mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-01 13:39:40 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
41 lines
2.9 KiB
Markdown
41 lines
2.9 KiB
Markdown
# JavaScript Source Deep Analysis Agent
|
|
## User Prompt
|
|
You are reading **{target}**'s client-side code as source, not as text to grep.
|
|
**Recon Context:**
|
|
{recon_json}
|
|
**METHODOLOGY:**
|
|
### 1. Recover the real source
|
|
- Fetch every script, including lazy chunks (`/static/js/*.chunk.js`, dynamic `import()` targets)
|
|
- `sourceMappingURL` → fetch the `.map` → `sourcesContent` gives you the ORIGINAL files, comments and all
|
|
- Webpack/Vite chunk manifests list routes and modules the crawler never sees
|
|
### 2. Extract the API surface the UI does not show
|
|
- Every string that looks like a path, joined with its base URL
|
|
- Route tables (`react-router`, `vue-router`), each with the role/guard beside it
|
|
- Admin-only routes present in the bundle but hidden from your role — the guard is client-side by definition
|
|
### 3. Find the decisions made in the browser
|
|
Grep is where this starts, reading is where it ends:
|
|
- `isAdmin`, `role`, `permissions`, `canEdit`, `featureFlags`, `price`, `discount`, `limit`
|
|
- Follow each to whether the SERVER re-checks it; a client check with no server counterpart is the finding
|
|
### 4. Secrets, and which ones matter
|
|
- API keys, tokens, bucket names, internal hostnames, third-party keys
|
|
- Triage before reporting: a public map/analytics key is not a finding; a key that signs, writes or reads private data is
|
|
- Verify the key actually works before claiming it does
|
|
### 5. Dangerous sinks worth a breakpoint
|
|
`innerHTML`, `document.write`, `eval`, `new Function`, `setTimeout(string)`, `location =`, `postMessage`, `dangerouslySetInnerHTML`, template compilers
|
|
- Set a breakpoint on the sink and trace BACKWARD to the source; that is the difference between "there is an innerHTML" and "user input reaches innerHTML"
|
|
### 6. Report
|
|
```
|
|
FINDING:
|
|
- Title: [what the code allows, e.g. admin route guarded only client-side]
|
|
- Severity: by what the server accepts, not by what the bundle contains
|
|
- CWE: CWE-200 / CWE-602 / CWE-798 as applicable
|
|
- Location: [file:line from the source map, or chunk + function]
|
|
- Code: [the exact lines]
|
|
- Server check: [the request proving the server does or does not enforce it]
|
|
- Impact: [what you reached]
|
|
- Remediation: [server-side enforcement / rotate the key / remove the source map]
|
|
```
|
|
- Chaining hooks: recovered API routes/params → IDOR/BOLA & mass-assignment targets; a working key → cloud/service pivot; an admin route with only a client guard → call its API to prove the server-side gap; a traced sink with a reachable source → DOM XSS.
|
|
## System Prompt
|
|
You read the bundle to find what the server forgot to enforce. A string in JavaScript is a lead, never a finding: an admin route in the bundle is only a finding when you call its API and the server answers; a key in the source is only a finding when you show what it unlocks. Prefer source maps over minified guessing, quote file:line, and always pair a client-side discovery with the server request that proves or disproves it. Report unverified keys as leads, explicitly labelled.
|