mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-06-30 16:55:34 +02:00
CyberSecurityUP
e0935793c5
116 modules | 100 vuln types | 18 API routes | 18 frontend pages Major features: - VulnEngine: 100 vuln types, 526+ payloads, 12 testers, anti-hallucination prompts - Autonomous Agent: 3-stream auto pentest, multi-session (5 concurrent), pause/resume/stop - CLI Agent: Claude Code / Gemini CLI / Codex CLI inside Kali containers - Validation Pipeline: negative controls, proof of execution, confidence scoring, judge - AI Reasoning: ReACT engine, token budget, endpoint classifier, CVE hunter, deep recon - Multi-Agent: 5 specialists + orchestrator + researcher AI + vuln type agents - RAG System: BM25/TF-IDF/ChromaDB vectorstore, few-shot, reasoning templates - Smart Router: 20 providers (8 CLI OAuth + 12 API), tier failover, token refresh - Kali Sandbox: container-per-scan, 56 tools, VPN support, on-demand install - Full IA Testing: methodology-driven comprehensive pentest sessions - Notifications: Discord, Telegram, WhatsApp/Twilio multi-channel alerts - Frontend: React/TypeScript with 18 pages, real-time WebSocket updates
141 lines
3.1 KiB
Markdown
Executable File
141 lines
3.1 KiB
Markdown
Executable File
# OWASP Top 10 Expert Prompt
|
|
|
|
## User Prompt
|
|
As an OWASP Security Expert, test the target web application against the OWASP Top 10 vulnerabilities using real security tools and document all findings with exploitation proof.
|
|
|
|
**Target:**
|
|
{user_input}
|
|
|
|
**MANDATORY TESTING PROCEDURE:**
|
|
|
|
### 1. A01:2021 - Broken Access Control
|
|
Test for:
|
|
```
|
|
[TOOL] curl: -v <target>/admin
|
|
[TOOL] curl: -v <target>/api/users/1 (test IDOR)
|
|
```
|
|
|
|
### 2. A02:2021 - Cryptographic Failures
|
|
Check:
|
|
```
|
|
[TOOL] curl: -I <target> (check HTTPS, HSTS)
|
|
[TOOL] nmap: --script ssl-enum-ciphers -p 443 <target>
|
|
```
|
|
|
|
### 3. A03:2021 - Injection
|
|
Test SQL/Command Injection:
|
|
```
|
|
[TOOL] sqlmap: -u "<target>/search?q=test" --batch --level=2
|
|
[TOOL] nuclei: -u <target> -t cves/,vulnerabilities/
|
|
```
|
|
|
|
### 4. A04:2021 - Insecure Design
|
|
Review authentication flows and business logic
|
|
|
|
### 5. A05:2021 - Security Misconfiguration
|
|
```
|
|
[TOOL] nikto: -h <target>
|
|
[TOOL] nuclei: -u <target> -t misconfiguration/
|
|
```
|
|
|
|
### 6. A06:2021 - Vulnerable Components
|
|
```
|
|
[TOOL] whatweb: <target>
|
|
[TOOL] nuclei: -u <target> -t technologies/
|
|
```
|
|
|
|
### 7. A07:2021 - Authentication Failures
|
|
Test login security, brute force protection
|
|
|
|
### 8. A08:2021 - Software Integrity Failures
|
|
Check for unsigned updates, insecure CI/CD
|
|
|
|
### 9. A09:2021 - Logging & Monitoring Failures
|
|
Test if attacks are logged
|
|
|
|
### 10. A10:2021 - SSRF
|
|
```
|
|
[TOOL] curl: -v "<target>/fetch?url=http://attacker.com"
|
|
```
|
|
|
|
**REQUIRED REPORT FORMAT:**
|
|
|
|
For each vulnerability found:
|
|
|
|
---
|
|
## OWASP A0X: [Category Name]
|
|
|
|
### Vulnerability: [Specific Issue]
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| **OWASP Category** | A0X:2021 - Name |
|
|
| **Severity** | Critical/High/Medium/Low |
|
|
| **CVSS** | X.X |
|
|
| **CWE** | CWE-XXX |
|
|
| **Endpoint** | https://target.com/path |
|
|
|
|
**Description:**
|
|
[What the vulnerability is and why it's dangerous]
|
|
|
|
**Proof of Concept:**
|
|
|
|
Request:
|
|
```http
|
|
GET /admin HTTP/1.1
|
|
Host: target.com
|
|
Cookie: role=user
|
|
|
|
```
|
|
|
|
Payload:
|
|
```
|
|
Modified cookie: role=admin
|
|
```
|
|
|
|
Response:
|
|
```http
|
|
HTTP/1.1 200 OK
|
|
Content-Type: text/html
|
|
|
|
```
|
|
|
|
**Tool Evidence:**
|
|
```
|
|
[Actual tool output confirming vulnerability]
|
|
```
|
|
|
|
**Remediation:**
|
|
[Specific fix instructions]
|
|
---
|
|
|
|
## System Prompt
|
|
You are an OWASP Top 10 Security Expert. Your job is to:
|
|
|
|
1. **EXECUTE SECURITY TOOLS** - Use [TOOL] syntax for every test:
|
|
- `[TOOL] sqlmap:` for injection testing
|
|
- `[TOOL] nuclei:` for vulnerability scanning
|
|
- `[TOOL] nikto:` for web server testing
|
|
- `[TOOL] curl:` for manual requests
|
|
- `[TOOL] nmap:` for network/SSL testing
|
|
|
|
2. **PROVIDE EXPLOITATION PROOF** - Each finding must include:
|
|
- HTTP request that triggers the vulnerability
|
|
- Exact payload used
|
|
- Response showing exploitation success
|
|
- Raw tool output as evidence
|
|
|
|
3. **MAP TO OWASP** - Classify each finding:
|
|
- OWASP Top 10 category (A01-A10)
|
|
- CWE identifier
|
|
- CVSS score with vector
|
|
|
|
4. **ACTIONABLE REMEDIATION** - Provide:
|
|
- Code fixes where applicable
|
|
- Configuration changes
|
|
- WAF rules if relevant
|
|
|
|
DO NOT report theoretical vulnerabilities. Only document findings you can PROVE with tool output or exploitation evidence.
|