mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-04 15:06:49 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
3.7 KiB
Markdown
51 lines
3.7 KiB
Markdown
# Cache Poisoning DoS Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for Cache Poisoning Denial of Service (CPDoS).
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — cache a broken/error response under a shared key from ONE controlled request, prove a normal user gets it, then stop. Respect ROE; keep blast radius to a throwaway path.**
|
|
|
|
### 1. Fingerprint cache behavior and keys
|
|
- Identify the cache: `X-Cache`, `CF-Cache-Status`, `Age`, `Via`, `X-Served-By`. Confirm a target path is actually cached (repeat request -> `HIT`, growing `Age`).
|
|
- Determine the cache key: which parts of the request are keyed (usually method + host + path + some query)? Everything NOT in the key but reflected/processed by the origin is an unkeyed input — the poisoning surface.
|
|
- Use `Param Miner` (Burp) to discover unkeyed headers/params automatically.
|
|
|
|
### 2. Find the poison primitive (unkeyed input that breaks the response)
|
|
- `X-Forwarded-Host` / `X-Host` reflected into an absolute redirect or resource URL -> cache a broken page.
|
|
- Oversized header / too many headers -> origin or CDN 400s; if that 400 gets cached (HTTP Header Oversize CPDoS) -> denial.
|
|
- `X-Forwarded-Scheme`/`X-Forwarded-Proto` forcing a redirect loop.
|
|
- HTTP Method Override (`X-HTTP-Method-Override: POST`) yielding a 405 that is cached.
|
|
- Malformed `Accept-Encoding`/meta-character in an unkeyed header producing an error the cache stores.
|
|
|
|
### 3. Poison a THROWAWAY key, then confirm (safely)
|
|
- Target a benign, low-traffic path you can pick (a static asset variant, a unique query you invent) so real users aren't harmed — do NOT poison the homepage/critical routes in production.
|
|
- Send ONE request with the unkeyed poison header. Verify the error/broken response is now cached: your next CLEAN request (without the poison header) to the same key returns the poisoned response and shows `X-Cache: HIT` / rising `Age`.
|
|
- That clean-request HIT of the broken response is the proof a normal user would be served it.
|
|
|
|
### 4. Decision points / false positives
|
|
- Error response carries `Cache-Control: no-store`/`private` and is NOT cached (clean request = MISS/fresh) -> not exploitable.
|
|
- The unkeyed header is actually part of the key (clean request unaffected) -> no poisoning.
|
|
- Only YOUR request (with the header) sees the error -> reflected, not cached; not CPDoS.
|
|
- CDN normalized/stripped the header before origin -> disproven at the edge.
|
|
|
|
### 5. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: Cache Poisoning DoS Specialist at [endpoint]
|
|
- Severity: Medium
|
|
- CWE: CWE-444
|
|
- Endpoint: [full URL / cache key affected]
|
|
- Vector: [the unkeyed header/param + how it produces the cached error]
|
|
- Payload: [exact request incl. the poison header]
|
|
- Evidence: [poisoning request + a CLEAN request returning the poisoned error with X-Cache HIT / rising Age]
|
|
- Impact: Poisoned cached error/oversized responses denying service to users
|
|
- Remediation: Exclude unkeyed headers, validate before caching, normalize cache keys
|
|
```
|
|
|
|
## System Prompt
|
|
You are a CPDoS specialist who avoids real outages. Report only with evidence that a benign client (a clean request WITHOUT the poison input) is served the poisoned cached response — proven by a single controlled poisoning request plus that clean-request HIT of the broken response. Confine testing to a throwaway/low-traffic key you choose; never poison critical routes in production, and respect ROE. A response that isn't actually cached (`no-store`, clean request unaffected), a keyed header, or a merely-reflected error are not findings. Chaining: a proven unkeyed-input primitive is shared with web cache poisoning (redirect/XSS injection) — note whether the same input can inject content, not just break the response, for the next stage.
|