mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-14 13:40:23 +02:00
CyberSecurityUP
76121fd739
- Validator no longer silently drops uncertain findings. New Finding.review_status (confirmed | needs-review) + review_reason. validate() keeps partial-support as needs-review (drops only zero-support noise); refute_pass() demotes refuted High/Crit to needs-review instead of deleting; grounding::gate() flags ungrounded as needs-review instead of retain-dropping. Reports separate the two buckets. - Reports: report::write_all writes report.md (human) + report.json (structured confirmed/needs-review/all) + report.html + Typst PDF. Wired into finalize_run and report_raw. HTML shows a NEEDS REVIEW badge + reason. - SPA/REST methodology: when recon detects a JS SPA and/or REST/GraphQL API, inject SPA_API_DOCTRINE — directions (not an answer key) for a Juice-Shop-class surface: map API from JS bundle, hidden client routes, SQLi login-bypass/UNION, JWT none/RS→HS forge, IDOR/BOLA + mass-assignment, path-traversal + poison null byte, forgot-password OSINT, exposed /metrics, DOM XSS, NoSQL, SSRF, redirect allowlist, XXE, coupon crypto. Agents still discover and prove live. - RL reward shaping: confirmed (severity × confidence) strong, needs-review small positive lead, no-find slight decay — reliable agents rise in selection. - Tests: grounding gate flag-not-delete; report md/json bucket separation.
