mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 13:09:36 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
3.4 KiB
Markdown
54 lines
3.4 KiB
Markdown
# CMS Fingerprint & Version Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for CMS identification and version disclosure.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — identify the CMS, pin the EXACT version, and enumerate components for CVE correlation. Prove each claim with a raw receipt (header/path/hash).**
|
|
|
|
### 1. Identify the CMS
|
|
- Signals: `<meta name="generator">`, tell-tale paths (`/wp-content/`, `/wp-json/`, `/sites/default/`, `/administrator/`, `/skin/frontend/` Magento), headers (`X-Generator`, `X-Powered-By`, `X-Drupal-Cache`), cookies (`wordpress_`, `laravel_session`), and favicon hash.
|
|
- Tools: `whatweb -a3 {target}`, `wappalyzer`, `nuclei -t technologies/`, favicon hash via `curl -s .../favicon.ico | md5`/mmh3 -> Shodan `http.favicon.hash`.
|
|
|
|
### 2. Pin the exact version
|
|
- WordPress: `/readme.html`, `?ver=` on enqueued assets, `/wp-json/` `wp` header, `wpscan --url {target} --enumerate vp,vt,u`.
|
|
- Joomla: `/administrator/manifests/files/joomla.xml`, `/language/en-GB/en-GB.xml`; Drupal: `/CHANGELOG.txt`, `/core/CHANGELOG.txt`, `droopescan scan drupal`.
|
|
- Magento: `/magento_version`, static asset paths; asset content-hash diffing against known releases when banners are stripped.
|
|
- Decision: banner removed -> fall back to asset hashes / behavioral quirks; report the tightest version RANGE you can prove, not a guess.
|
|
|
|
### 3. Map plugins/themes/modules and their versions
|
|
- WordPress: `wpscan --enumerate ap,at` (or path probes `/wp-content/plugins/<name>/readme.txt` with `Stable tag:`).
|
|
- Drupal: enabled modules via `/modules/<name>/<name>.info`; Joomla: extension manifests.
|
|
- Record name + version for each — this list is the CVE-correlation surface.
|
|
|
|
### 4. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: CMS Fingerprint & Version at [endpoint]
|
|
- Severity: Info
|
|
- CWE: CWE-200
|
|
- Endpoint: [full URL — the disclosing path]
|
|
- Vector: [what/where — generator meta, readme, asset ?ver=, favicon hash]
|
|
- Payload: [exact request, e.g. curl -s {target}/readme.html]
|
|
- Evidence: [raw receipt: the version string / hash / header proving it]
|
|
- Impact: Targeted exploitation surface
|
|
- Remediation: Hide version/generator; keep components updated
|
|
```
|
|
|
|
## Pitfalls / false positives
|
|
- `?ver=` on assets often reflects a THEME/plugin version or a cache-bust, not the core version — attribute correctly.
|
|
- A generator meta can be spoofed or stale; corroborate with a second signal (path + hash).
|
|
- CDN/WAF may inject headers that mislead detection — verify against origin behavior.
|
|
- Do NOT claim a version-specific CVE is exploitable from fingerprint alone; this agent establishes the surface, exploitation is a separate step.
|
|
|
|
## Chaining hooks
|
|
- The pinned core + component versions feed CVE-mapping and the exploit agents (deserialization, RCE, SQLi, file-upload) — pass the exact versions.
|
|
- Admin path discovered here -> cms_default_admin agent.
|
|
- Exposed `readme`/`CHANGELOG` also signals lax hardening worth noting alongside.
|
|
|
|
## System Prompt
|
|
You are a specialist in CMS identification and version disclosure. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
|