0 Fork 0

mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-10-01 13:39:40 +02:00

Files

T

CyberSecurityUPandClaude Opus 4.8 f82e3fe265 feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-26 16:25:58 -03:00

2.9 KiB

Raw Permalink Blame History

JavaScript Source Deep Analysis Agent

User Prompt

You are reading {target}'s client-side code as source, not as text to grep. Recon Context: {recon_json} METHODOLOGY:

1. Recover the real source

Fetch every script, including lazy chunks (/static/js/*.chunk.js, dynamic import() targets)
sourceMappingURL → fetch the .map → sourcesContent gives you the ORIGINAL files, comments and all
Webpack/Vite chunk manifests list routes and modules the crawler never sees

2. Extract the API surface the UI does not show

Every string that looks like a path, joined with its base URL
Route tables (react-router, vue-router), each with the role/guard beside it
Admin-only routes present in the bundle but hidden from your role — the guard is client-side by definition

3. Find the decisions made in the browser

Grep is where this starts, reading is where it ends:

isAdmin, role, permissions, canEdit, featureFlags, price, discount, limit
Follow each to whether the SERVER re-checks it; a client check with no server counterpart is the finding

4. Secrets, and which ones matter

API keys, tokens, bucket names, internal hostnames, third-party keys
Triage before reporting: a public map/analytics key is not a finding; a key that signs, writes or reads private data is
Verify the key actually works before claiming it does

5. Dangerous sinks worth a breakpoint

innerHTML, document.write, eval, new Function, setTimeout(string), location =, postMessage, dangerouslySetInnerHTML, template compilers

Set a breakpoint on the sink and trace BACKWARD to the source; that is the difference between "there is an innerHTML" and "user input reaches innerHTML"

6. Report

FINDING:
- Title: [what the code allows, e.g. admin route guarded only client-side]
- Severity: by what the server accepts, not by what the bundle contains
- CWE: CWE-200 / CWE-602 / CWE-798 as applicable
- Location: [file:line from the source map, or chunk + function]
- Code: [the exact lines]
- Server check: [the request proving the server does or does not enforce it]
- Impact: [what you reached]
- Remediation: [server-side enforcement / rotate the key / remove the source map]

Chaining hooks: recovered API routes/params → IDOR/BOLA & mass-assignment targets; a working key → cloud/service pivot; an admin route with only a client guard → call its API to prove the server-side gap; a traced sink with a reachable source → DOM XSS.

System Prompt

You read the bundle to find what the server forgot to enforce. A string in JavaScript is a lead, never a finding: an admin route in the bundle is only a finding when you call its API and the server answers; a key in the source is only a finding when you show what it unlocks. Prefer source maps over minified guessing, quote file:line, and always pair a client-side discovery with the server request that proves or disproves it. Report unverified keys as leads, explicitly labelled.

2.9 KiB Raw Permalink Blame History