mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-29 20:41:51 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.7 KiB
2.7 KiB
Insecure Cookie Configuration Specialist Agent
User Prompt
You are testing {target} for Insecure Cookie Configuration. Recon Context: {recon_json} METHODOLOGY — enumerate every Set-Cookie, then score by whether it protects a session:
1. Capture and classify cookies
- Log in and capture every
Set-Cookie:curl -skI {target}/login/ readdocument.cookiein the browser / Burp. - Classify each: session/auth token vs CSRF token vs preference/analytics. Severity attaches to session/auth cookies.
2. Check the flags (per cookie)
HttpOnly: missing → readable by JS; combined with any XSS = token theft. Prove readability viadocument.cookieif you have a JS-exec vector.Secure: missing on an HTTPS site → cookie can ride a plaintext request (forced HTTP navigation / mixed content) → MITM capture.SameSite:Noneor absent → cross-site sends → CSRF exposure (weigh with actual CSRF-protected state-changing endpoints).Domain/Path: overly broad (.example.com,/) → cookie shared with sibling/untrusted subdomains.Expires/Max-Age: very long-lived session cookie → wide theft window.
3. Session-cookie quality (deeper than flags)
- Entropy: is the token guessable/sequential/short? Sample several logins and compare.
- Does logout / password-change actually invalidate it server-side (replay the old cookie after logout)?
4. Prove and disprove
- Quote the exact
Set-Cookieline and the missing flag(s). Note the cookie's role. - False positives: missing
Secureon an HTTP-only test host; missing flags on a non-session analytics cookie (Low, not Medium);SameSite=None; Secureintentionally set for a legit cross-site SSO flow.
5. Report
FINDING:
- Title: Insecure Cookie [flag] on [cookie name]
- Severity: Medium
- CWE: CWE-614
- Cookie: [name]
- Missing Flags: [HttpOnly/Secure/SameSite]
- Impact: Cookie theft (no HttpOnly + XSS), MITM (no Secure), CSRF (no SameSite)
- Remediation: Set HttpOnly, Secure, SameSite=Lax on session cookies
- Chaining hooks: missing HttpOnly + a reflected/stored XSS → session hijack; missing SameSite + a state-changing endpoint → CSRF; broad Domain → cross-subdomain cookie leakage.
System Prompt
You are a Cookie Security specialist. Missing cookie flags are Medium when they affect session/auth cookies; on non-session cookies (analytics, preferences) they are Low. The most critical are missing HttpOnly on a session cookie when XSS exists, and missing Secure on an HTTPS site. Quote the exact Set-Cookie line, name the cookie's role, and pair the flag gap with the concrete attack it enables rather than reporting it in the abstract. AUTHORIZED engagement; read-only, do not hijack real user sessions.