reject sanitized, unreachable, dead, or hypothetical code. If the snippet is insufficient to confirm, say so instead of guessing. Credits: Joas A Santos and Red Team Leaders.
|
||||
@@ -1,5 +0,0 @@
|
||||
# Netscape HTTP Cookie File
|
||||
# https://curl.se/docs/http-cookies.html
|
||||
# This file was generated by libcurl! Edit at your own risk.
|
||||
|
||||
#HttpOnly_testaspnet.vulnweb.com FALSE / FALSE 0 ASP.NET_SessionId 1mkryz45pc3j44ua53yfe545
|
||||
@@ -1,5 +0,0 @@
|
||||
# Netscape HTTP Cookie File
|
||||
# https://curl.se/docs/http-cookies.html
|
||||
# This file was generated by libcurl! Edit at your own risk.
|
||||
|
||||
#HttpOnly_testaspnet.vulnweb.com FALSE / FALSE 0 ASP.NET_SessionId okc513jjz1kxsxbmkmidnmfs
|
||||
@@ -1,5 +0,0 @@
|
||||
# Netscape HTTP Cookie File
|
||||
# https://curl.se/docs/http-cookies.html
|
||||
# This file was generated by libcurl! Edit at your own risk.
|
||||
|
||||
#HttpOnly_testaspnet.vulnweb.com FALSE / FALSE 0 ASP.NET_SessionId r2w133jnjihmgf552tyes4uh
|
||||
@@ -1,122 +0,0 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.<br><br>http://go.microsoft.com/fwlink/?LinkID=314055</title>
|
||||
<style>
|
||||
body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;}
|
||||
p {font-family:"Verdana";font-weight:normal;color:black;margin-top: -5px}
|
||||
b {font-family:"Verdana";font-weight:bold;color:black;margin-top: -5px}
|
||||
H1 { font-family:"Verdana";font-weight:normal;font-size:18pt;color:red }
|
||||
H2 { font-family:"Verdana";font-weight:normal;font-size:14pt;color:maroon }
|
||||
pre {font-family:"Lucida Console";font-size: .9em}
|
||||
.marker {font-weight: bold; color: black;text-decoration: none;}
|
||||
.version {color: gray;}
|
||||
.error {margin-bottom: 10px;}
|
||||
.expandable { text-decoration:underline; font-weight:bold; color:navy; cursor:hand; }
|
||||
</style>
|
||||
</head>
|
||||
|
||||
<body bgcolor="white">
|
||||
|
||||
<span><H1>Server Error in '/' Application.<hr width=100% size=1 color=silver></H1>
|
||||
|
||||
<h2> <i>Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.<br><br>http://go.microsoft.com/fwlink/?LinkID=314055</i> </h2></span>
|
||||
|
||||
<font face="Arial, Helvetica, Geneva, SunSans-Regular, sans-serif ">
|
||||
|
||||
<b> Description: </b>An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
|
||||
|
||||
<br><br>
|
||||
|
||||
<b> Exception Details: </b>System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.<br><br>http://go.microsoft.com/fwlink/?LinkID=314055<br><br>
|
||||
|
||||
<b>Source Error:</b> <br><br>
|
||||
|
||||
<table width=100% bgcolor="#ffffcc">
|
||||
<tr>
|
||||
<td>
|
||||
<code><pre>
|
||||
|
||||
[No relevant source lines]</pre></code>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<br>
|
||||
|
||||
<b> Source File: </b> c:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\e6eb278b\4a52d72d\App_Web_pebpzm2g.0.cs<b> Line: </b> 0
|
||||
<br><br>
|
||||
|
||||
<b>Stack Trace:</b> <br><br>
|
||||
|
||||
<table width=100% bgcolor="#ffffcc">
|
||||
<tr>
|
||||
<td>
|
||||
<code><pre>
|
||||
|
||||
[ViewStateException: Invalid viewstate.
|
||||
Client IP: 177.62.32.16
|
||||
Port: 56298
|
||||
User-Agent: Mozilla/5.0
|
||||
ViewState: /wEPDwUKLTg2MjcwMzE2Mg9kFgICAQ9kFgICAQ9kFgQCAQ8WBB4EaHJlZgUKbG9naW4uYXNweB4JaW5uZXJodG1sBQVsb2dpbmQCAw8WBB8AZB4HVmlzaWJsZWhkAgMPFgIfAQVJcG9zdGVkIGJ5IDxzdHJvbmc+YWRtaW4gICAgICAgICAgICAgICAgICAgIDwvc3Ryb25nPjUvMTYvMjAxOSAxMjozMjozMCBQTWQCBQ8WBB8BBT5BY3VuZXRpeCBWdWxuZXJhYmlsaXR5IFNjYW5uZXIgTm93IFdpdGggTmV0d29yayBTZWN1cml0eSBTY2Fucx8ABRJSZWFkTmV3cy5hc3B4P2lkPTBkAgcPFgIfAQVEU2VhbWxlc3MgT3BlblZBUyBpbnRlZ3JhdGlvbiBub3cgYWxzbyBhdmFpbGFibGUgb24gV2luZG93cyBhbmQgTGludXhkAgkPZBYCAgEPZBYGZg9kFgJmDxYCHwEFJTxJTUcgc3JjPSJpbWFnZXMvY29tbWVudC1iZWZvcmUuZ2lmIj5kAgEPZBYCZg8WAh4FY2xhc3MFB0NvbW1lbnRkAgIPZBYCZg8WAh8BBSQ8SU1HIHNyYz0iaW1hZ2VzL2NvbW1lbnQtYWZ0ZXIuZ2lmIj5kZLtjZhxvUS4ci8HIFlqscBeWoXbu
|
||||
Referer:
|
||||
Path: /Comments.aspx]
|
||||
|
||||
[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
|
||||
|
||||
http://go.microsoft.com/fwlink/?LinkID=314055]
|
||||
System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +190
|
||||
System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +11093249
|
||||
System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +59
|
||||
System.Web.UI.HiddenFieldPageStatePersister.Load() +11093352
|
||||
System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +11178689
|
||||
System.Web.UI.Page.LoadAllState() +46
|
||||
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +11174087
|
||||
System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +11173626
|
||||
System.Web.UI.Page.ProcessRequest() +91
|
||||
System.Web.UI.Page.ProcessRequest(HttpContext context) +240
|
||||
ASP.comments_aspx.ProcessRequest(HttpContext context) in c:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\e6eb278b\4a52d72d\App_Web_pebpzm2g.0.cs:0
|
||||
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +599
|
||||
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +171
|
||||
</pre></code>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<br>
|
||||
|
||||
<hr width=100% size=1 color=silver>
|
||||
|
||||
<b>Version Information:</b> Microsoft .NET Framework Version:2.0.50727.8974; ASP.NET Version:2.0.50727.8974
|
||||
|
||||
</font>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
<!--
|
||||
[ViewStateException]: Invalid viewstate.
|
||||
Client IP: 177.62.32.16
|
||||
Port: 56298
|
||||
User-Agent: Mozilla/5.0
|
||||
ViewState: /wEPDwUKLTg2MjcwMzE2Mg9kFgICAQ9kFgICAQ9kFgQCAQ8WBB4EaHJlZgUKbG9naW4uYXNweB4JaW5uZXJodG1sBQVsb2dpbmQCAw8WBB8AZB4HVmlzaWJsZWhkAgMPFgIfAQVJcG9zdGVkIGJ5IDxzdHJvbmc+YWRtaW4gICAgICAgICAgICAgICAgICAgIDwvc3Ryb25nPjUvMTYvMjAxOSAxMjozMjozMCBQTWQCBQ8WBB8BBT5BY3VuZXRpeCBWdWxuZXJhYmlsaXR5IFNjYW5uZXIgTm93IFdpdGggTmV0d29yayBTZWN1cml0eSBTY2Fucx8ABRJSZWFkTmV3cy5hc3B4P2lkPTBkAgcPFgIfAQVEU2VhbWxlc3MgT3BlblZBUyBpbnRlZ3JhdGlvbiBub3cgYWxzbyBhdmFpbGFibGUgb24gV2luZG93cyBhbmQgTGludXhkAgkPZBYCAgEPZBYGZg9kFgJmDxYCHwEFJTxJTUcgc3JjPSJpbWFnZXMvY29tbWVudC1iZWZvcmUuZ2lmIj5kAgEPZBYCZg8WAh4FY2xhc3MFB0NvbW1lbnRkAgIPZBYCZg8WAh8BBSQ8SU1HIHNyYz0iaW1hZ2VzL2NvbW1lbnQtYWZ0ZXIuZ2lmIj5kZLtjZhxvUS4ci8HIFlqscBeWoXbu
|
||||
Referer:
|
||||
Path: /Comments.aspx
|
||||
[HttpException]: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
|
||||
|
||||
http://go.microsoft.com/fwlink/?LinkID=314055
|
||||
at System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError)
|
||||
at System.Web.UI.ObjectStateFormatter.Deserialize(String inputString)
|
||||
at System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState)
|
||||
at System.Web.UI.HiddenFieldPageStatePersister.Load()
|
||||
at System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
|
||||
at System.Web.UI.Page.LoadAllState()
|
||||
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
|
||||
at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
|
||||
at System.Web.UI.Page.ProcessRequest()
|
||||
at System.Web.UI.Page.ProcessRequest(HttpContext context)
|
||||
at ASP.comments_aspx.ProcessRequest(HttpContext context) in c:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files\root\e6eb278b\4a52d72d\App_Web_pebpzm2g.0.cs:line 0
|
||||
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
|
||||
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
|
||||
--><!--
|
||||
This error page might contain sensitive information because ASP.NET is configured to show verbose error messages using <customErrors mode="Off"/>. Consider using <customErrors mode="On"/> or <customErrors mode="RemoteOnly"/> in production environments.-->
|
||||
File diff suppressed because one or more lines are too long
@@ -1,50 +0,0 @@
|
||||
{
|
||||
"llm": {
|
||||
"provider": "gemini",
|
||||
"model": "gemini-pro",
|
||||
"api_key": "",
|
||||
"temperature": 0.7,
|
||||
"max_tokens": 4096
|
||||
},
|
||||
"agents": {
|
||||
"recon": {
|
||||
"enabled": true,
|
||||
"priority": 1
|
||||
},
|
||||
"exploitation": {
|
||||
"enabled": true,
|
||||
"priority": 2
|
||||
},
|
||||
"privilege_escalation": {
|
||||
"enabled": true,
|
||||
"priority": 3
|
||||
},
|
||||
"persistence": {
|
||||
"enabled": true,
|
||||
"priority": 4
|
||||
},
|
||||
"lateral_movement": {
|
||||
"enabled": true,
|
||||
"priority": 5
|
||||
}
|
||||
},
|
||||
"methodologies": {
|
||||
"owasp_top10": true,
|
||||
"cwe_top25": true,
|
||||
"network_pentest": true,
|
||||
"ad_pentest": true,
|
||||
"web_security": true
|
||||
},
|
||||
"tools": {
|
||||
"nmap": "/usr/bin/nmap",
|
||||
"metasploit": "/usr/bin/msfconsole",
|
||||
"burpsuite": "/usr/bin/burpsuite",
|
||||
"sqlmap": "/usr/bin/sqlmap",
|
||||
"hydra": "/usr/bin/hydra"
|
||||
},
|
||||
"output": {
|
||||
"format": "json",
|
||||
"verbose": true,
|
||||
"save_artifacts": true
|
||||
}
|
||||
}
|
||||
@@ -1,114 +0,0 @@
|
||||
{
|
||||
"llm": {
|
||||
"default_profile": "gemini_pro_default",
|
||||
"profiles": {
|
||||
"gemini_pro_default": {
|
||||
"provider": "gemini",
|
||||
"model": "gemini-pro",
|
||||
"api_key": "${GEMINI_API_KEY}",
|
||||
"temperature": 0.7,
|
||||
"max_tokens": 4096,
|
||||
"input_token_limit": 30720,
|
||||
"output_token_limit": 2048,
|
||||
"cache_enabled": true,
|
||||
"search_context_level": "medium",
|
||||
"pdf_support_enabled": true,
|
||||
"guardrails_enabled": true,
|
||||
"hallucination_mitigation_strategy": "consistency_check"
|
||||
}
|
||||
}
|
||||
},
|
||||
"agent_roles": {
|
||||
"pentest_generalist": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"nmap",
|
||||
"metasploit",
|
||||
"burpsuite",
|
||||
"sqlmap",
|
||||
"hydra"
|
||||
],
|
||||
"description": "Performs comprehensive penetration tests across various domains.",
|
||||
"methodology": ["OWASP-WSTG", "PTES", "OWASP-Top10-2021"],
|
||||
"default_prompt": "auto_pentest",
|
||||
"vuln_coverage": 100,
|
||||
"ai_prompts": true
|
||||
},
|
||||
"bug_bounty_hunter": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"subfinder",
|
||||
"nuclei",
|
||||
"burpsuite",
|
||||
"sqlmap"
|
||||
],
|
||||
"description": "Focuses on web application vulnerabilities with 100 vuln types.",
|
||||
"methodology": ["OWASP-WSTG", "OWASP-Top10-2021"],
|
||||
"default_prompt": "auto_pentest",
|
||||
"vuln_coverage": 100,
|
||||
"ai_prompts": true
|
||||
}
|
||||
},
|
||||
"methodologies": {
|
||||
"owasp_top10": true,
|
||||
"cwe_top25": true,
|
||||
"network_pentest": true,
|
||||
"ad_pentest": true,
|
||||
"web_security": true
|
||||
},
|
||||
"tools": {
|
||||
"nmap": "/usr/bin/nmap",
|
||||
"metasploit": "/usr/bin/msfconsole",
|
||||
"burpsuite": "/usr/bin/burpsuite",
|
||||
"sqlmap": "/usr/bin/sqlmap",
|
||||
"hydra": "/usr/bin/hydra"
|
||||
},
|
||||
"mcp_servers": {
|
||||
"neurosploit_tools": {
|
||||
"transport": "stdio",
|
||||
"command": "python3",
|
||||
"args": ["-m", "core.mcp_server"],
|
||||
"description": "NeuroSploit pentest tools: screenshots, payload delivery, DNS, port scan, tech detect, subdomain enum, findings, AI prompts, Nuclei scanner, Naabu port scanner, sandbox execution"
|
||||
}
|
||||
},
|
||||
"sandbox": {
|
||||
"enabled": false,
|
||||
"mode": "per_scan",
|
||||
"image": "neurosploit-sandbox:latest",
|
||||
"container_name": "neurosploit-sandbox",
|
||||
"auto_start": false,
|
||||
"kali": {
|
||||
"enabled": true,
|
||||
"image": "neurosploit-kali:latest",
|
||||
"max_concurrent": 5,
|
||||
"container_ttl_minutes": 60,
|
||||
"auto_cleanup_orphans": true
|
||||
},
|
||||
"resources": {
|
||||
"memory_limit": "2g",
|
||||
"cpu_limit": 2.0
|
||||
},
|
||||
"tools": [
|
||||
"nuclei", "naabu", "nmap", "httpx", "subfinder", "katana",
|
||||
"dnsx", "ffuf", "gobuster", "dalfox", "nikto", "sqlmap",
|
||||
"whatweb", "curl", "dig", "whois", "masscan", "dirsearch",
|
||||
"wfuzz", "arjun", "wafw00f", "waybackurls"
|
||||
],
|
||||
"nuclei": {
|
||||
"rate_limit": 150,
|
||||
"timeout": 600,
|
||||
"severity_filter": "critical,high,medium",
|
||||
"auto_update_templates": true
|
||||
},
|
||||
"naabu": {
|
||||
"rate": 1000,
|
||||
"top_ports": 1000,
|
||||
"timeout": 300
|
||||
}
|
||||
},
|
||||
"output": {
|
||||
"format": "json",
|
||||
"verbose": true,
|
||||
"save_artifacts": true
|
||||
}
|
||||
}
|
||||
@@ -1,154 +0,0 @@
|
||||
{
|
||||
"llm": {
|
||||
"default_profile": "gemini_pro_default",
|
||||
"profiles": {
|
||||
"ollama_llama3_default": {
|
||||
"provider": "ollama",
|
||||
"model": "llama3:8b",
|
||||
"api_key": "",
|
||||
"temperature": 0.7,
|
||||
"max_tokens": 4096,
|
||||
"input_token_limit": 8000,
|
||||
"output_token_limit": 4000,
|
||||
"cache_enabled": true,
|
||||
"search_context_level": "medium",
|
||||
"pdf_support_enabled": false,
|
||||
"guardrails_enabled": true,
|
||||
"hallucination_mitigation_strategy": null
|
||||
},
|
||||
"gemini_pro_default": {
|
||||
"provider": "gemini",
|
||||
"model": "gemini-pro",
|
||||
"api_key": "${GEMINI_API_KEY}",
|
||||
"temperature": 0.7,
|
||||
"max_tokens": 4096,
|
||||
"input_token_limit": 30720,
|
||||
"output_token_limit": 2048,
|
||||
"cache_enabled": true,
|
||||
"search_context_level": "medium",
|
||||
"pdf_support_enabled": true,
|
||||
"guardrails_enabled": true,
|
||||
"hallucination_mitigation_strategy": "consistency_check"
|
||||
},
|
||||
"claude_opus_default": {
|
||||
"provider": "claude",
|
||||
"model": "claude-opus-4-6-20250918",
|
||||
"api_key": "${ANTHROPIC_API_KEY}",
|
||||
"temperature": 0.7,
|
||||
"max_tokens": 16384,
|
||||
"input_token_limit": 1000000,
|
||||
"output_token_limit": 16384,
|
||||
"cache_enabled": true,
|
||||
"search_context_level": "high",
|
||||
"pdf_support_enabled": true,
|
||||
"guardrails_enabled": true,
|
||||
"hallucination_mitigation_strategy": "self_reflection"
|
||||
},
|
||||
"gpt_4o_default": {
|
||||
"provider": "gpt",
|
||||
"model": "gpt-4o",
|
||||
"api_key": "${OPENAI_API_KEY}",
|
||||
"temperature": 0.7,
|
||||
"max_tokens": 4096,
|
||||
"input_token_limit": 128000,
|
||||
"output_token_limit": 4096,
|
||||
"cache_enabled": true,
|
||||
"search_context_level": "high",
|
||||
"pdf_support_enabled": true,
|
||||
"guardrails_enabled": true,
|
||||
"hallucination_mitigation_strategy": "consistency_check"
|
||||
}
|
||||
}
|
||||
},
|
||||
"agent_roles": {
|
||||
"bug_bounty_hunter": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"subfinder",
|
||||
"nuclei",
|
||||
"burpsuite",
|
||||
"sqlmap"
|
||||
],
|
||||
"description": "Focuses on web application vulnerabilities, leveraging recon and exploitation tools."
|
||||
},
|
||||
"blue_team_agent": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [],
|
||||
"description": "Analyzes logs and telemetry for threats, provides defensive strategies."
|
||||
},
|
||||
"exploit_expert": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"metasploit",
|
||||
"nmap"
|
||||
],
|
||||
"description": "Devises exploitation strategies and payloads for identified vulnerabilities."
|
||||
},
|
||||
"red_team_agent": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"nmap",
|
||||
"metasploit",
|
||||
"hydra"
|
||||
],
|
||||
"description": "Plans and executes simulated attacks to test an organization's defenses."
|
||||
},
|
||||
"replay_attack_specialist": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"burpsuite"
|
||||
],
|
||||
"description": "Identifies and leverages replay attack vectors in network traffic or authentication."
|
||||
},
|
||||
"pentest_generalist": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"nmap",
|
||||
"subfinder",
|
||||
"nuclei",
|
||||
"metasploit",
|
||||
"burpsuite",
|
||||
"sqlmap",
|
||||
"hydra"
|
||||
],
|
||||
"description": "Performs comprehensive penetration tests across various domains."
|
||||
},
|
||||
"owasp_expert": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [
|
||||
"burpsuite",
|
||||
"sqlmap"
|
||||
],
|
||||
"description": "Specializes in assessing web applications against OWASP Top 10 vulnerabilities."
|
||||
},
|
||||
"cwe_expert": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [],
|
||||
"description": "Analyzes code and reports for weaknesses based on MITRE CWE Top 25."
|
||||
},
|
||||
"malware_analyst": {
|
||||
"enabled": true,
|
||||
"tools_allowed": [],
|
||||
"description": "Examines malware samples to understand functionality and identify IOCs."
|
||||
}
|
||||
},
|
||||
"methodologies": {
|
||||
"owasp_top10": true,
|
||||
"cwe_top25": true,
|
||||
"network_pentest": true,
|
||||
"ad_pentest": true,
|
||||
"web_security": true
|
||||
},
|
||||
"tools": {
|
||||
"nmap": "/usr/bin/nmap",
|
||||
"metasploit": "/usr/bin/msfconsole",
|
||||
"burpsuite": "/usr/bin/burpsuite",
|
||||
"sqlmap": "/usr/bin/sqlmap",
|
||||
"hydra": "/usr/bin/hydra"
|
||||
},
|
||||
"output": {
|
||||
"format": "json",
|
||||
"verbose": true,
|
||||
"save_artifacts": true
|
||||
}
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
# Netscape HTTP Cookie File
|
||||
# https://curl.se/docs/http-cookies.html
|
||||
# This file was generated by libcurl! Edit at your own risk.
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
# Netscape HTTP Cookie File
|
||||
# https://curl.se/docs/http-cookies.html
|
||||
# This file was generated by libcurl! Edit at your own risk.
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
{
|
||||
"feedback": [
|
||||
{
|
||||
"vuln_id": "1b79cb50-2f1e-4ab2-a8bc-3de7b95f2fbc",
|
||||
"vuln_type": "unknown",
|
||||
"endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"param": "file",
|
||||
"payload_pattern": "",
|
||||
"is_true_positive": false,
|
||||
"explanation": "nao disparou alerta de XSS e parece ser mais um possivel Path Transversal aqui",
|
||||
"severity": "medium",
|
||||
"domain": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"timestamp": "2026-02-16T20:41:38.817732"
|
||||
},
|
||||
{
|
||||
"vuln_id": "836fd546-ee28-4869-a9fe-1c2cd37a3f41",
|
||||
"vuln_type": "unknown",
|
||||
"endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"param": "pp",
|
||||
"payload_pattern": "",
|
||||
"is_true_positive": false,
|
||||
"explanation": "Parece ser mais DOM XSS",
|
||||
"severity": "medium",
|
||||
"domain": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"timestamp": "2026-02-16T20:42:01.342162"
|
||||
}
|
||||
],
|
||||
"patterns": {
|
||||
"unknown": [
|
||||
{
|
||||
"endpoint_pattern": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"vuln_type": "unknown",
|
||||
"indicators": [
|
||||
"file"
|
||||
],
|
||||
"is_false_positive": true,
|
||||
"confidence": 0.5,
|
||||
"feedback_count": 1,
|
||||
"domain": "http://testphp.vulnweb.com/showimage.php?file=1&file=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"explanation_summary": "nao disparou alerta de XSS e parece ser mais um possivel Path Transversal aqui",
|
||||
"last_updated": "2026-02-16T20:41:38.817738"
|
||||
},
|
||||
{
|
||||
"endpoint_pattern": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"vuln_type": "unknown",
|
||||
"indicators": [
|
||||
"pp"
|
||||
],
|
||||
"is_false_positive": true,
|
||||
"confidence": 0.5,
|
||||
"feedback_count": 1,
|
||||
"domain": "http://testphp.vulnweb.com/hpp/?pp=12&pp=%3Cscript%3Ealert('XSS')%3C/script%3E",
|
||||
"explanation_summary": "Parece ser mais DOM XSS",
|
||||
"last_updated": "2026-02-16T20:42:01.342167"
|
||||
}
|
||||
]
|
||||
},
|
||||
"metadata": {
|
||||
"total_feedback": 2,
|
||||
"total_patterns": 2,
|
||||
"last_updated": "2026-02-16T20:42:01.342235"
|
||||
}
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{
|
||||
"documents": [
|
||||
{
|
||||
"id": "1c4cf70f-d4a",
|
||||
"filename": "pentest.md",
|
||||
"title": "Kali Linux Penetration Testing Fundamentals and Essential Tools",
|
||||
"source_type": "md",
|
||||
"uploaded_at": "2026-02-16T14:50:31.618020",
|
||||
"processed": true,
|
||||
"file_size_bytes": 20702,
|
||||
"summary": "This document provides an introduction to Kali Linux as a penetration testing platform and covers fundamental Linux concepts. It discusses the differences between vulnerability assessments and penetration tests, emphasizes legal considerations including written authorization requirements, and introduces netcat as an essential networking tool for security testing.",
|
||||
"vuln_types": [],
|
||||
"knowledge_entries": []
|
||||
}
|
||||
],
|
||||
"vuln_type_index": {
|
||||
"information_disclosure": [],
|
||||
"clickjacking": []
|
||||
},
|
||||
"version": "1.0",
|
||||
"updated_at": "2026-04-28T19:00:40.997968"
|
||||
}
|
||||
@@ -1,344 +0,0 @@
|
||||
|
||||
|
||||
----------
|
||||
Chapter 1: Introduction
|
||||
========
|
||||
About Kali Linux
|
||||
------------------------
|
||||
|
||||
> [Kali Linux](https://www.kali.org/) is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools which are geared towards various information security tasks, such as Penetration Testing, Security research, Computer Forensics and Reverse Engineering. Kali Linux is developed, funded and maintained by [Offensive Security](http://www.offensive-security.com/), a leading information security training company.
|
||||
|
||||
Kali Linux was released on the 13th March, 2013 as a complete, top-to-bottom rebuild of [BackTrack Linux](http://www.backtrack-linux.org/), adhering completely to Debian development standards.
|
||||
|
||||
Linux Basics
|
||||
---------------
|
||||
You should aware of some basics of Linux commands which will be used and come in handy and will be lot helpful. Here only basics are covered and more detail can be found at this [link](https://www.digitalocean.com/community/tutorials/an-introduction-to-linux-i-o-redirection)
|
||||
**Streams**
|
||||
Input and output in the Linux environment is distributed across three streams. These streams are:
|
||||
|
||||
standard input (stdin) # typically carries data from a user to a program
|
||||
standard output (stdout) # writes the data that is generated by a program
|
||||
standard error (stderr) # writes the errors generated by a program that has failed at some point in its execution
|
||||
The streams are also numbered:
|
||||
|
||||
stdin (0) # cat
|
||||
stdout (1) # echo
|
||||
stderr (2)
|
||||
**Stream Redirection**
|
||||
Linux includes redirection commands for each stream. These commands write standard output to a file. If a non-existent file is targetted (either by a single-bracket or double-bracket command), a new file with that name will be created prior to writing.
|
||||
|
||||
Commands with a single bracket overwrite the destination's existing contents.
|
||||
|
||||
Overwrite
|
||||
|
||||
> - standard output
|
||||
< - standard input
|
||||
2> - standard error
|
||||
|
||||
Commands with a double bracket do not overwrite the destination's existing contents.
|
||||
|
||||
Append
|
||||
|
||||
>> - standard output
|
||||
<< - standard input
|
||||
2>> - standard error
|
||||
**Pipes**
|
||||
Pipes (vertical bar `*|*`) are used to redirect a stream from one program to another. When a program's standard output is sent to another through a pipe, the first program's data, which is received by the second program, will not be displayed on the terminal. Only the filtered data returned by the second program will be displayed.
|
||||
**Filters**
|
||||
Filters are commands that alter piped redirection and output.
|
||||
>filter commands are also standard Linux commands that can be used without pipes.
|
||||
|
||||
* `find` - returns files with filenames that match the argument passed to find.
|
||||
* `grep` - returns text that matches the string pattern passed to grep.
|
||||
* `tee` - redirects standard input to both standard output and one or more files. (typically used to view a program's output while simultaneously saving it to a file.)
|
||||
* `tr` - finds-and-replaces one string with another.
|
||||
* `wc` - counts characters, lines, and words.
|
||||
|
||||
About Penetration Testing
|
||||
----------------------------------
|
||||
**vulnerability assessment :** simply identifies and reports noted vulnerabilities
|
||||
**penetration test(Pen Test)** attempts to exploit the vulnerabilities to determine whether unauthorized access or other malicious activity is possible. Penetration testing typically includes network penetration testing and application security testing as well as controls and processes around the networks and applications, and should occur from both outside the network trying to come in (external testing) and from inside the network.
|
||||
|
||||
an authorised simulated attack on a computer system, performed to evaluate the security of the system. The test is performed to identify both weaknesses (also referred to as vulnerabilities), including the potential for unauthorized parties to gain access to the system's features and data,as well as strengths, enabling a full risk assessment to be completed.
|
||||
|
||||
***Penetration testing tools*** are used as part of a penetration test(Pen Test) to automate certain tasks, improve testing efficiency and discover issues that might be difficult to find using manual analysis techniques alone. Two common penetration testing tools are static analysis tools and dynamic analysis tools.
|
||||
|
||||
|
||||
Legal
|
||||
------
|
||||
> As one might expect, there are a wealth of legal issues that are associated with information security. Whether it’s a matter of preventing security breaches in order to maintain the security of your client information (or that of your organization), or simply realizing exactly how far one’s obligations go when it comes to information security, it’s important to realize exactly what your obligations are as far as the legal world goes with information security.
|
||||
|
||||
Because technology is ever-changing, there are always questions about what the legal protections might be when it comes to the misuse of new technology, or even what sort of jurisdiction might govern your organization or its clients. One of the biggest problems with computer crime is that laws still aren’t clear as to who polices what online, if anything. As a result, companies must protect themselves against an attack on their internal servers and other information that might be at risk.
|
||||
**Major Issues**
|
||||
- One of the biggest issues that organizations will face as far as maintaining your information security goes is that technology is developing so quickly that it is hard for the legal system to keep up. Even if you have taken the time to amass evidence against those who may have breached your information security system, there are no guarantees that this evidence will even be admissible in a court of law.
|
||||
- Penetration testing may affect system performance, and can raise confidentiality and integrity issues; therefore, this is very important, even in an internal penetration testing, which is performed by an internal staff to get permission in writing. There should be a written agreement between a tester and the company/organization/individual to clarify all the points regarding the data security, disclosure, etc. before commencing testing.
|
||||
> One consideration that pen testers should be aware of is the laws surrounding the practice of port scanning.
|
||||
|
||||
You need to consider exactly how tightly your pen test will need to scan the systems that you are authorized to scan. Also, ensure you have permission to conduct the scan with a legitimate reason to do so; it is far easier to ask permission in this case than to beg forgiveness.
|
||||
|
||||
|
||||
----------
|
||||
|
||||
|
||||
Chapter 2: The Essential Tools
|
||||
========
|
||||
Netcat
|
||||
--------
|
||||
> This simple utility reads and writes data across TCP or UDP network connections. It is designed to be a reliable back-end tool to use directly or easily drive by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need, including port binding to accept incoming connections.
|
||||
|
||||
Official website: http://nc110.sourceforge.net/
|
||||
### Features
|
||||
The original netcat's features include:
|
||||
|
||||
* Outbound or inbound connections, TCP or UDP, to or from any ports
|
||||
* Full DNS forward/reverse checking, with appropriate warnings
|
||||
* Ability to use any local source port
|
||||
* Ability to use any locally configured network source address
|
||||
* Built-in port-scanning capabilities, with randomization
|
||||
* Built-in loose source-routing capability
|
||||
* Can read command line arguments from standard input
|
||||
* Slow-send mode, one line every N seconds
|
||||
* Hex dump of transmitted and received data
|
||||
* Optional ability to let another program service establish connections
|
||||
* Optional telnet-options responder
|
||||
* Featured tunneling mode which permits user-defined tunneling, e.g., UDP or TCP, with the possibility of specifying all network parameters (source port/interface, listening port/interface, and the remote host allowed to connect to the tunnel).
|
||||
|
||||
#### The Basics
|
||||
The most basic syntax is:
|
||||
|
||||
$ netcat [options] host port
|
||||
This will attempt to initiate a TCP to the defined host on the port number specified. This is basically functions similarly to the old Linux telnet command. Keep in mind that your connection is entirely unencrypted.
|
||||
|
||||
If you would like to send a UDP packet instead of initiating a TCP connection, you can use the -u option:
|
||||
|
||||
$ netcat -u host port
|
||||
You can specify a range of ports by placing a dash between the first and last:
|
||||
|
||||
$ netcat host startport-endport
|
||||
### Netcat for Port Scanning
|
||||
the most common uses for netcat is as a port scanner.
|
||||
|
||||
$ netcat -z -v domain.com 1-10000
|
||||
`-z` - to perform a scan instead of attempting to initiate a connection
|
||||
`-v` - provide more verbose information.
|
||||
`1-10000` - scan all ports up to 10000 by issuing this command
|
||||
Output:
|
||||
|
||||
nc: connect to domain.com port 1 (tcp) failed: Connection refused
|
||||
nc: connect to domain.com port 2 (tcp) failed: Connection refused
|
||||
nc: connect to domain.com port 3 (tcp) failed: Connection refused
|
||||
nc: connect to domain.com port 4 (tcp) failed: Connection refused
|
||||
nc: connect to domain.com port 5 (tcp) failed: Connection refused
|
||||
nc: connect to domain.com port 6 (tcp) failed: Connection refused
|
||||
nc: connect to domain.com port 7 (tcp) failed: Connection refused
|
||||
. . .
|
||||
Connection to domain.com 22 port [tcp/ssh] succeeded!
|
||||
. . .
|
||||
Connection to domain.com 8000 port [tcp/*] succeeded!
|
||||
|
||||
> scan will go much faster if you know the IP address that you need. You can then use the `-n` flag to specify that you do not need to resolve the IP address using DNS
|
||||
|
||||
Another example:
|
||||
|
||||
Checking whether UDP ports (-u) 27010-27015 are open on 209.58.178.32 using zero mode I/O (-z)
|
||||
|
||||
$ nc -vzu 209.58.178.32 27010-27015
|
||||
Connection to 209.58.178.32 27015 port [udp/*] succeeded!
|
||||
|
||||
\* for education purpose only I have use ip of open server for the game counter strike
|
||||
### Communicate through Netcat
|
||||
|
||||
Netcat can listen on a port for connections and packets. This gives us the opportunity to connect two instances of netcat in a client-server relationship.
|
||||
|
||||
On one machine, you can tell netcat to listen to a specific port for connections. We can do this by providing the `-l` parameter and choosing a port:
|
||||
|
||||
$ netcat -l 4444
|
||||
|
||||
As a regular (non-root) user, you will not be able to open any ports under 1000, as a security measure.
|
||||
On another machine we'll connect to the first machine on the port number we choose
|
||||
|
||||
$ netcat domain.com 4444
|
||||
|
||||
### File Transfer with NetCat
|
||||
Because we are establishing a regular TCP connection, we can transmit just about any kind of information over that connection. It is not limited to chat messages that are typed in by a user. We can use this knowledge to turn netcat into a file transfer program.
|
||||
|
||||
again, we need to choose one end of the connection to listen for connections. However, instead of printing information onto the screen, we will place all of the information straight into a file.
|
||||
|
||||
$ netcat -l 4444 > received_file
|
||||
On other machine transfer the file as:
|
||||
|
||||
netcat domain.com 4444 < original_file
|
||||
For instance, we can transfer the contents of an entire directory by creating an unnamed tarball on-the-fly, transferring it to the remote system, and unpacking it into the remote directory.
|
||||
|
||||
On the receiving end, we can anticipate a file coming over that will need to be unzipped and extracted by typing:
|
||||
|
||||
$ netcat -l 4444 | tar xzvf -
|
||||
the ending dash (`-`) means that tar will operate on standard input, which is being piped from netcat across the network when a connection is made.
|
||||
On the side with the directory contents we want to transfer, we can pack them into a tarball and then send them to the remote computer through netcat:
|
||||
|
||||
$ tar -czf - * | netcat domain.com 4444
|
||||
This time, the dash (`-`) in the tar command means to tar and zip the contents of the current directory (as specified by the `*` wildcard), and write the result to standard output.
|
||||
> use the `dd` command to image a disk on one side and transfer it to a remote computer.
|
||||
|
||||
### Netcat as a Simple Web Server
|
||||
create a HTML `index.html` file and serve it to desire port address (as previously you can not host to port below 1000 as non root user)
|
||||
|
||||
printf 'HTTP/1.1 200 OK\n\n%s' "$(cat index.html)" | netcat -l 8888
|
||||
This will serve the page, and then the netcat connection will close. If you attempt to refresh the page, it will be gone
|
||||
We can have netcat serve the page indefinitely by wrapping the last command in an infinite loop, as:
|
||||
|
||||
while true; do printf 'HTTP/1.1 200 OK\n\n%s' "$(cat index.html)" | netcat -l 8888; done
|
||||
----------
|
||||
***Ncat***
|
||||
Ncat is a feature-packed networking utility which reads and writes data across networks from the command line. Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat. It uses both TCP and UDP for communication and is designed to be a reliable back-end tool to instantly provide network connectivity to other applications and users. Ncat will not only work with IPv4 and IPv6 but provides the user with a virtually limitless number of potential uses.
|
||||
|
||||
Among Ncat’s vast number of features there is the ability to chain Ncats together, redirect both TCP and UDP ports to other sites, SSL support, and proxy connections via SOCKS4 or HTTP (CONNECT method) proxies (with optional proxy authentication as well). Some general principles apply to most applications and thus give you the capability of instantly adding networking support to software that would normally never support it.
|
||||
|
||||
|
||||
----------
|
||||
Wireshark
|
||||
-------------
|
||||
> Official document: https://www.wireshark.org/docs/wsug_html_chunked/
|
||||
> Other helpful link(s):
|
||||
> https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/
|
||||
|
||||
Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible.
|
||||
|
||||
Wireshark is a free application that allows you to capture and view the data traveling back and forth on your network, providing the ability to drill down and read the contents of each packet – filtered to meet your specific needs. It is commonly utilized to troubleshoot network problems as well as to develop and test software. This open-source protocol analyzer is widely accepted as the industry standard, winning its fair share of awards over the years.
|
||||
|
||||
## Why use Wireshark?
|
||||
- Network administrators use it to troubleshoot network problems
|
||||
- Network security engineers use it to examine security problems
|
||||
- QA engineers use it to verify network applications
|
||||
- Developers use it to debug protocol implementations
|
||||
- People use it to learn network protocol internals
|
||||
|
||||
### Features
|
||||
- _Capture_ live packet data from a network interface.
|
||||
- _Open_ files containing packet data captured with tcpdump/WinDump, Wireshark, and a number of other packet capture programs.
|
||||
- _Import_ packets from text files containing hex dumps of packet data.
|
||||
- Display packets with _very detailed protocol information_.
|
||||
- _Filter packets_ on many criteria.
|
||||
: i.e. IPv4 address, IPv6 address, ethernet address, port, tcp, udp etc.
|
||||
- _Search_ for packets on many criteria.
|
||||
- Create various _statistics_.
|
||||
|
||||
## Making Sense of Network Dumps
|
||||
## Capture and Display Filters
|
||||
Some of the filters are as below:
|
||||
|
||||
filter packets if ipv4 address is equal to 54.36.48.153 (using `eq` or `==`)
|
||||
|
||||
ip.addr eq 54.36.48.153
|
||||
you can use multiple expression with `and` or `&&`
|
||||
|
||||
ip.addr eq 54.36.48.153 and tcp.stream eq 6
|
||||
|
||||
get conversation with specific ip and port
|
||||
|
||||
(ip.addr eq 54.36.48.153 and ip.addr eq 200.200.200.9) and (tcp.port eq 8000 and tcp.port eq 34018)
|
||||
|
||||
Look at below filter options in wireshark, here various available filter with example expression and as per requirement we can combine various filter with various Boolean operators
|
||||
|
||||
|
||||
## Following TCP Streams
|
||||
A good [link](https://www.youtube.com/watch?time_continue=4&v=xPgCZwj446o) to learn in detail how to follow tcp stream:
|
||||
|
||||
|
||||
|
||||
----------
|
||||
|
||||
|
||||
Tcpdump
|
||||
-----------
|
||||
Official [site](https://www.tcpdump.org/tcpdump_man.html)
|
||||
|
||||
other references:
|
||||
https://linux.die.net/man/8/tcpdump
|
||||
https://danielmiessler.com/study/tcpdump/
|
||||
> Tcpdump is the premier network analysis tool for information security professionals.
|
||||
|
||||
When using a tool that displays network traffic a more natural (raw) way the burden of analysis is placed directly on the human rather than the application. This approach cultivates continued and elevated understanding of the TCP/IP suite
|
||||
### Options
|
||||
|
||||
- **`-i any`** : Listen on all interfaces just to see if you’re seeing any traffic.
|
||||
- **`-i eth0`** : Listen on the eth0 interface.
|
||||
- **`-D`** : Show the list of available interfaces
|
||||
- **`-n`** : Don’t resolve hostnames.
|
||||
- **`-nn`** : Don’t resolve hostnames _or_ port names.
|
||||
- **`-q`** : Be less verbose (more quiet) with your output.
|
||||
- **`-t`** : Give human-readable timestamp output.
|
||||
- **`-tttt`** : Give maximally human-readable timestamp output.
|
||||
- **`-X`** : Show the packet’s _contents_ in both [hex](https://en.wikipedia.org/wiki/Hexidecimal) and [ascii](https://en.wikipedia.org/wiki/Ascii).
|
||||
- **`-XX`** : Same as **`-X`**, but also shows the ethernet header.
|
||||
- **`-v, -vv, -vvv`** : Increase the amount of packet information you get back.
|
||||
- **`-c`** : Only get _x_ number of packets and then stop.
|
||||
- **`-s`** : Define the _snaplength_ (size) of the capture in bytes. Use `-s0` to get everything, unless you are intentionally capturing less.
|
||||
- **`-S`** : Print absolute sequence numbers.
|
||||
- **`-e`** : Get the ethernet header as well.
|
||||
- **`-q`** : Show less protocol information.
|
||||
- **`-E`** : Decrypt IPSEC traffic by providing an encryption key.
|
||||
### Expressions
|
||||
|
||||
In `tcpdump`, _Expressions_ allow you to trim out various types of traffic and find exactly what you’re looking for. Mastering the expressions and learning to combine them creatively is what makes one truly powerful with `tcpdump`.
|
||||
|
||||
There are three main types of expression: `type`, `dir`, and `proto`.
|
||||
|
||||
- Type options are: `host`, `net`, and `port`.
|
||||
- Direction lets you do `src`, `dst`, and combinations thereof.
|
||||
- Proto(col) lets you designate: `tcp`, `udp`, `icmp`, `ah`, and many more.
|
||||
## Filtering Traffic
|
||||
**Filtering hosts:**
|
||||
| | |
|
||||
|--|--|
|
||||
| Match any traffic involving 192.168.1.1 as destination or source | `$ tcpdump -i eth1 host 192.168.1.1` |
|
||||
| As source only | `$ tcpdump -i eth1 src host 192.168.1.1` |
|
||||
| As destination only | `$ tcpdump -i eth1 dst host 192.168.1.1` |
|
||||
**Filtering ports :**
|
||||
| | |
|
||||
|--|--|
|
||||
| Match any traffic involving port 25 as source or destination | `$ tcpdump -i eth1 port 25` |
|
||||
| As source only | `$ tcpdump -i eth1 src port 25` |
|
||||
| As destination only | `$ tcpdump -i eth1 dst port 25` |
|
||||
**Network filtering :**
|
||||
|
||||
$ tcpdump -i eth1 net 192.168
|
||||
$ tcpdump -i eth1 src net 192.168
|
||||
$ tcpdump -i eth1 dst net 192.168
|
||||
**Protocol filtering :**
|
||||
|
||||
$ tcpdump -i eth1 arp
|
||||
$ tcpdump -i eth1 ip
|
||||
|
||||
$ tcpdump -i eth1 tcp
|
||||
$ tcpdump -i eth1 udp
|
||||
$ tcpdump -i eth1 icmp
|
||||
***Combine expressions :***
|
||||
*Negation* : `!` or `not` (without the quotes)
|
||||
*Concatanate* : `&&` or `and`
|
||||
*Alternate* : `||` or `or`
|
||||
|
||||
- This rule will match any TCP traffic on port `80` (web) with `192.168.1.254` or `192.168.1.200` as destination host
|
||||
|
||||
`$ tcpdump -i eth1 '((tcp) and (port 80) and ((dst host 192.168.1.254) or (dst host 192.168.1.200)))'`
|
||||
|
||||
- Will match any ICMP traffic involving the destination with physical/MAC address `00:01:02:03:04:05`
|
||||
|
||||
`$ tcpdump -i eth1 '((icmp) and ((ether dst host 00:01:02:03:04:05)))'`
|
||||
|
||||
- Will match any traffic for the destination network `192.168` except destination host `192.168.1.200`
|
||||
|
||||
`$ tcpdump -i eth1 '((tcp) and ((dst net 192.168) and (not dst host 192.168.1.200)))'`
|
||||
|
||||
## Advanced Header Filtering
|
||||
> Helpful [link](https://www.wains.be/pub/networking/tcpdump_advanced_filters.txt)
|
||||
| | |
|
||||
|--|--|
|
||||
| `proto[x:y]` | will start filtering from byte `x` for `y` bytes. `ip[2:2]` would filter bytes `3` and `4` (first byte begins by 0) |
|
||||
| `proto[x:y] & z = 0` | will *match* bits set to `0` when applying `mask z` to `proto[x:y]`
|
||||
| `proto[x:y] & z !=0` | some bits are *set* when applying `mask z` to `proto[x:y]`
|
||||
| `proto[x:y] & z = z` | *every* bits are *set* to `z` when applying `mask z` to `proto[x:y]`
|
||||
| `proto[x:y] = z` | `p[x:y]` has exactly the bits set to `z`
|
||||
|
||||
**IP header**
|
||||
|
||||
@@ -1,269 +0,0 @@
|
||||
{
|
||||
"claude_code": {
|
||||
"id": "claude_code",
|
||||
"name": "Claude Code",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "anthropic",
|
||||
"base_url": "https://api.anthropic.com",
|
||||
"tier": 1,
|
||||
"default_model": "claude-sonnet-4-5-20250929",
|
||||
"accounts": {
|
||||
"acct_36f54de8": {
|
||||
"id": "acct_36f54de8",
|
||||
"label": "Claude Code (credentials file)",
|
||||
"source": "cli_detect",
|
||||
"credential_type": "oauth",
|
||||
"created_at": "2026-02-16T18:46:19Z",
|
||||
"last_used": null,
|
||||
"tokens_used": 0,
|
||||
"is_active": true,
|
||||
"expires_at": 1771822745.308,
|
||||
"model_override": null
|
||||
}
|
||||
},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"codex_cli": {
|
||||
"id": "codex_cli",
|
||||
"name": "OpenAI Codex CLI",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.openai.com/v1",
|
||||
"tier": 1,
|
||||
"default_model": "gpt-4o",
|
||||
"accounts": {},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"gemini_cli": {
|
||||
"id": "gemini_cli",
|
||||
"name": "Gemini CLI",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "gemini_code_assist",
|
||||
"base_url": "https://cloudcode-pa.googleapis.com",
|
||||
"tier": 1,
|
||||
"default_model": "gemini-2.5-flash",
|
||||
"accounts": {
|
||||
"acct_ad76c781": {
|
||||
"id": "acct_ad76c781",
|
||||
"label": "Gemini CLI",
|
||||
"source": "cli_detect",
|
||||
"credential_type": "oauth",
|
||||
"created_at": "2026-02-16T18:45:22Z",
|
||||
"last_used": "2026-02-18T14:59:29Z",
|
||||
"tokens_used": 5009,
|
||||
"is_active": true,
|
||||
"expires_at": 1771461656.003,
|
||||
"model_override": null
|
||||
}
|
||||
},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"cursor": {
|
||||
"id": "cursor",
|
||||
"name": "Cursor",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api2.cursor.sh/v1",
|
||||
"tier": 1,
|
||||
"default_model": "cursor-fast",
|
||||
"accounts": {},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"copilot": {
|
||||
"id": "copilot",
|
||||
"name": "GitHub Copilot",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.githubcopilot.com",
|
||||
"tier": 1,
|
||||
"default_model": "gpt-4o",
|
||||
"accounts": {},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"iflow": {
|
||||
"id": "iflow",
|
||||
"name": "iFlow AI",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.iflow.ai/v1",
|
||||
"tier": 1,
|
||||
"default_model": "kimi-k2",
|
||||
"accounts": {},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"qwen_code": {
|
||||
"id": "qwen_code",
|
||||
"name": "Qwen Code",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://chat.qwen.ai/api/v1",
|
||||
"tier": 1,
|
||||
"default_model": "qwen3-coder",
|
||||
"accounts": {},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"kiro": {
|
||||
"id": "kiro",
|
||||
"name": "Kiro AI",
|
||||
"auth_type": "oauth",
|
||||
"api_format": "anthropic",
|
||||
"base_url": "https://api.anthropic.com",
|
||||
"tier": 1,
|
||||
"default_model": "claude-sonnet-4-5-20250929",
|
||||
"accounts": {},
|
||||
"env_key": null,
|
||||
"enabled": true
|
||||
},
|
||||
"anthropic": {
|
||||
"id": "anthropic",
|
||||
"name": "Anthropic",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "anthropic",
|
||||
"base_url": "https://api.anthropic.com",
|
||||
"tier": 1,
|
||||
"default_model": "claude-sonnet-4-5-20250929",
|
||||
"accounts": {
|
||||
"acct_eaabc038": {
|
||||
"id": "acct_eaabc038",
|
||||
"label": "Anthropic (env)",
|
||||
"source": "env_var",
|
||||
"credential_type": "api_key",
|
||||
"created_at": "2026-02-16T13:46:47Z",
|
||||
"last_used": "2026-02-16T19:05:03Z",
|
||||
"tokens_used": 114420,
|
||||
"is_active": true,
|
||||
"expires_at": null,
|
||||
"model_override": null
|
||||
}
|
||||
},
|
||||
"env_key": "ANTHROPIC_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"openai": {
|
||||
"id": "openai",
|
||||
"name": "OpenAI",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.openai.com/v1",
|
||||
"tier": 1,
|
||||
"default_model": "gpt-4o",
|
||||
"accounts": {},
|
||||
"env_key": "OPENAI_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"gemini": {
|
||||
"id": "gemini",
|
||||
"name": "Gemini",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "gemini",
|
||||
"base_url": "https://generativelanguage.googleapis.com/v1beta",
|
||||
"tier": 1,
|
||||
"default_model": "gemini-2.5-flash",
|
||||
"accounts": {},
|
||||
"env_key": "GEMINI_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"openrouter": {
|
||||
"id": "openrouter",
|
||||
"name": "OpenRouter",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://openrouter.ai/api/v1",
|
||||
"tier": 1,
|
||||
"default_model": "anthropic/claude-sonnet-4-5",
|
||||
"accounts": {},
|
||||
"env_key": "OPENROUTER_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"glm": {
|
||||
"id": "glm",
|
||||
"name": "GLM (Zhipu AI)",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://open.bigmodel.cn/api/paas/v4",
|
||||
"tier": 2,
|
||||
"default_model": "glm-4-flash",
|
||||
"accounts": {},
|
||||
"env_key": "GLM_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"kimi": {
|
||||
"id": "kimi",
|
||||
"name": "Kimi (Moonshot)",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.moonshot.cn/v1",
|
||||
"tier": 2,
|
||||
"default_model": "moonshot-v1-8k",
|
||||
"accounts": {},
|
||||
"env_key": "KIMI_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"minimax": {
|
||||
"id": "minimax",
|
||||
"name": "Minimax",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.minimax.chat/v1",
|
||||
"tier": 2,
|
||||
"default_model": "abab6.5-chat",
|
||||
"accounts": {},
|
||||
"env_key": "MINIMAX_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"together": {
|
||||
"id": "together",
|
||||
"name": "Together AI",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.together.xyz/v1",
|
||||
"tier": 2,
|
||||
"default_model": "meta-llama/Llama-3-70b-chat-hf",
|
||||
"accounts": {},
|
||||
"env_key": "TOGETHER_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"fireworks": {
|
||||
"id": "fireworks",
|
||||
"name": "Fireworks AI",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "https://api.fireworks.ai/inference/v1",
|
||||
"tier": 2,
|
||||
"default_model": "accounts/fireworks/models/llama-v3p1-70b-instruct",
|
||||
"accounts": {},
|
||||
"env_key": "FIREWORKS_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"ollama": {
|
||||
"id": "ollama",
|
||||
"name": "Ollama",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "ollama",
|
||||
"base_url": "http://localhost:11434",
|
||||
"tier": 3,
|
||||
"default_model": "llama3",
|
||||
"accounts": {},
|
||||
"env_key": "OLLAMA_API_KEY",
|
||||
"enabled": true
|
||||
},
|
||||
"lmstudio": {
|
||||
"id": "lmstudio",
|
||||
"name": "LM Studio",
|
||||
"auth_type": "api_key",
|
||||
"api_format": "openai_compat",
|
||||
"base_url": "http://localhost:1234/v1",
|
||||
"tier": 3,
|
||||
"default_model": "local-model",
|
||||
"accounts": {},
|
||||
"env_key": "LMSTUDIO_API_KEY",
|
||||
"enabled": true
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
File diff suppressed because one or more lines are too long
@@ -1,45 +0,0 @@
|
||||
# NeuroSploit v3 - LITE Docker Compose
|
||||
# Fast builds without external security tools
|
||||
# Usage: docker compose -f docker-compose.lite.yml up --build
|
||||
|
||||
services:
|
||||
backend:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/Dockerfile.backend.lite
|
||||
container_name: neurosploit-backend
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
|
||||
- OPENAI_API_KEY=${OPENAI_API_KEY:-}
|
||||
- DATABASE_URL=sqlite+aiosqlite:///./data/neurosploit.db
|
||||
volumes:
|
||||
- neurosploit-data:/app/data
|
||||
ports:
|
||||
- "8000:8000"
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8000/api/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
|
||||
frontend:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/Dockerfile.frontend
|
||||
container_name: neurosploit-frontend
|
||||
ports:
|
||||
- "3000:80"
|
||||
depends_on:
|
||||
backend:
|
||||
condition: service_healthy
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
neurosploit-data:
|
||||
|
||||
networks:
|
||||
default:
|
||||
name: neurosploit-network
|
||||
@@ -1,45 +0,0 @@
|
||||
services:
|
||||
backend:
|
||||
build:
|
||||
context: .
|
||||
# Use Dockerfile.backend.lite for faster builds (no security tools)
|
||||
# Use Dockerfile.backend for full version with all tools
|
||||
dockerfile: docker/Dockerfile.backend
|
||||
container_name: neurosploit-backend
|
||||
env_file:
|
||||
- .env
|
||||
environment:
|
||||
# These override .env if set
|
||||
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
|
||||
- OPENAI_API_KEY=${OPENAI_API_KEY:-}
|
||||
- NIM_API_KEY=${NIM_API_KEY:-}
|
||||
- DATABASE_URL=sqlite+aiosqlite:///./data/neurosploit.db
|
||||
volumes:
|
||||
- neurosploit-data:/app/data
|
||||
ports:
|
||||
- "8000:8000"
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8000/api/health"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
|
||||
frontend:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: docker/Dockerfile.frontend
|
||||
container_name: neurosploit-frontend
|
||||
ports:
|
||||
- "3000:80"
|
||||
depends_on:
|
||||
backend:
|
||||
condition: service_healthy
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
neurosploit-data:
|
||||
|
||||
networks:
|
||||
default:
|
||||
name: neurosploit-network
|
||||
@@ -1,103 +0,0 @@
|
||||
# NeuroSploit v3 - Optimized Multi-Stage Dockerfile
|
||||
# Dramatically reduces build time and image size
|
||||
# Supports ARM64 (Apple Silicon) and AMD64
|
||||
|
||||
# =============================================================================
|
||||
# STAGE 1: Go Tools Builder
|
||||
# =============================================================================
|
||||
FROM golang:1.22-alpine AS go-builder
|
||||
|
||||
RUN apk add --no-cache git
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install Go tools in parallel where possible
|
||||
RUN go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest & \
|
||||
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest & \
|
||||
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest & \
|
||||
go install -v github.com/tomnomnom/waybackurls@latest & \
|
||||
go install -v github.com/ffuf/ffuf/v2@latest & \
|
||||
wait
|
||||
|
||||
RUN go install -v github.com/projectdiscovery/katana/cmd/katana@latest & \
|
||||
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest & \
|
||||
go install -v github.com/lc/gau/v2/cmd/gau@latest & \
|
||||
go install -v github.com/tomnomnom/gf@latest & \
|
||||
go install -v github.com/tomnomnom/qsreplace@latest & \
|
||||
wait
|
||||
|
||||
RUN go install -v github.com/hahwul/dalfox/v2@latest & \
|
||||
go install -v github.com/OJ/gobuster/v3@latest & \
|
||||
go install -v github.com/jaeles-project/gospider@latest & \
|
||||
go install -v github.com/tomnomnom/anew@latest & \
|
||||
wait
|
||||
|
||||
# Optional tools (less critical)
|
||||
RUN go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest 2>/dev/null || true
|
||||
RUN go install -v github.com/hakluke/hakrawler@latest 2>/dev/null || true
|
||||
|
||||
# =============================================================================
|
||||
# STAGE 2: Python Dependencies
|
||||
# =============================================================================
|
||||
FROM python:3.11-slim AS python-deps
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY backend/requirements.txt .
|
||||
|
||||
RUN pip install --no-cache-dir --user -r requirements.txt && \
|
||||
pip install --no-cache-dir --user arjun wafw00f
|
||||
|
||||
# =============================================================================
|
||||
# STAGE 3: Final Runtime Image
|
||||
# =============================================================================
|
||||
FROM python:3.11-slim AS runtime
|
||||
|
||||
# Install only essential runtime dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
curl \
|
||||
wget \
|
||||
git \
|
||||
dnsutils \
|
||||
nmap \
|
||||
sqlmap \
|
||||
jq \
|
||||
ca-certificates \
|
||||
libpcap0.8 \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& apt-get clean
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Copy Go binaries from builder (may be partial if some tools failed)
|
||||
COPY --from=go-builder /go/bin/ /usr/local/bin/
|
||||
|
||||
# Note: Rust tools (feroxbuster) removed for faster builds
|
||||
# Install via: cargo install feroxbuster (if needed)
|
||||
|
||||
# Copy Python packages
|
||||
COPY --from=python-deps /root/.local /root/.local
|
||||
ENV PATH=/root/.local/bin:$PATH
|
||||
|
||||
# Copy application code
|
||||
COPY backend/ ./backend/
|
||||
COPY prompts/ ./prompts/
|
||||
|
||||
# Create data directories
|
||||
RUN mkdir -p data/reports data/scans data/recon /root/.config/nuclei
|
||||
|
||||
# Download wordlists (small subset for faster builds)
|
||||
RUN mkdir -p /opt/wordlists && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt -O /opt/wordlists/common.txt || true && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt -O /opt/wordlists/subdomains-5000.txt || true
|
||||
|
||||
# Update nuclei templates (runs on first startup if needed)
|
||||
RUN nuclei -update-templates -silent 2>/dev/null || true
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD curl -f http://localhost:8000/api/health || exit 1
|
||||
|
||||
EXPOSE 8000
|
||||
|
||||
CMD ["python", "-m", "uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "8000"]
|
||||
@@ -1,32 +0,0 @@
|
||||
# NeuroSploit v3 - LITE Dockerfile (Fast Build)
|
||||
# Minimal image without external security tools
|
||||
# Use this for development or when you don't need the recon tools
|
||||
|
||||
FROM python:3.11-slim
|
||||
|
||||
# Install minimal dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
curl \
|
||||
ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install Python dependencies
|
||||
COPY backend/requirements.txt .
|
||||
RUN pip install --no-cache-dir -r requirements.txt
|
||||
|
||||
# Copy application code
|
||||
COPY backend/ ./backend/
|
||||
COPY prompts/ ./prompts/
|
||||
|
||||
# Create data directories
|
||||
RUN mkdir -p data/reports data/scans data/recon
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD curl -f http://localhost:8000/api/health || exit 1
|
||||
|
||||
EXPOSE 8000
|
||||
|
||||
CMD ["python", "-m", "uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "8000"]
|
||||
@@ -1,29 +0,0 @@
|
||||
# Build stage
|
||||
FROM node:20-alpine AS builder
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Copy package files
|
||||
COPY frontend/package*.json ./
|
||||
|
||||
# Install dependencies
|
||||
RUN npm install
|
||||
|
||||
# Copy source code
|
||||
COPY frontend/ ./
|
||||
|
||||
# Build the application
|
||||
RUN npm run build
|
||||
|
||||
# Production stage
|
||||
FROM nginx:alpine
|
||||
|
||||
# Copy built assets
|
||||
COPY --from=builder /app/dist /usr/share/nginx/html
|
||||
|
||||
# Copy nginx configuration
|
||||
COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
|
||||
|
||||
EXPOSE 80
|
||||
|
||||
CMD ["nginx", "-g", "daemon off;"]
|
||||
@@ -1,131 +0,0 @@
|
||||
# NeuroSploit v3 - Kali Linux Security Sandbox
|
||||
# Per-scan container with essential tools pre-installed + on-demand install support.
|
||||
#
|
||||
# Build:
|
||||
# docker build -f docker/Dockerfile.kali -t neurosploit-kali:latest docker/
|
||||
#
|
||||
# Rebuild (no cache):
|
||||
# docker build --no-cache -f docker/Dockerfile.kali -t neurosploit-kali:latest docker/
|
||||
#
|
||||
# Or via compose:
|
||||
# docker compose -f docker/docker-compose.kali.yml build
|
||||
#
|
||||
# Design:
|
||||
# - Pre-compile Go tools (nuclei, naabu, httpx, subfinder, katana, dnsx, ffuf,
|
||||
# gobuster, dalfox, waybackurls, uncover) to avoid 60s+ go install per scan
|
||||
# - Pre-install common apt tools (nikto, sqlmap, masscan, whatweb) for instant use
|
||||
# - Include Go, Python, pip, git so on-demand tools can be compiled/installed
|
||||
# - Full Kali apt repos available for on-demand apt-get install of any security tool
|
||||
|
||||
# ---- Stage 1: Pre-compile Go security tools ----
|
||||
FROM golang:1.26-bookworm AS go-builder
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
git build-essential libpcap-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Pre-compile ProjectDiscovery suite + common Go tools
|
||||
# Split into separate RUN layers for better Docker cache (if one fails, others cached)
|
||||
RUN go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
|
||||
RUN go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
|
||||
RUN go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
|
||||
RUN go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
|
||||
RUN go install -v github.com/projectdiscovery/katana/cmd/katana@latest
|
||||
RUN go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
|
||||
RUN go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest
|
||||
RUN go install -v github.com/ffuf/ffuf/v2@latest
|
||||
RUN go install -v github.com/OJ/gobuster/v3@v3.7.0
|
||||
RUN go install -v github.com/hahwul/dalfox/v2@latest
|
||||
RUN go install -v github.com/tomnomnom/waybackurls@latest
|
||||
|
||||
# ---- Stage 2: Kali Linux runtime ----
|
||||
FROM kalilinux/kali-rolling
|
||||
|
||||
LABEL maintainer="NeuroSploit Team"
|
||||
LABEL description="NeuroSploit Kali Sandbox - Per-scan isolated tool execution"
|
||||
LABEL neurosploit.version="3.0"
|
||||
LABEL neurosploit.type="kali-sandbox"
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
# Layer 1: Core system + build tools (rarely changes, cached)
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
bash \
|
||||
curl \
|
||||
wget \
|
||||
git \
|
||||
jq \
|
||||
ca-certificates \
|
||||
openssl \
|
||||
dnsutils \
|
||||
whois \
|
||||
netcat-openbsd \
|
||||
libpcap-dev \
|
||||
python3 \
|
||||
python3-pip \
|
||||
golang-go \
|
||||
build-essential \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Layer 2: Pre-install common security tools from Kali repos (saves ~30s on-demand each)
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
nmap \
|
||||
nikto \
|
||||
sqlmap \
|
||||
masscan \
|
||||
whatweb \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Layer 3: VPN + network tools (for terminal agent VPN connections)
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
openvpn \
|
||||
wireguard-tools \
|
||||
iproute2 \
|
||||
iptables \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy ALL pre-compiled Go binaries from builder
|
||||
COPY --from=go-builder /go/bin/nuclei /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/naabu /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/httpx /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/subfinder /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/katana /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/dnsx /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/uncover /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/ffuf /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/gobuster /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/dalfox /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/waybackurls /usr/local/bin/
|
||||
|
||||
# Go environment for on-demand tool compilation
|
||||
ENV GOPATH=/root/go
|
||||
ENV PATH="${PATH}:/root/go/bin"
|
||||
|
||||
# Create directories
|
||||
RUN mkdir -p /opt/wordlists /opt/output /opt/templates /opt/nuclei-templates
|
||||
|
||||
# Download commonly used wordlists (|| true so build doesn't fail on network issues)
|
||||
RUN wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt \
|
||||
-O /opt/wordlists/common.txt 2>/dev/null || true && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/directory-list-2.3-medium.txt \
|
||||
-O /opt/wordlists/directory-list-medium.txt 2>/dev/null || true && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt \
|
||||
-O /opt/wordlists/subdomains-5000.txt 2>/dev/null || true && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-1000.txt \
|
||||
-O /opt/wordlists/passwords-top1000.txt 2>/dev/null || true
|
||||
|
||||
# Update Nuclei templates
|
||||
RUN nuclei -update-templates -silent 2>/dev/null || true
|
||||
|
||||
# Health check script
|
||||
RUN printf '#!/bin/bash\nnuclei -version > /dev/null 2>&1 && naabu -version > /dev/null 2>&1 && echo "OK"\n' \
|
||||
> /opt/healthcheck.sh && chmod +x /opt/healthcheck.sh
|
||||
|
||||
HEALTHCHECK --interval=60s --timeout=10s --retries=3 \
|
||||
CMD /opt/healthcheck.sh
|
||||
|
||||
WORKDIR /opt/output
|
||||
|
||||
CMD ["bash"]
|
||||
@@ -1,98 +0,0 @@
|
||||
# NeuroSploit v3 - Security Sandbox Container
|
||||
# Kali-based container with real penetration testing tools
|
||||
# Provides Nuclei, Naabu, and other ProjectDiscovery tools via isolated execution
|
||||
|
||||
FROM golang:1.26-bookworm AS go-builder
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends git build-essential && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install ProjectDiscovery suite + other Go security tools
|
||||
RUN go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest && \
|
||||
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest && \
|
||||
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest && \
|
||||
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest && \
|
||||
go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
|
||||
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest && \
|
||||
go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest && \
|
||||
go install -v github.com/ffuf/ffuf/v2@latest && \
|
||||
go install -v github.com/OJ/gobuster/v3@v3.7.0 && \
|
||||
go install -v github.com/hahwul/dalfox/v2@latest && \
|
||||
go install -v github.com/tomnomnom/waybackurls@latest
|
||||
|
||||
# Final runtime image - Debian-based for compatibility
|
||||
FROM debian:bookworm-slim
|
||||
|
||||
LABEL maintainer="NeuroSploit Team"
|
||||
LABEL description="NeuroSploit Security Sandbox - Isolated tool execution environment"
|
||||
|
||||
# Install runtime dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
bash \
|
||||
curl \
|
||||
wget \
|
||||
nmap \
|
||||
python3 \
|
||||
python3-pip \
|
||||
git \
|
||||
jq \
|
||||
dnsutils \
|
||||
openssl \
|
||||
libpcap-dev \
|
||||
ca-certificates \
|
||||
whois \
|
||||
netcat-openbsd \
|
||||
nikto \
|
||||
masscan \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Install Python security tools
|
||||
RUN pip3 install --no-cache-dir --break-system-packages \
|
||||
sqlmap \
|
||||
wfuzz \
|
||||
dirsearch \
|
||||
arjun \
|
||||
wafw00f \
|
||||
2>/dev/null || pip3 install --no-cache-dir --break-system-packages sqlmap
|
||||
|
||||
# Copy Go binaries from builder
|
||||
COPY --from=go-builder /go/bin/nuclei /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/naabu /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/httpx /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/subfinder /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/katana /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/dnsx /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/uncover /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/ffuf /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/gobuster /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/dalfox /usr/local/bin/
|
||||
COPY --from=go-builder /go/bin/waybackurls /usr/local/bin/
|
||||
|
||||
# Create directories
|
||||
RUN mkdir -p /opt/wordlists /opt/output /opt/templates /opt/nuclei-templates
|
||||
|
||||
# Download wordlists
|
||||
RUN wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt \
|
||||
-O /opt/wordlists/common.txt && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/directory-list-2.3-medium.txt \
|
||||
-O /opt/wordlists/directory-list-medium.txt && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt \
|
||||
-O /opt/wordlists/subdomains-5000.txt && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-1000.txt \
|
||||
-O /opt/wordlists/passwords-top1000.txt
|
||||
|
||||
# Update Nuclei templates (8000+ vulnerability checks)
|
||||
RUN nuclei -update-templates -silent 2>/dev/null || true
|
||||
|
||||
# Health check script
|
||||
RUN echo '#!/bin/bash\nnuclei -version > /dev/null 2>&1 && naabu -version > /dev/null 2>&1 && echo "OK"' > /opt/healthcheck.sh && \
|
||||
chmod +x /opt/healthcheck.sh
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
|
||||
CMD /opt/healthcheck.sh
|
||||
|
||||
WORKDIR /opt/output
|
||||
|
||||
ENTRYPOINT ["/bin/bash", "-c"]
|
||||
@@ -1,92 +0,0 @@
|
||||
# NeuroSploit v3 - Security Tools Runner Container
|
||||
# Ephemeral container for running security tools in isolation
|
||||
|
||||
FROM golang:1.22-alpine AS go-builder
|
||||
|
||||
RUN apk add --no-cache git build-base
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
# Install essential Go security tools
|
||||
RUN go install -v github.com/ffuf/ffuf/v2@latest && \
|
||||
go install -v github.com/OJ/gobuster/v3@latest && \
|
||||
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest && \
|
||||
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest && \
|
||||
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest && \
|
||||
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest && \
|
||||
go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
|
||||
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest && \
|
||||
go install -v github.com/hahwul/dalfox/v2@latest && \
|
||||
go install -v github.com/tomnomnom/waybackurls@latest
|
||||
|
||||
# Rust tools builder
|
||||
FROM rust:1.75-alpine AS rust-builder
|
||||
|
||||
RUN apk add --no-cache musl-dev openssl-dev openssl-libs-static pkgconf
|
||||
|
||||
# Install feroxbuster
|
||||
RUN cargo install feroxbuster --locked
|
||||
|
||||
# Final runtime image
|
||||
FROM alpine:3.19
|
||||
|
||||
# Install runtime dependencies and tools
|
||||
RUN apk add --no-cache \
|
||||
bash \
|
||||
curl \
|
||||
wget \
|
||||
nmap \
|
||||
nmap-scripts \
|
||||
python3 \
|
||||
py3-pip \
|
||||
git \
|
||||
jq \
|
||||
bind-tools \
|
||||
openssl \
|
||||
libpcap \
|
||||
ca-certificates \
|
||||
nikto \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
# Install Python security tools
|
||||
RUN pip3 install --no-cache-dir --break-system-packages \
|
||||
sqlmap \
|
||||
wfuzz \
|
||||
dirsearch \
|
||||
arjun \
|
||||
wafw00f \
|
||||
whatweb 2>/dev/null || pip3 install --no-cache-dir --break-system-packages sqlmap wfuzz
|
||||
|
||||
# Copy Go binaries
|
||||
COPY --from=go-builder /go/bin/* /usr/local/bin/
|
||||
|
||||
# Copy Rust binaries
|
||||
COPY --from=rust-builder /usr/local/cargo/bin/feroxbuster /usr/local/bin/
|
||||
|
||||
# Install dirb
|
||||
RUN apk add --no-cache dirb 2>/dev/null || \
|
||||
(wget -q https://downloads.sourceforge.net/project/dirb/dirb/2.22/dirb222.tar.gz && \
|
||||
tar -xzf dirb222.tar.gz && cd dirb222 && ./configure && make && make install && \
|
||||
cd .. && rm -rf dirb222*) || true
|
||||
|
||||
# Create wordlists directory
|
||||
RUN mkdir -p /opt/wordlists /opt/output
|
||||
|
||||
# Download common wordlists
|
||||
RUN wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/common.txt \
|
||||
-O /opt/wordlists/common.txt && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/directory-list-2.3-medium.txt \
|
||||
-O /opt/wordlists/directory-list-medium.txt && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/raft-large-files.txt \
|
||||
-O /opt/wordlists/raft-files.txt && \
|
||||
wget -q https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt \
|
||||
-O /opt/wordlists/subdomains-5000.txt
|
||||
|
||||
# Update nuclei templates
|
||||
RUN nuclei -update-templates -silent 2>/dev/null || true
|
||||
|
||||
# Set working directory
|
||||
WORKDIR /opt/output
|
||||
|
||||
# Default command
|
||||
ENTRYPOINT ["/bin/bash", "-c"]
|
||||
@@ -1,38 +0,0 @@
|
||||
# NeuroSploit v3 - Kali Sandbox Build & Management
|
||||
#
|
||||
# Build image:
|
||||
# docker compose -f docker/docker-compose.kali.yml build
|
||||
#
|
||||
# Build (no cache):
|
||||
# docker compose -f docker/docker-compose.kali.yml build --no-cache
|
||||
#
|
||||
# Test container manually:
|
||||
# docker compose -f docker/docker-compose.kali.yml run --rm kali-sandbox "nuclei -version"
|
||||
#
|
||||
# Note: In production, containers are managed by ContainerPool (core/container_pool.py).
|
||||
# This compose file is for building the image and manual testing only.
|
||||
|
||||
services:
|
||||
kali-sandbox:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile.kali
|
||||
image: neurosploit-kali:latest
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 2G
|
||||
cpus: '2.0'
|
||||
reservations:
|
||||
memory: 512M
|
||||
cpus: '0.5'
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
cap_add:
|
||||
- NET_RAW
|
||||
- NET_ADMIN
|
||||
labels:
|
||||
neurosploit.type: "kali-sandbox"
|
||||
neurosploit.version: "3.0"
|
||||
@@ -1,51 +0,0 @@
|
||||
# NeuroSploit v3 - Security Sandbox
|
||||
# Isolated container for running real penetration testing tools
|
||||
#
|
||||
# Usage:
|
||||
# docker compose -f docker-compose.sandbox.yml up -d
|
||||
# docker compose -f docker-compose.sandbox.yml exec sandbox nuclei -u https://target.com
|
||||
# docker compose -f docker-compose.sandbox.yml down
|
||||
|
||||
services:
|
||||
sandbox:
|
||||
build:
|
||||
context: .
|
||||
dockerfile: Dockerfile.sandbox
|
||||
image: neurosploit-sandbox:latest
|
||||
container_name: neurosploit-sandbox
|
||||
command: ["sleep infinity"]
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- sandbox-net
|
||||
volumes:
|
||||
- sandbox-output:/opt/output
|
||||
- sandbox-templates:/opt/nuclei-templates
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 2G
|
||||
cpus: '2.0'
|
||||
reservations:
|
||||
memory: 512M
|
||||
cpus: '0.5'
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
cap_add:
|
||||
- NET_RAW # Required for naabu/nmap raw sockets
|
||||
- NET_ADMIN # Required for packet capture
|
||||
healthcheck:
|
||||
test: ["CMD", "/opt/healthcheck.sh"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
|
||||
networks:
|
||||
sandbox-net:
|
||||
driver: bridge
|
||||
internal: false
|
||||
|
||||
volumes:
|
||||
sandbox-output:
|
||||
sandbox-templates:
|
||||
@@ -1,47 +0,0 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name localhost;
|
||||
|
||||
root /usr/share/nginx/html;
|
||||
index index.html;
|
||||
|
||||
# Gzip compression
|
||||
gzip on;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
|
||||
|
||||
# API proxy
|
||||
location /api {
|
||||
proxy_pass http://backend:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 300s;
|
||||
proxy_connect_timeout 75s;
|
||||
}
|
||||
|
||||
# WebSocket proxy for scan updates
|
||||
location /ws {
|
||||
proxy_pass http://backend:8000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_read_timeout 86400;
|
||||
proxy_send_timeout 86400;
|
||||
}
|
||||
|
||||
# Frontend routes - serve index.html for SPA
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
|
||||
# Cache static assets
|
||||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
-10
@@ -1,10 +0,0 @@
|
||||
HTTP/1.1 200 OK
|
||||
Cache-Control: private
|
||||
Content-Type: text/html; charset=utf-8
|
||||
Server: Microsoft-IIS/8.5
|
||||
X-AspNet-Version: 2.0.50727
|
||||
Set-Cookie: ASP.NET_SessionId=fnvw5h45lqt4ay45z1d0bd2u; path=/; HttpOnly
|
||||
X-Powered-By: ASP.NET
|
||||
Date: Tue, 23 Jun 2026 21:13:51 GMT
|
||||
Content-Length: 13318
|
||||
|
||||
@@ -1,544 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# NeuroSploit v2 - Reconnaissance Tools Installer
|
||||
# Installs all required tools for advanced reconnaissance
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
# Colors
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# Banner
|
||||
echo -e "${CYAN}"
|
||||
echo "╔═══════════════════════════════════════════════════════════════╗"
|
||||
echo "║ NEUROSPLOIT v2 - TOOLS INSTALLER ║"
|
||||
echo "║ Advanced Reconnaissance Tools Setup ║"
|
||||
echo "╚═══════════════════════════════════════════════════════════════╝"
|
||||
echo -e "${NC}"
|
||||
|
||||
# Detect OS
|
||||
detect_os() {
|
||||
if [[ "$OSTYPE" == "darwin"* ]]; then
|
||||
OS="macos"
|
||||
PKG_MANAGER="brew"
|
||||
elif [ -f /etc/debian_version ]; then
|
||||
OS="debian"
|
||||
PKG_MANAGER="apt"
|
||||
elif [ -f /etc/redhat-release ]; then
|
||||
OS="redhat"
|
||||
PKG_MANAGER="dnf"
|
||||
elif [ -f /etc/arch-release ]; then
|
||||
OS="arch"
|
||||
PKG_MANAGER="pacman"
|
||||
else
|
||||
OS="unknown"
|
||||
PKG_MANAGER="unknown"
|
||||
fi
|
||||
echo -e "${BLUE}[*] Detected OS: ${OS} (Package Manager: ${PKG_MANAGER})${NC}"
|
||||
}
|
||||
|
||||
# Check if command exists
|
||||
command_exists() {
|
||||
command -v "$1" &> /dev/null
|
||||
}
|
||||
|
||||
# Print status
|
||||
print_status() {
|
||||
if command_exists "$1"; then
|
||||
echo -e " ${GREEN}[✓]${NC} $1 - installed"
|
||||
return 0
|
||||
else
|
||||
echo -e " ${RED}[✗]${NC} $1 - not found"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Install Go if not present
|
||||
install_go() {
|
||||
if command_exists go; then
|
||||
echo -e "${GREEN}[✓] Go is already installed${NC}"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo -e "${YELLOW}[*] Installing Go...${NC}"
|
||||
|
||||
if [ "$OS" == "macos" ]; then
|
||||
brew install go
|
||||
elif [ "$OS" == "debian" ]; then
|
||||
sudo apt update && sudo apt install -y golang-go
|
||||
elif [ "$OS" == "redhat" ]; then
|
||||
sudo dnf install -y golang
|
||||
elif [ "$OS" == "arch" ]; then
|
||||
sudo pacman -S --noconfirm go
|
||||
else
|
||||
# Manual installation
|
||||
GO_VERSION="1.21.5"
|
||||
wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
|
||||
sudo rm -rf /usr/local/go
|
||||
sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
|
||||
rm "go${GO_VERSION}.linux-amd64.tar.gz"
|
||||
export PATH=$PATH:/usr/local/go/bin
|
||||
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
|
||||
echo 'export PATH=$PATH:$(go env GOPATH)/bin' >> ~/.bashrc
|
||||
fi
|
||||
|
||||
# Set GOPATH
|
||||
export GOPATH=$HOME/go
|
||||
export PATH=$PATH:$GOPATH/bin
|
||||
}
|
||||
|
||||
# Install Rust if not present
|
||||
install_rust() {
|
||||
if command_exists cargo; then
|
||||
echo -e "${GREEN}[✓] Rust is already installed${NC}"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo -e "${YELLOW}[*] Installing Rust...${NC}"
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
|
||||
source "$HOME/.cargo/env"
|
||||
}
|
||||
|
||||
# Install Python packages
|
||||
install_python_packages() {
|
||||
echo -e "${BLUE}[*] Installing Python packages...${NC}"
|
||||
|
||||
pip3 install --upgrade pip 2>/dev/null || pip install --upgrade pip
|
||||
|
||||
# Core packages
|
||||
pip3 install requests dnspython urllib3 2>/dev/null || pip install requests dnspython urllib3
|
||||
|
||||
# Security tools
|
||||
pip3 install wafw00f 2>/dev/null || echo -e "${YELLOW} [!] wafw00f installation failed, try: pip install wafw00f${NC}"
|
||||
pip3 install paramspider 2>/dev/null || echo -e "${YELLOW} [!] paramspider installation failed${NC}"
|
||||
}
|
||||
|
||||
# Install tool via Go
|
||||
install_go_tool() {
|
||||
local tool_name=$1
|
||||
local repo=$2
|
||||
|
||||
if command_exists "$tool_name"; then
|
||||
echo -e " ${GREEN}[✓]${NC} $tool_name - already installed"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo -e " ${YELLOW}[~]${NC} Installing $tool_name..."
|
||||
go install "$repo@latest" 2>/dev/null
|
||||
|
||||
if command_exists "$tool_name"; then
|
||||
echo -e " ${GREEN}[✓]${NC} $tool_name - installed successfully"
|
||||
else
|
||||
echo -e " ${RED}[✗]${NC} $tool_name - installation failed"
|
||||
fi
|
||||
}
|
||||
|
||||
# Install tool via Cargo (Rust)
|
||||
install_cargo_tool() {
|
||||
local tool_name=$1
|
||||
local crate_name=${2:-$tool_name}
|
||||
|
||||
if command_exists "$tool_name"; then
|
||||
echo -e " ${GREEN}[✓]${NC} $tool_name - already installed"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo -e " ${YELLOW}[~]${NC} Installing $tool_name..."
|
||||
cargo install "$crate_name" 2>/dev/null
|
||||
|
||||
if command_exists "$tool_name"; then
|
||||
echo -e " ${GREEN}[✓]${NC} $tool_name - installed successfully"
|
||||
else
|
||||
echo -e " ${RED}[✗]${NC} $tool_name - installation failed"
|
||||
fi
|
||||
}
|
||||
|
||||
# Install system packages
|
||||
install_system_packages() {
|
||||
echo -e "${BLUE}[*] Installing system packages...${NC}"
|
||||
|
||||
if [ "$OS" == "macos" ]; then
|
||||
brew update
|
||||
brew install nmap curl wget jq git python3 2>/dev/null || true
|
||||
brew install feroxbuster 2>/dev/null || true
|
||||
brew install nikto 2>/dev/null || true
|
||||
brew install whatweb 2>/dev/null || true
|
||||
|
||||
elif [ "$OS" == "debian" ]; then
|
||||
sudo apt update
|
||||
sudo apt install -y nmap curl wget jq git python3 python3-pip dnsutils whois
|
||||
sudo apt install -y nikto whatweb 2>/dev/null || true
|
||||
|
||||
elif [ "$OS" == "redhat" ]; then
|
||||
sudo dnf install -y nmap curl wget jq git python3 python3-pip bind-utils whois
|
||||
|
||||
elif [ "$OS" == "arch" ]; then
|
||||
sudo pacman -Syu --noconfirm nmap curl wget jq git python python-pip dnsutils whois
|
||||
sudo pacman -S --noconfirm nikto whatweb 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
# Install Go-based tools
|
||||
install_go_tools() {
|
||||
echo -e "\n${BLUE}[*] Installing Go-based reconnaissance tools...${NC}"
|
||||
|
||||
# Ensure Go paths are set
|
||||
export GOPATH=${GOPATH:-$HOME/go}
|
||||
export PATH=$PATH:$GOPATH/bin
|
||||
|
||||
# ProjectDiscovery tools
|
||||
install_go_tool "subfinder" "github.com/projectdiscovery/subfinder/v2/cmd/subfinder"
|
||||
install_go_tool "httpx" "github.com/projectdiscovery/httpx/cmd/httpx"
|
||||
install_go_tool "nuclei" "github.com/projectdiscovery/nuclei/v3/cmd/nuclei"
|
||||
install_go_tool "naabu" "github.com/projectdiscovery/naabu/v2/cmd/naabu"
|
||||
install_go_tool "katana" "github.com/projectdiscovery/katana/cmd/katana"
|
||||
install_go_tool "dnsx" "github.com/projectdiscovery/dnsx/cmd/dnsx"
|
||||
install_go_tool "shuffledns" "github.com/projectdiscovery/shuffledns/cmd/shuffledns"
|
||||
|
||||
# Other Go tools
|
||||
install_go_tool "amass" "github.com/owasp-amass/amass/v4/..."
|
||||
install_go_tool "assetfinder" "github.com/tomnomnom/assetfinder"
|
||||
install_go_tool "waybackurls" "github.com/tomnomnom/waybackurls"
|
||||
install_go_tool "gau" "github.com/lc/gau/v2/cmd/gau"
|
||||
install_go_tool "httprobe" "github.com/tomnomnom/httprobe"
|
||||
install_go_tool "ffuf" "github.com/ffuf/ffuf/v2"
|
||||
install_go_tool "gobuster" "github.com/OJ/gobuster/v3"
|
||||
install_go_tool "gospider" "github.com/jaeles-project/gospider"
|
||||
install_go_tool "hakrawler" "github.com/hakluke/hakrawler"
|
||||
install_go_tool "subjack" "github.com/haccer/subjack"
|
||||
install_go_tool "gowitness" "github.com/sensepost/gowitness"
|
||||
install_go_tool "findomain" "github.com/Findomain/Findomain"
|
||||
}
|
||||
|
||||
# Install Rust-based tools
|
||||
install_rust_tools() {
|
||||
echo -e "\n${BLUE}[*] Installing Rust-based tools...${NC}"
|
||||
|
||||
source "$HOME/.cargo/env" 2>/dev/null || true
|
||||
|
||||
install_cargo_tool "rustscan" "rustscan"
|
||||
install_cargo_tool "feroxbuster" "feroxbuster"
|
||||
}
|
||||
|
||||
# Install Nuclei templates
|
||||
install_nuclei_templates() {
|
||||
echo -e "\n${BLUE}[*] Updating Nuclei templates...${NC}"
|
||||
|
||||
if command_exists nuclei; then
|
||||
nuclei -update-templates 2>/dev/null || echo -e "${YELLOW} [!] Template update failed, run manually: nuclei -update-templates${NC}"
|
||||
echo -e " ${GREEN}[✓]${NC} Nuclei templates updated"
|
||||
else
|
||||
echo -e " ${RED}[✗]${NC} Nuclei not installed, skipping templates"
|
||||
fi
|
||||
}
|
||||
|
||||
# Install SecLists
|
||||
install_seclists() {
|
||||
echo -e "\n${BLUE}[*] Checking SecLists...${NC}"
|
||||
|
||||
SECLISTS_PATH="/opt/wordlists/SecLists"
|
||||
|
||||
if [ -d "$SECLISTS_PATH" ]; then
|
||||
echo -e " ${GREEN}[✓]${NC} SecLists already installed at $SECLISTS_PATH"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo -e " ${YELLOW}[~]${NC} Installing SecLists..."
|
||||
sudo mkdir -p /opt/wordlists
|
||||
sudo git clone --depth 1 https://github.com/danielmiessler/SecLists.git "$SECLISTS_PATH" 2>/dev/null || {
|
||||
echo -e " ${RED}[✗]${NC} SecLists installation failed"
|
||||
return 1
|
||||
}
|
||||
|
||||
# Create symlinks for common wordlists
|
||||
sudo ln -sf "$SECLISTS_PATH/Discovery/Web-Content/common.txt" /opt/wordlists/common.txt 2>/dev/null
|
||||
sudo ln -sf "$SECLISTS_PATH/Discovery/Web-Content/raft-medium-directories.txt" /opt/wordlists/directories.txt 2>/dev/null
|
||||
sudo ln -sf "$SECLISTS_PATH/Discovery/DNS/subdomains-top1million-5000.txt" /opt/wordlists/subdomains.txt 2>/dev/null
|
||||
|
||||
echo -e " ${GREEN}[✓]${NC} SecLists installed"
|
||||
}
|
||||
|
||||
# Install additional tools via package managers or manual
|
||||
install_additional_tools() {
|
||||
echo -e "\n${BLUE}[*] Installing additional tools...${NC}"
|
||||
|
||||
# wafw00f
|
||||
if ! command_exists wafw00f; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing wafw00f..."
|
||||
pip3 install wafw00f 2>/dev/null || pip install wafw00f 2>/dev/null
|
||||
fi
|
||||
print_status "wafw00f"
|
||||
|
||||
# paramspider
|
||||
if ! command_exists paramspider; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing paramspider..."
|
||||
pip3 install paramspider 2>/dev/null || {
|
||||
git clone https://github.com/devanshbatham/ParamSpider.git /tmp/paramspider 2>/dev/null
|
||||
cd /tmp/paramspider && pip3 install . 2>/dev/null
|
||||
cd -
|
||||
}
|
||||
fi
|
||||
print_status "paramspider"
|
||||
|
||||
# whatweb
|
||||
if ! command_exists whatweb; then
|
||||
if [ "$OS" == "macos" ]; then
|
||||
brew install whatweb 2>/dev/null
|
||||
elif [ "$OS" == "debian" ]; then
|
||||
sudo apt install -y whatweb 2>/dev/null
|
||||
fi
|
||||
fi
|
||||
print_status "whatweb"
|
||||
|
||||
# nikto
|
||||
if ! command_exists nikto; then
|
||||
if [ "$OS" == "macos" ]; then
|
||||
brew install nikto 2>/dev/null
|
||||
elif [ "$OS" == "debian" ]; then
|
||||
sudo apt install -y nikto 2>/dev/null
|
||||
fi
|
||||
fi
|
||||
print_status "nikto"
|
||||
|
||||
# sqlmap
|
||||
if ! command_exists sqlmap; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing sqlmap..."
|
||||
if [ "$OS" == "macos" ]; then
|
||||
brew install sqlmap 2>/dev/null
|
||||
elif [ "$OS" == "debian" ]; then
|
||||
sudo apt install -y sqlmap 2>/dev/null
|
||||
else
|
||||
pip3 install sqlmap 2>/dev/null
|
||||
fi
|
||||
fi
|
||||
print_status "sqlmap"
|
||||
|
||||
# eyewitness
|
||||
if ! command_exists eyewitness; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing EyeWitness..."
|
||||
git clone https://github.com/RedSiege/EyeWitness.git /opt/EyeWitness 2>/dev/null || true
|
||||
if [ -d "/opt/EyeWitness" ]; then
|
||||
cd /opt/EyeWitness/Python/setup
|
||||
sudo ./setup.sh 2>/dev/null || true
|
||||
sudo ln -sf /opt/EyeWitness/Python/EyeWitness.py /usr/local/bin/eyewitness 2>/dev/null
|
||||
cd -
|
||||
fi
|
||||
fi
|
||||
print_status "eyewitness"
|
||||
|
||||
# wpscan
|
||||
if ! command_exists wpscan; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing wpscan..."
|
||||
if [ "$OS" == "macos" ]; then
|
||||
brew install wpscan 2>/dev/null
|
||||
else
|
||||
sudo gem install wpscan 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
print_status "wpscan"
|
||||
|
||||
# dirsearch
|
||||
if ! command_exists dirsearch; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing dirsearch..."
|
||||
pip3 install dirsearch 2>/dev/null || {
|
||||
git clone https://github.com/maurosoria/dirsearch.git /opt/dirsearch 2>/dev/null
|
||||
sudo ln -sf /opt/dirsearch/dirsearch.py /usr/local/bin/dirsearch 2>/dev/null
|
||||
}
|
||||
fi
|
||||
print_status "dirsearch"
|
||||
|
||||
# massdns (for shuffledns/puredns)
|
||||
if ! command_exists massdns; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing massdns..."
|
||||
git clone https://github.com/blechschmidt/massdns.git /tmp/massdns 2>/dev/null
|
||||
cd /tmp/massdns && make 2>/dev/null && sudo make install 2>/dev/null
|
||||
cd -
|
||||
fi
|
||||
print_status "massdns"
|
||||
|
||||
# puredns
|
||||
if ! command_exists puredns; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing puredns..."
|
||||
go install github.com/d3mondev/puredns/v2@latest 2>/dev/null
|
||||
fi
|
||||
print_status "puredns"
|
||||
|
||||
# waymore
|
||||
if ! command_exists waymore; then
|
||||
echo -e " ${YELLOW}[~]${NC} Installing waymore..."
|
||||
pip3 install waymore 2>/dev/null || pip install waymore 2>/dev/null
|
||||
fi
|
||||
print_status "waymore"
|
||||
}
|
||||
|
||||
# Check all tools status
|
||||
check_tools_status() {
|
||||
echo -e "\n${CYAN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e "${CYAN} TOOLS STATUS SUMMARY ${NC}"
|
||||
echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}\n"
|
||||
|
||||
echo -e "${BLUE}[Subdomain Enumeration]${NC}"
|
||||
print_status "subfinder"
|
||||
print_status "amass"
|
||||
print_status "assetfinder"
|
||||
print_status "findomain"
|
||||
print_status "puredns"
|
||||
print_status "shuffledns"
|
||||
print_status "massdns"
|
||||
|
||||
echo -e "\n${BLUE}[HTTP Probing]${NC}"
|
||||
print_status "httpx"
|
||||
print_status "httprobe"
|
||||
|
||||
echo -e "\n${BLUE}[URL Collection]${NC}"
|
||||
print_status "gau"
|
||||
print_status "waybackurls"
|
||||
print_status "waymore"
|
||||
print_status "hakrawler"
|
||||
|
||||
echo -e "\n${BLUE}[Web Crawling]${NC}"
|
||||
print_status "katana"
|
||||
print_status "gospider"
|
||||
|
||||
echo -e "\n${BLUE}[Directory Bruteforce]${NC}"
|
||||
print_status "feroxbuster"
|
||||
print_status "gobuster"
|
||||
print_status "ffuf"
|
||||
print_status "dirsearch"
|
||||
|
||||
echo -e "\n${BLUE}[Port Scanning]${NC}"
|
||||
print_status "rustscan"
|
||||
print_status "naabu"
|
||||
print_status "nmap"
|
||||
|
||||
echo -e "\n${BLUE}[Vulnerability Scanning]${NC}"
|
||||
print_status "nuclei"
|
||||
print_status "nikto"
|
||||
print_status "sqlmap"
|
||||
print_status "wpscan"
|
||||
|
||||
echo -e "\n${BLUE}[WAF Detection]${NC}"
|
||||
print_status "wafw00f"
|
||||
|
||||
echo -e "\n${BLUE}[Parameter Discovery]${NC}"
|
||||
print_status "paramspider"
|
||||
|
||||
echo -e "\n${BLUE}[Fingerprinting]${NC}"
|
||||
print_status "whatweb"
|
||||
|
||||
echo -e "\n${BLUE}[Screenshot]${NC}"
|
||||
print_status "gowitness"
|
||||
print_status "eyewitness"
|
||||
|
||||
echo -e "\n${BLUE}[Subdomain Takeover]${NC}"
|
||||
print_status "subjack"
|
||||
|
||||
echo -e "\n${BLUE}[DNS Tools]${NC}"
|
||||
print_status "dnsx"
|
||||
print_status "dig"
|
||||
|
||||
echo -e "\n${BLUE}[Utilities]${NC}"
|
||||
print_status "curl"
|
||||
print_status "wget"
|
||||
print_status "jq"
|
||||
print_status "git"
|
||||
|
||||
echo -e "\n${BLUE}[Wordlists]${NC}"
|
||||
if [ -d "/opt/wordlists/SecLists" ]; then
|
||||
echo -e " ${GREEN}[✓]${NC} SecLists - installed at /opt/wordlists/SecLists"
|
||||
else
|
||||
echo -e " ${RED}[✗]${NC} SecLists - not found"
|
||||
fi
|
||||
}
|
||||
|
||||
# Update PATH
|
||||
update_path() {
|
||||
echo -e "\n${BLUE}[*] Updating PATH...${NC}"
|
||||
|
||||
# Add Go bin to PATH
|
||||
if ! grep -q 'GOPATH' ~/.bashrc 2>/dev/null; then
|
||||
echo 'export GOPATH=$HOME/go' >> ~/.bashrc
|
||||
echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bashrc
|
||||
fi
|
||||
|
||||
if ! grep -q 'GOPATH' ~/.zshrc 2>/dev/null; then
|
||||
echo 'export GOPATH=$HOME/go' >> ~/.zshrc 2>/dev/null || true
|
||||
echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.zshrc 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Add Cargo bin to PATH
|
||||
if ! grep -q '.cargo/bin' ~/.bashrc 2>/dev/null; then
|
||||
echo 'export PATH=$PATH:$HOME/.cargo/bin' >> ~/.bashrc
|
||||
fi
|
||||
|
||||
# Source for current session
|
||||
export GOPATH=$HOME/go
|
||||
export PATH=$PATH:$GOPATH/bin:$HOME/.cargo/bin
|
||||
|
||||
echo -e " ${GREEN}[✓]${NC} PATH updated"
|
||||
}
|
||||
|
||||
# Main installation function
|
||||
main() {
|
||||
echo -e "${BLUE}[*] Starting NeuroSploit tools installation...${NC}\n"
|
||||
|
||||
detect_os
|
||||
|
||||
# Parse arguments
|
||||
INSTALL_ALL=false
|
||||
CHECK_ONLY=false
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--all) INSTALL_ALL=true ;;
|
||||
--check) CHECK_ONLY=true ;;
|
||||
--help|-h)
|
||||
echo "Usage: $0 [OPTIONS]"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " --all Install all tools (full installation)"
|
||||
echo " --check Only check tool status, don't install"
|
||||
echo " --help Show this help message"
|
||||
echo ""
|
||||
exit 0
|
||||
;;
|
||||
*) echo "Unknown parameter: $1"; exit 1 ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
if [ "$CHECK_ONLY" = true ]; then
|
||||
check_tools_status
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Installation steps
|
||||
install_system_packages
|
||||
install_go
|
||||
install_rust
|
||||
install_python_packages
|
||||
install_go_tools
|
||||
install_rust_tools
|
||||
install_additional_tools
|
||||
install_seclists
|
||||
install_nuclei_templates
|
||||
update_path
|
||||
|
||||
# Final status check
|
||||
check_tools_status
|
||||
|
||||
echo -e "\n${GREEN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e "${GREEN} INSTALLATION COMPLETE! ${NC}"
|
||||
echo -e "${GREEN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e "\n${YELLOW}[!] Please restart your terminal or run: source ~/.bashrc${NC}"
|
||||
echo -e "${YELLOW}[!] Some tools may require sudo privileges to run${NC}\n"
|
||||
}
|
||||
|
||||
# Run main
|
||||
main "$@"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Legacy (pre-v3.3.0) Python orchestration
|
||||
|
||||
These files are the **previous** orchestration architecture, retired in
|
||||
NeuroSploit v3.3.0 when the pentest agent was re-modeled into an autonomous,
|
||||
markdown-driven engine that delegates execution to a local agentic CLI backend.
|
||||
|
||||
Kept for reference and migration only — **not** used by the v3.3.0 engine.
|
||||
|
||||
| Path | What it was |
|
||||
|------|-------------|
|
||||
| `neurosploit_legacy.py` | The 2,500-line monolithic CLI/orchestrator (`NeuroSploitv2`) |
|
||||
| `agents_python/` | Hand-coded Python agent classes (web/exploitation/lateral/privesc/persistence/recon) |
|
||||
| `custom_agents/` | Example custom Python agent |
|
||||
| `core/` | Old orchestration support (llm_manager, sandbox, report_generator, …) |
|
||||
| `backend_fastapi/` | Old FastAPI backend — replaced by `webgui/server.py` (stdlib) |
|
||||
| `frontend_react/` | Old React/Vite dashboard — replaced by the minimalist `webgui/` |
|
||||
| `test_agent_run.py` | Test harness for the old Python agents |
|
||||
|
||||
## What replaced it
|
||||
|
||||
- **`neurosploit` + `neurosploit_agent/`** — the lean autonomous engine
|
||||
(`orchestrator`, `agent_loader`, `backends`, `rl`, `mcp`, `models`, `cli`).
|
||||
- **`agents_md/`** — 213 curated markdown agents (196 vuln specialists + 17
|
||||
meta-agents) that the engine composes into a master prompt.
|
||||
- The engine runs **Claude Code / Codex / Grok CLI** (or a Claude subscription)
|
||||
as the autonomous runtime, with **Playwright MCP** for browser-based proof and
|
||||
a **reinforcement-learning** loop that adapts agent selection across runs.
|
||||
|
||||
Run `./neurosploit` (interactive) or `./neurosploit run <url>` to use the new engine.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,256 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Exploitation Agent - Vulnerability exploitation and access gaining
|
||||
"""
|
||||
|
||||
import json
|
||||
import logging
|
||||
from typing import Dict, List
|
||||
from core.llm_manager import LLMManager
|
||||
from tools.exploitation import (
|
||||
ExploitDatabase,
|
||||
MetasploitWrapper,
|
||||
WebExploiter,
|
||||
SQLInjector,
|
||||
RCEExploiter,
|
||||
BufferOverflowExploiter
|
||||
)
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class ExploitationAgent:
|
||||
"""Agent responsible for vulnerability exploitation"""
|
||||
|
||||
def __init__(self, config: Dict):
|
||||
"""Initialize exploitation agent"""
|
||||
self.config = config
|
||||
self.llm = LLMManager(config)
|
||||
self.exploit_db = ExploitDatabase(config)
|
||||
self.metasploit = MetasploitWrapper(config)
|
||||
self.web_exploiter = WebExploiter(config)
|
||||
self.sql_injector = SQLInjector(config)
|
||||
self.rce_exploiter = RCEExploiter(config)
|
||||
self.bof_exploiter = BufferOverflowExploiter(config)
|
||||
|
||||
logger.info("ExploitationAgent initialized")
|
||||
|
||||
def execute(self, target: str, context: Dict) -> Dict:
|
||||
"""Execute exploitation phase"""
|
||||
logger.info(f"Starting exploitation on {target}")
|
||||
|
||||
results = {
|
||||
"target": target,
|
||||
"status": "running",
|
||||
"successful_exploits": [],
|
||||
"failed_attempts": [],
|
||||
"shells_obtained": [],
|
||||
"credentials_found": [],
|
||||
"ai_recommendations": {}
|
||||
}
|
||||
|
||||
try:
|
||||
# Get reconnaissance data from context
|
||||
recon_data = context.get("phases", {}).get("recon", {})
|
||||
|
||||
# Phase 1: Vulnerability Analysis
|
||||
logger.info("Phase 1: Analyzing vulnerabilities")
|
||||
vulnerabilities = self._identify_vulnerabilities(recon_data)
|
||||
|
||||
# Phase 2: AI-powered Exploit Selection
|
||||
logger.info("Phase 2: AI exploit selection")
|
||||
exploit_plan = self._ai_exploit_planning(vulnerabilities, recon_data)
|
||||
results["ai_recommendations"] = exploit_plan
|
||||
|
||||
# Phase 3: Execute Exploits
|
||||
logger.info("Phase 3: Executing exploits")
|
||||
for vuln in vulnerabilities[:5]: # Limit to top 5 vulnerabilities
|
||||
exploit_result = self._attempt_exploitation(vuln, target)
|
||||
|
||||
if exploit_result.get("success"):
|
||||
results["successful_exploits"].append(exploit_result)
|
||||
logger.info(f"Successful exploit: {vuln.get('type')}")
|
||||
|
||||
# Check for shell access
|
||||
if exploit_result.get("shell_access"):
|
||||
results["shells_obtained"].append(exploit_result["shell_info"])
|
||||
else:
|
||||
results["failed_attempts"].append(exploit_result)
|
||||
|
||||
# Phase 4: Post-Exploitation Intelligence
|
||||
if results["successful_exploits"]:
|
||||
logger.info("Phase 4: Post-exploitation intelligence gathering")
|
||||
results["post_exploit_intel"] = self._gather_post_exploit_intel(
|
||||
results["successful_exploits"]
|
||||
)
|
||||
|
||||
results["status"] = "completed"
|
||||
logger.info("Exploitation phase completed")
|
||||
|
||||
except Exception as e:
|
||||
logger.error(f"Error during exploitation: {e}")
|
||||
results["status"] = "error"
|
||||
results["error"] = str(e)
|
||||
|
||||
return results
|
||||
|
||||
def _identify_vulnerabilities(self, recon_data: Dict) -> List[Dict]:
|
||||
"""Identify exploitable vulnerabilities from recon data"""
|
||||
vulnerabilities = []
|
||||
|
||||
# Check network scan results
|
||||
network_scan = recon_data.get("network_scan", {})
|
||||
for host, data in network_scan.get("hosts", {}).items():
|
||||
for port in data.get("open_ports", []):
|
||||
vuln = {
|
||||
"type": "network_service",
|
||||
"host": host,
|
||||
"port": port.get("port"),
|
||||
"service": port.get("service"),
|
||||
"version": port.get("version")
|
||||
}
|
||||
vulnerabilities.append(vuln)
|
||||
|
||||
# Check web vulnerabilities
|
||||
web_analysis = recon_data.get("web_analysis", {})
|
||||
for vuln_type in ["sql_injection", "xss", "lfi", "rfi", "rce"]:
|
||||
if web_analysis.get(vuln_type):
|
||||
vulnerabilities.append({
|
||||
"type": vuln_type,
|
||||
"details": web_analysis[vuln_type]
|
||||
})
|
||||
|
||||
return vulnerabilities
|
||||
|
||||
def _ai_exploit_planning(self, vulnerabilities: List[Dict], recon_data: Dict) -> Dict:
|
||||
"""Use AI to plan exploitation strategy"""
|
||||
prompt = self.llm.get_prompt(
|
||||
"exploitation",
|
||||
"ai_exploit_planning_user",
|
||||
default=f"""
|
||||
Plan an exploitation strategy based on the following data:
|
||||
|
||||
Vulnerabilities Identified:
|
||||
{json.dumps(vulnerabilities, indent=2)}
|
||||
|
||||
Reconnaissance Data:
|
||||
{json.dumps(recon_data, indent=2)}
|
||||
|
||||
Provide:
|
||||
1. Prioritized exploitation order
|
||||
2. Recommended exploits for each vulnerability
|
||||
3. Payload suggestions
|
||||
4. Evasion techniques
|
||||
5. Fallback strategies
|
||||
6. Success probability estimates
|
||||
|
||||
Response in JSON format with detailed exploitation roadmap.
|
||||
"""
|
||||
)
|
||||
|
||||
system_prompt = self.llm.get_prompt(
|
||||
"exploitation",
|
||||
"ai_exploit_planning_system",
|
||||
default="""You are an expert exploit developer and penetration tester.
|
||||
Create sophisticated exploitation plans considering detection, success rates, and impact.
|
||||
Prioritize stealthy, reliable exploits over noisy attempts."""
|
||||
)
|
||||
|
||||
try:
|
||||
formatted_prompt = prompt.format(
|
||||
vulnerabilities_json=json.dumps(vulnerabilities, indent=2),
|
||||
recon_data_json=json.dumps(recon_data, indent=2)
|
||||
)
|
||||
response = self.llm.generate(formatted_prompt, system_prompt)
|
||||
return json.loads(response)
|
||||
except Exception as e:
|
||||
logger.error(f"AI exploit planning error: {e}")
|
||||
return {"error": str(e)}
|
||||
|
||||
def _attempt_exploitation(self, vulnerability: Dict, target: str) -> Dict:
|
||||
"""Attempt to exploit a specific vulnerability"""
|
||||
vuln_type = vulnerability.get("type")
|
||||
|
||||
result = {
|
||||
"vulnerability": vulnerability,
|
||||
"success": False,
|
||||
"method": None,
|
||||
"details": {}
|
||||
}
|
||||
|
||||
try:
|
||||
if vuln_type == "sql_injection":
|
||||
result = self.sql_injector.exploit(target, vulnerability)
|
||||
elif vuln_type in ["xss", "csrf"]:
|
||||
result = self.web_exploiter.exploit(target, vulnerability)
|
||||
elif vuln_type in ["rce", "command_injection"]:
|
||||
result = self.rce_exploiter.exploit(target, vulnerability)
|
||||
elif vuln_type == "buffer_overflow":
|
||||
result = self.bof_exploiter.exploit(target, vulnerability)
|
||||
elif vuln_type == "network_service":
|
||||
result = self._exploit_network_service(target, vulnerability)
|
||||
else:
|
||||
# Use Metasploit for generic exploitation
|
||||
result = self.metasploit.exploit(target, vulnerability)
|
||||
|
||||
except Exception as e:
|
||||
logger.error(f"Exploitation error for {vuln_type}: {e}")
|
||||
result["error"] = str(e)
|
||||
|
||||
return result
|
||||
|
||||
def _exploit_network_service(self, target: str, vulnerability: Dict) -> Dict:
|
||||
"""Exploit network service vulnerabilities"""
|
||||
service = vulnerability.get("service", "").lower()
|
||||
|
||||
# Check exploit database for known exploits
|
||||
exploits = self.exploit_db.search(service, vulnerability.get("version"))
|
||||
|
||||
if exploits:
|
||||
logger.info(f"Found {len(exploits)} exploits for {service}")
|
||||
|
||||
for exploit in exploits[:3]: # Try top 3 exploits
|
||||
result = self.metasploit.run_exploit(
|
||||
exploit["module"],
|
||||
target,
|
||||
vulnerability.get("port")
|
||||
)
|
||||
|
||||
if result.get("success"):
|
||||
return result
|
||||
|
||||
return {"success": False, "message": "No suitable exploits found"}
|
||||
|
||||
def _gather_post_exploit_intel(self, successful_exploits: List[Dict]) -> Dict:
|
||||
"""Gather intelligence after successful exploitation"""
|
||||
intel = {
|
||||
"system_info": [],
|
||||
"user_accounts": [],
|
||||
"network_info": [],
|
||||
"installed_software": [],
|
||||
"credentials": []
|
||||
}
|
||||
|
||||
for exploit in successful_exploits:
|
||||
if exploit.get("shell_access"):
|
||||
shell = exploit["shell_info"]
|
||||
|
||||
# Gather system information
|
||||
# This would execute actual commands on compromised system
|
||||
# Placeholder for demonstration
|
||||
intel["system_info"].append({
|
||||
"os": "detected_os",
|
||||
"hostname": "detected_hostname",
|
||||
"architecture": "x64"
|
||||
})
|
||||
|
||||
return intel
|
||||
|
||||
def generate_custom_exploit(self, vulnerability: Dict) -> str:
|
||||
"""Generate custom exploit using AI"""
|
||||
target_info = {
|
||||
"vulnerability": vulnerability,
|
||||
"requirements": "Create working exploit code"
|
||||
}
|
||||
|
||||
return self.llm.generate_payload(target_info, vulnerability.get("type"))
|
||||
@@ -1,199 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Lateral Movement Agent - Move through the network
|
||||
"""
|
||||
|
||||
import json
|
||||
import logging
|
||||
from typing import Dict, List
|
||||
from core.llm_manager import LLMManager
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class LateralMovementAgent:
|
||||
"""Agent responsible for lateral movement"""
|
||||
|
||||
def __init__(self, config: Dict):
|
||||
"""Initialize lateral movement agent"""
|
||||
self.config = config
|
||||
self.llm = LLMManager(config)
|
||||
logger.info("LateralMovementAgent initialized")
|
||||
|
||||
def execute(self, target: str, context: Dict) -> Dict:
|
||||
"""Execute lateral movement phase"""
|
||||
logger.info(f"Starting lateral movement from {target}")
|
||||
|
||||
results = {
|
||||
"target": target,
|
||||
"status": "running",
|
||||
"discovered_hosts": [],
|
||||
"compromised_hosts": [],
|
||||
"credentials_used": [],
|
||||
"movement_paths": [],
|
||||
"ai_analysis": {}
|
||||
}
|
||||
|
||||
try:
|
||||
# Get previous phase data
|
||||
recon_data = context.get("phases", {}).get("recon", {})
|
||||
privesc_data = context.get("phases", {}).get("privilege_escalation", {})
|
||||
|
||||
# Phase 1: Network Discovery
|
||||
logger.info("Phase 1: Internal network discovery")
|
||||
results["discovered_hosts"] = self._discover_internal_network(recon_data)
|
||||
|
||||
# Phase 2: AI-Powered Movement Strategy
|
||||
logger.info("Phase 2: AI lateral movement strategy")
|
||||
strategy = self._ai_movement_strategy(context, results["discovered_hosts"])
|
||||
results["ai_analysis"] = strategy
|
||||
|
||||
# Phase 3: Credential Reuse
|
||||
logger.info("Phase 3: Credential reuse attacks")
|
||||
credentials = privesc_data.get("credentials_harvested", [])
|
||||
results["credentials_used"] = self._attempt_credential_reuse(
|
||||
results["discovered_hosts"],
|
||||
credentials
|
||||
)
|
||||
|
||||
# Phase 4: Pass-the-Hash/Pass-the-Ticket
|
||||
logger.info("Phase 4: Pass-the-Hash/Ticket attacks")
|
||||
results["movement_paths"].extend(
|
||||
self._pass_the_hash_attacks(results["discovered_hosts"])
|
||||
)
|
||||
|
||||
# Phase 5: Exploit Trust Relationships
|
||||
logger.info("Phase 5: Exploiting trust relationships")
|
||||
results["movement_paths"].extend(
|
||||
self._exploit_trust_relationships(results["discovered_hosts"])
|
||||
)
|
||||
|
||||
results["status"] = "completed"
|
||||
logger.info("Lateral movement phase completed")
|
||||
|
||||
except Exception as e:
|
||||
logger.error(f"Error during lateral movement: {e}")
|
||||
results["status"] = "error"
|
||||
results["error"] = str(e)
|
||||
|
||||
return results
|
||||
|
||||
def _discover_internal_network(self, recon_data: Dict) -> List[Dict]:
|
||||
"""Discover internal network hosts"""
|
||||
hosts = []
|
||||
|
||||
# Extract hosts from recon data
|
||||
network_scan = recon_data.get("network_scan", {})
|
||||
for ip, data in network_scan.get("hosts", {}).items():
|
||||
hosts.append({
|
||||
"ip": ip,
|
||||
"ports": data.get("open_ports", []),
|
||||
"os": data.get("os", "unknown")
|
||||
})
|
||||
|
||||
# Simulate additional internal discovery
|
||||
hosts.extend([
|
||||
{"ip": "192.168.1.10", "role": "domain_controller", "status": "discovered"},
|
||||
{"ip": "192.168.1.20", "role": "file_server", "status": "discovered"},
|
||||
{"ip": "192.168.1.30", "role": "workstation", "status": "discovered"}
|
||||
])
|
||||
|
||||
return hosts
|
||||
|
||||
def _ai_movement_strategy(self, context: Dict, hosts: List[Dict]) -> Dict:
|
||||
"""Use AI to plan lateral movement"""
|
||||
prompt = self.llm.get_prompt(
|
||||
"lateral_movement",
|
||||
"ai_movement_strategy_user",
|
||||
default=f"""
|
||||
Plan a lateral movement strategy based on the following:
|
||||
|
||||
Current Context:
|
||||
{json.dumps(context, indent=2)}
|
||||
|
||||
Discovered Hosts:
|
||||
{json.dumps(hosts, indent=2)}
|
||||
|
||||
Provide:
|
||||
1. Target prioritization (high-value targets first)
|
||||
2. Movement techniques for each target
|
||||
3. Credential strategies
|
||||
4. Evasion techniques
|
||||
5. Attack path optimization
|
||||
6. Fallback options
|
||||
|
||||
Response in JSON format with detailed attack paths.
|
||||
"""
|
||||
)
|
||||
|
||||
system_prompt = self.llm.get_prompt(
|
||||
"lateral_movement",
|
||||
"ai_movement_strategy_system",
|
||||
default="""You are an expert in lateral movement and Active Directory attacks.
|
||||
Plan sophisticated movement strategies that minimize detection and maximize impact.
|
||||
Consider Pass-the-Hash, Pass-the-Ticket, RDP, WMI, PSExec, and other techniques.
|
||||
Prioritize domain controllers and critical infrastructure."""
|
||||
)
|
||||
|
||||
try:
|
||||
formatted_prompt = prompt.format(
|
||||
context_json=json.dumps(context, indent=2),
|
||||
hosts_json=json.dumps(hosts, indent=2)
|
||||
)
|
||||
response = self.llm.generate(formatted_prompt, system_prompt)
|
||||
return json.loads(response)
|
||||
except Exception as e:
|
||||
logger.error(f"AI movement strategy error: {e}")
|
||||
return {"error": str(e)}
|
||||
|
||||
def _attempt_credential_reuse(self, hosts: List[Dict], credentials: List[Dict]) -> List[Dict]:
|
||||
"""Attempt credential reuse across hosts"""
|
||||
attempts = []
|
||||
|
||||
for host in hosts[:5]: # Limit attempts
|
||||
for cred in credentials[:3]:
|
||||
attempts.append({
|
||||
"host": host.get("ip"),
|
||||
"credential": "***hidden***",
|
||||
"protocol": "SMB",
|
||||
"success": False, # Simulated
|
||||
"status": "simulated"
|
||||
})
|
||||
|
||||
return attempts
|
||||
|
||||
def _pass_the_hash_attacks(self, hosts: List[Dict]) -> List[Dict]:
|
||||
"""Perform Pass-the-Hash attacks"""
|
||||
attacks = []
|
||||
|
||||
for host in hosts:
|
||||
if host.get("role") in ["domain_controller", "file_server"]:
|
||||
attacks.append({
|
||||
"type": "pass_the_hash",
|
||||
"target": host.get("ip"),
|
||||
"technique": "SMB relay",
|
||||
"success": False, # Simulated
|
||||
"status": "simulated"
|
||||
})
|
||||
|
||||
return attacks
|
||||
|
||||
def _exploit_trust_relationships(self, hosts: List[Dict]) -> List[Dict]:
|
||||
"""Exploit trust relationships"""
|
||||
exploits = []
|
||||
|
||||
# Domain trust exploitation
|
||||
exploits.append({
|
||||
"type": "domain_trust",
|
||||
"description": "Cross-domain exploitation",
|
||||
"status": "simulated"
|
||||
})
|
||||
|
||||
# Kerberos delegation
|
||||
exploits.append({
|
||||
"type": "kerberos_delegation",
|
||||
"description": "Unconstrained delegation abuse",
|
||||
"status": "simulated"
|
||||
})
|
||||
|
||||
return exploits
|
||||
@@ -1,148 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Network Reconnaissance Agent - Network-focused information gathering and enumeration
|
||||
"""
|
||||
|
||||
import os
|
||||
import json
|
||||
import subprocess
|
||||
from typing import Dict, List
|
||||
import logging
|
||||
from core.llm_manager import LLMManager
|
||||
from tools.recon import (
|
||||
NetworkScanner,
|
||||
OSINTCollector,
|
||||
DNSEnumerator,
|
||||
SubdomainFinder
|
||||
)
|
||||
from urllib.parse import urlparse # Added import
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class NetworkReconAgent:
|
||||
"""Agent responsible for network-focused reconnaissance and information gathering"""
|
||||
|
||||
def __init__(self, config: Dict):
|
||||
"""Initialize network reconnaissance agent"""
|
||||
self.config = config
|
||||
self.llm = LLMManager(config)
|
||||
self.network_scanner = NetworkScanner(config)
|
||||
self.osint = OSINTCollector(config)
|
||||
self.dns_enum = DNSEnumerator(config)
|
||||
self.subdomain_finder = SubdomainFinder(config)
|
||||
|
||||
logger.info("NetworkReconAgent initialized")
|
||||
|
||||
def execute(self, target: str, context: Dict) -> Dict:
|
||||
"""Execute network reconnaissance phase"""
|
||||
logger.info(f"Starting network reconnaissance on {target}")
|
||||
|
||||
results = {
|
||||
"target": target,
|
||||
"status": "running",
|
||||
"findings": [],
|
||||
"network_scan": {},
|
||||
"osint": {},
|
||||
"dns": {},
|
||||
"subdomains": [],
|
||||
"ai_analysis": {}
|
||||
}
|
||||
|
||||
# Parse target to extract hostname if it's a URL
|
||||
parsed_target = urlparse(target)
|
||||
target_host = parsed_target.hostname or target # Use hostname if exists, otherwise original target
|
||||
logger.info(f"Target for network tools: {target_host}")
|
||||
|
||||
try:
|
||||
# Phase 1: Network Scanning
|
||||
logger.info("Phase 1: Network scanning")
|
||||
results["network_scan"] = self.network_scanner.scan(target_host) # Use target_host
|
||||
|
||||
# Phase 2: DNS Enumeration
|
||||
logger.info("Phase 2: DNS enumeration")
|
||||
results["dns"] = self.dns_enum.enumerate(target_host) # Use target_host
|
||||
|
||||
# Phase 3: Subdomain Discovery
|
||||
logger.info("Phase 3: Subdomain discovery")
|
||||
results["subdomains"] = self.subdomain_finder.find(target_host) # Use target_host
|
||||
|
||||
# Phase 4: OSINT Collection
|
||||
logger.info("Phase 4: OSINT collection")
|
||||
results["osint"] = self.osint.collect(target_host) # Use target_host
|
||||
|
||||
# Phase 5: AI Analysis
|
||||
logger.info("Phase 5: AI-powered analysis")
|
||||
results["ai_analysis"] = self._ai_analysis(results)
|
||||
|
||||
results["status"] = "completed"
|
||||
logger.info("Network reconnaissance phase completed")
|
||||
|
||||
except Exception as e:
|
||||
logger.error(f"Error during network reconnaissance: {e}")
|
||||
results["status"] = "error"
|
||||
results["error"] = str(e)
|
||||
|
||||
return results
|
||||
|
||||
def _ai_analysis(self, recon_data: Dict) -> Dict:
|
||||
"""Use AI to analyze reconnaissance data"""
|
||||
prompt = self.llm.get_prompt(
|
||||
"network_recon",
|
||||
"ai_analysis_user",
|
||||
default=f"""
|
||||
Analyze the following network reconnaissance data and provide insights:
|
||||
|
||||
{json.dumps(recon_data, indent=2)}
|
||||
|
||||
Provide:
|
||||
1. Attack surface summary
|
||||
2. Prioritized network target list
|
||||
3. Identified network vulnerabilities or misconfigurations
|
||||
4. Recommended next steps for network exploitation
|
||||
5. Network risk assessment
|
||||
6. Stealth considerations for network activities
|
||||
|
||||
Response in JSON format with actionable recommendations.
|
||||
"""
|
||||
)
|
||||
|
||||
system_prompt = self.llm.get_prompt(
|
||||
"network_recon",
|
||||
"ai_analysis_system",
|
||||
default="""You are an expert network penetration tester analyzing reconnaissance data.
|
||||
Identify network security weaknesses, network attack vectors, and provide strategic recommendations.
|
||||
Consider both technical and operational security aspects."""
|
||||
)
|
||||
|
||||
try:
|
||||
# Format the user prompt with recon_data
|
||||
formatted_prompt = prompt.format(recon_data_json=json.dumps(recon_data, indent=2))
|
||||
response = self.llm.generate(formatted_prompt, system_prompt)
|
||||
return json.loads(response)
|
||||
except Exception as e:
|
||||
logger.error(f"AI analysis error: {e}")
|
||||
return {"error": str(e), "raw_response": response if 'response' in locals() else None}
|
||||
|
||||
def passive_recon(self, target: str) -> Dict:
|
||||
"""Perform passive reconnaissance only"""
|
||||
# Parse target to extract hostname if it's a URL
|
||||
parsed_target = urlparse(target)
|
||||
target_host = parsed_target.hostname or target
|
||||
|
||||
return {
|
||||
"osint": self.osint.collect(target_host), # Use target_host
|
||||
"dns": self.dns_enum.enumerate(target_host), # Use target_host
|
||||
"subdomains": self.subdomain_finder.find(target_host) # Use target_host
|
||||
}
|
||||
|
||||
def active_recon(self, target: str) -> Dict:
|
||||
"""Perform active reconnaissance"""
|
||||
# Parse target to extract hostname if it's a URL
|
||||
parsed_target = urlparse(target)
|
||||
target_host = parsed_target.hostname or target
|
||||
|
||||
return {
|
||||
"network_scan": self.network_scanner.scan(target_host) # Use target_host
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user