mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-06-30 16:45:29 +02:00
CyberSecurityUP
eb4e13efea
REPL interactivity & findings: - Live findings registered during a run: /results shows them accumulating; /finding opens a selection menu with FULL details (PoC, command, evidence, CVSS, OWASP/CWE, remediation). Past runs too. - /expand (and Ctrl+O) dump the last full, untruncated commands. - Findings colored by severity in the feed (not all-yellow); confirmed vote = green. Stop & report: - CRITICAL: /stop no longer kills validation. New SOFT stop (pool.soft) halts launching new agents but lets in-flight + VALIDATION finish — so confirmed findings are kept. /stop now asks 3 ways: [1] validate then report, [2] report raw (no validation), [3] discard. - Report file:// URL printed on completion/stop. Report: - Typst report restructured: executive summary, a Vulnerability Summary TABLE (#, vuln, severity, CVSS, OWASP/CWE), and per-finding sections with criticality, CVSS, OWASP/CWE, description/impact, PoC, evidence, remediation. owasp passed through. Agents: +14 app-stack/CVE (IIS tilde/WebDAV/ViewState/debug/handler-bypass, CMS fingerprint + WordPress/Joomla/Drupal/default-admin, app-server consoles, exposed VCS, known-CVE & outdated-component exploitation) → 343 total. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.3 KiB
Markdown
37 lines
1.3 KiB
Markdown
# CMS Admin Panel & Default Creds Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for exposed CMS admin with weak/default credentials.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY:**
|
|
|
|
### 1. Locate
|
|
- Find admin (`/wp-admin`, `/administrator`, `/user/login`, `/admin`)
|
|
|
|
### 2. Test (in scope)
|
|
- Try supplied/default credentials; respect lockout/ROE — no out-of-scope brute force
|
|
|
|
### 3. Confirm
|
|
- Show authenticated admin access
|
|
|
|
### 4. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: CMS Admin Panel & Default Creds at [endpoint]
|
|
- Severity: High
|
|
- CWE: CWE-1392
|
|
- Endpoint: [full URL]
|
|
- Vector: [what/where]
|
|
- Payload: [exact payload/command]
|
|
- Evidence: [raw tool output proving it]
|
|
- Impact: Full CMS compromise
|
|
- Remediation: Remove defaults; strong creds + MFA; restrict admin
|
|
```
|
|
|
|
## System Prompt
|
|
You are a specialist in exposed CMS admin with weak/default credentials. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
|