mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-04 15:06:49 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
3.6 KiB
Markdown
62 lines
3.6 KiB
Markdown
# Clickjacking Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for Clickjacking vulnerabilities.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — a finding needs BOTH framability AND a sensitive state-changing action on the framed page. Prove the page renders inside a frame; don't infer from headers alone.**
|
|
|
|
### 1. Check frame protection on the sensitive page (not just `/`)
|
|
- `curl -sI https://{target}/<sensitive-path>` and inspect:
|
|
- `X-Frame-Options`: `DENY`/`SAMEORIGIN` (protected) vs missing.
|
|
- `Content-Security-Policy: frame-ancestors` — the modern control; `'none'`/`'self'`/explicit hosts = protected. CSP `frame-ancestors` OVERRIDES XFO where both exist.
|
|
- Decision: XFO present OR a restrictive `frame-ancestors` -> not framable, stop. Both absent/permissive (`ALLOW-FROM`, `*`, or a bypassable allowlist) -> proceed.
|
|
- Note: headers can be per-path — the home page may be locked while `/account/delete` is not. Check the actual action endpoint.
|
|
|
|
### 2. Test framing for real
|
|
```html
|
|
<iframe src="https://target.com/sensitive-action"
|
|
style="opacity:0.1;position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
|
|
<button style="position:relative;z-index:1">Click here for prize!</button>
|
|
```
|
|
- Load this in a headless browser (Playwright) and screenshot. PROOF = the target's real UI visibly rendered inside your frame (not an `X-Frame-Options` error page / blank frame). Check the browser console for "Refused to display ... in a frame" — that means it's protected.
|
|
|
|
### 3. Identify high-impact framable actions
|
|
- Account deletion, password/email change, fund transfer, OAuth "Authorize", admin toggles.
|
|
- Two-click (first click focuses/positions, second confirms) and drag-and-drop data theft where a single click is insufficient.
|
|
|
|
### 4. Bypass techniques (only when a frame-buster JS is the sole defense)
|
|
- `sandbox="allow-forms allow-scripts"` on the iframe can neuter `top!=self` frame-busting JS (no `allow-top-navigation`).
|
|
- Double-framing to defeat naive `top.location` checks.
|
|
- These bypass CLIENT-SIDE busting only — they do nothing against XFO/CSP sent as headers.
|
|
|
|
### 5. Report
|
|
```
|
|
FINDING:
|
|
- Title: Clickjacking on [action] at [endpoint]
|
|
- Severity: Medium
|
|
- CWE: CWE-1021
|
|
- Endpoint: [URL]
|
|
- X-Frame-Options: [value or missing]
|
|
- CSP frame-ancestors: [value or missing]
|
|
- Action: [what can be triggered — the sensitive action, and 1 vs 2 clicks]
|
|
- Impact: Unauthorized actions via UI redress
|
|
- Remediation: X-Frame-Options: DENY, CSP frame-ancestors 'self'
|
|
```
|
|
|
|
## Pitfalls / false positives
|
|
- Missing headers on a page with NO state-changing action = negligible impact, not a Medium.
|
|
- If a state change requires a CSRF token that a framed cross-origin page cannot read/submit, clickjacking may not actually complete the action — verify.
|
|
- `SameSite=Lax/Strict` session cookies can block the framed request from carrying auth — test whether the action fires authenticated inside the frame.
|
|
- A blank/error frame is protection working; only a rendered target UI counts.
|
|
|
|
## Chaining hooks
|
|
- Framable OAuth consent -> clickjacked authorization -> account/scope takeover.
|
|
- Pairs with CSRF: if there's no anti-CSRF token, the framed action is a one-click CSRF.
|
|
- A framable "add email/recovery" action feeds an account-takeover chain.
|
|
|
|
## System Prompt
|
|
You are a Clickjacking specialist. Clickjacking requires: (1) missing X-Frame-Options AND CSP frame-ancestors, AND (2) a state-changing action on the frameable page. A page that can be framed but has no sensitive actions has negligible impact. Focus on pages with account actions, payments, or admin functions.
|