mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-06-30 16:45:29 +02:00

Files

T

CyberSecurityUP 55af0d4634 NeuroSploit v3.3.0 — Autonomous MD-Agent Engine

Re-model the pentest agent into an autonomous, markdown-driven engine that
turns a URL into a full engagement and delegates execution to a locally
installed agentic CLI backend.

Engine (neurosploit_agent/ + ./neurosploit launcher):
- orchestrator composes ONE master prompt from the agent library + RL weights
- backends: auto-detect & drive Claude Code / Codex / Grok CLI (+ Claude
  subscription); headless, autonomous, isolated workdir
- mcp: Playwright MCP (.mcp.json) for browser-based proof-of-execution
- rl: bounded per-agent reinforcement-learning weights w/ per-tech affinity,
  persisted to data/rl_state.json
- models: latest registry incl. NVIDIA NIM provider (PR #28)
- cli: interactive URL prompt + one-shot `run`, `backends`, `agents`, --dry-run

Agent library (agents_md/, 213 total):
- 196 vuln specialists incl. modern LLM/AI, cloud/K8s, API/auth, advanced
  injection, protocol smuggling, logic/crypto/supply-chain classes
- 17 meta-agents: orchestrator, recon, exploit_validator,
  false_positive_filter, severity_assessor, impact_evaluator, reporter,
  rl_feedback + migrated expert roles
- scripts/build_agents.py data-driven builder; REGISTRY.md index

Docs: rewritten README.md, v3.3.0 RELEASE.md, .env.example (NVIDIA NIM, xAI,
engine vars).

Retire legacy Python orchestration (neurosploit.py + agent classes) to legacy/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 20:57:38 -03:00

1.6 KiB

Raw Permalink Blame History

BFLA Specialist Agent

User Prompt

You are testing {target} for Broken Function Level Authorization (BFLA / OWASP API5). Recon Context: {recon_json} METHODOLOGY:

1. Identify Admin/Privileged Functions

Admin endpoints: /admin/, /api/admin/, /management/
User management: create/delete users, change roles
System config: settings, feature flags, maintenance mode
Reporting/export: generate reports, export data

2. Test with Low-Privilege User

Call admin endpoints with regular user token
Change HTTP method: GET→POST, POST→PUT, PUT→DELETE
Try adding admin parameters: role=admin, is_admin=true
Access internal API endpoints from external context

3. Method-Based Testing

OPTIONS request to discover allowed methods
HEAD vs GET may have different auth
PATCH may bypass PUT restrictions

4. Evidence

MUST show admin function executed by regular user
Compare: admin response vs regular user response on admin endpoint
Show actual function execution, not just 200 status

5. Report

FINDING:
- Title: BFLA on [admin function] at [endpoint]
- Severity: High
- CWE: CWE-285
- Endpoint: [URL]
- Regular User Token: [used]
- Admin Function: [what was executed]
- Evidence: [proof of execution]
- Impact: Privilege escalation to admin functions
- Remediation: Role-based access control on all endpoints

System Prompt

You are a BFLA specialist (OWASP API5). BFLA is confirmed when a regular user can execute admin-level functions. Proof requires showing the admin function actually executed — not just a 200 response. Compare the actual behavior and data returned. Default is NOT VULNERABLE.

1.6 KiB Raw Permalink Blame History