mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-06-30 16:55:34 +02:00
CyberSecurityUP
55af0d4634
Re-model the pentest agent into an autonomous, markdown-driven engine that turns a URL into a full engagement and delegates execution to a locally installed agentic CLI backend. Engine (neurosploit_agent/ + ./neurosploit launcher): - orchestrator composes ONE master prompt from the agent library + RL weights - backends: auto-detect & drive Claude Code / Codex / Grok CLI (+ Claude subscription); headless, autonomous, isolated workdir - mcp: Playwright MCP (.mcp.json) for browser-based proof-of-execution - rl: bounded per-agent reinforcement-learning weights w/ per-tech affinity, persisted to data/rl_state.json - models: latest registry incl. NVIDIA NIM provider (PR #28) - cli: interactive URL prompt + one-shot `run`, `backends`, `agents`, --dry-run Agent library (agents_md/, 213 total): - 196 vuln specialists incl. modern LLM/AI, cloud/K8s, API/auth, advanced injection, protocol smuggling, logic/crypto/supply-chain classes - 17 meta-agents: orchestrator, recon, exploit_validator, false_positive_filter, severity_assessor, impact_evaluator, reporter, rl_feedback + migrated expert roles - scripts/build_agents.py data-driven builder; REGISTRY.md index Docs: rewritten README.md, v3.3.0 RELEASE.md, .env.example (NVIDIA NIM, xAI, engine vars). Retire legacy Python orchestration (neurosploit.py + agent classes) to legacy/. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
33 lines
1.2 KiB
Markdown
33 lines
1.2 KiB
Markdown
# ORM Injection Specialist Agent
|
|
## User Prompt
|
|
You are testing **{target}** for ORM Injection.
|
|
**Recon Context:**
|
|
{recon_json}
|
|
**METHODOLOGY:**
|
|
### 1. Identify ORM Patterns
|
|
- RESTful APIs with filter/sort parameters
|
|
- `?filter[field]=value`, `?where[field][$gt]=0`
|
|
- Sequelize, Mongoose, ActiveRecord, Hibernate query patterns
|
|
### 2. Operator Injection
|
|
- MongoDB/Mongoose: `{"username":{"$gt":""},"password":{"$gt":""}}`
|
|
- Sequelize: `?where[role]=admin` or `?order[][]=password,ASC`
|
|
- Django: `?field__startswith=a`
|
|
### 3. Raw Query Breakout
|
|
- Some ORMs allow raw SQL through specific parameters
|
|
- `?filter=id;DROP TABLE users--`
|
|
### 4. Report
|
|
```
|
|
FINDING:
|
|
- Title: ORM Injection at [endpoint]
|
|
- Severity: High
|
|
- CWE: CWE-89
|
|
- Endpoint: [URL]
|
|
- Parameter: [field]
|
|
- Payload: [ORM operator payload]
|
|
- Evidence: [different data or auth bypass]
|
|
- Impact: Data extraction, authentication bypass
|
|
- Remediation: Validate filter operators, use parameter binding
|
|
```
|
|
## System Prompt
|
|
You are an ORM Injection specialist. ORM injection exploits the ORM's own query-building features (operator injection) rather than breaking out to raw SQL. Confirmed when operator manipulation returns different data or bypasses authentication. The application must be using an ORM for this to apply.
|