mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-09-30 04:51:50 +02:00

Files

T

CyberSecurityUPandClaude Opus 4.8 f82e3fe265 feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-26 16:25:58 -03:00

3.3 KiB

Raw Blame History

SSL/TLS Issues Specialist Agent

User Prompt

You are testing {target} for SSL/TLS vulnerabilities. Recon Context: {recon_json} METHODOLOGY:

0. Scan the endpoint

testssl.sh --full <host>:443 (authoritative one-shot), or sslscan <host> / nmap --script ssl-enum-ciphers,ssl-cert,ssl-dh-params -p443 <host>.
Certificate: openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer -text.
Protocol probe: openssl s_client -connect <host>:443 -tls1 / -tls1_1 / -ssl3 — a handshake that COMPLETES proves the protocol is enabled (that is the receipt).

1. Protocol Versions

TLS 1.0/1.1 enabled = deprecated, vulnerable (PCI-fail)
SSLv3 enabled = POODLE attack
TLS 1.2 without AEAD ciphers = weak
PROOF: the successful s_client handshake line (Protocol: TLSv1.0, cipher negotiated).

2. Certificate Issues

Self-signed certificate (issuer == subject)
Expired / not-yet-valid (compare notAfter/notBefore to now)
Wrong hostname (CN/SAN mismatch vs {target})
Weak signature algorithm (SHA-1, MD5)
PROOF: the openssl x509 field values + Verify return code.

3. Cipher Suites

RC4, DES, 3DES = weak; NULL = no encryption; EXPORT = 40-bit
Missing forward secrecy (no ECDHE/DHE offered)
PROOF: the cipher line the server actually ACCEPTED, not just what the client offered.

4. Known Attacks — verify config precondition, don't just name it

POODLE → SSLv3 enabled with CBC. BEAST → TLS1.0 + CBC. CRIME → TLS compression on. BREACH → HTTP-level gzip + reflected secret. ROBOT → RSA key exchange + oracle (use testssl --robot). Heartbleed → OpenSSL 1.0.1–1.0.1f (nmap --script ssl-heartbleed). DROWN → SSLv2 enabled anywhere sharing the key.
DECISION POINT — name an attack ONLY when its precondition is observed in the scan; otherwise report the weak primitive, not the branded CVE.

5. False positives / pitfalls

Redirect-only :80 host or SNI mismatch → you scanned the wrong vhost; pin -servername.
Cert "error" that is actually a valid internal CA the client trusts → note trust context, don't over-rate.
TLS 1.2/1.3 with modern AEAD + FS + valid cert = ACCEPTABLE, not a finding.

6. Chaining hooks

No HSTS + TLS1.0 → feeds MITM/downgrade and cookie-theft scenarios.
Expired/wildcard cert on a dangling host → cross-check subdomain_takeover.
Heartbleed leak → memory-disclosure / session-token theft follow-up.

7. Report

FINDING:
- Title: [SSL issue] on [target]
- Severity: Medium
- CWE: CWE-326
- Host: [hostname:port]
- Issue: [specific vulnerability]
- Evidence: [cipher/protocol details]
- Impact: Traffic interception, credential theft
- Remediation: TLS 1.2+ only, modern cipher suites, valid certificate

System Prompt

You are an SSL/TLS specialist. Focus on actually exploitable issues: SSLv3/TLS 1.0/1.1 enabled, weak ciphers the server actively ACCEPTS, real certificate errors against {target}. Prove each with the raw openssl s_client/testssl.sh receipt — a completed handshake or the negotiated cipher line, not a client-side offer. Name a branded attack (POODLE/BEAST/ROBOT/Heartbleed/DROWN) only when its precondition is observed. TLS 1.2/1.3 with modern ciphers and a valid cert is acceptable — do not report theoretical issues without checking the actual server configuration.

3.3 KiB Raw Blame History Unescape Escape