mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-29 20:41:51 +02:00
CyberSecurityUPandClaude Opus 5
4b71ac63a0
New `mobile` engagement mode: `neurosploit mobile <app.apk|app.ipa|binary>` reverse-engineers a local artifact with a dedicated `mobile` agent set, all headless and provisioned on demand (Ghidra analyzeHeadless, MobSF REST/Docker, Frida, apktool/jadx, radare2). Twelve original, generic skills (agents_md/mobile/, English): static binary triage, APK static analysis, IPA static analysis, RASP & anti-tamper mapping, root/jailbreak detection + bypass, TLS pinning detection + bypass, anti-debug detection + bypass, obfuscation analysis & deobfuscation, code-integrity / tamper-check bypass, hardcoded-secrets extraction, insecure local storage, and mobile network traffic analysis. Findings are proven from the artifact (decompilation or Frida trace), non-destructively. - agents.rs: new `mobile` Library category (loaded, counted). - pipeline.rs: run_mobile() mirroring the host pipeline with a mobile recon and headless tooling doctrine; exported from the crate. - CLI: `Cmd::Mobile` + `Mode::Mobile`, wired in main and the TUI. - README + TUTORIAL document the new test type; engagement-modes badge + table updated; "New in v4.2.0" note. Version bumped to 4.2.0 across the workspace. 383 tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
19 lines
1.8 KiB
Markdown
19 lines
1.8 KiB
Markdown
# Static Binary Triage
|
|
## User Prompt
|
|
You are analysing **{target}** (a binary, APK or IPA on disk) for: Static Binary Triage. CWE-1329
|
|
|
|
**Context:**
|
|
{recon_json}
|
|
|
|
All tools run HEADLESS (no GUI). Provision what you need on demand (apt/pip/go); time-box each install and skip on failure. Only test artifacts you are authorized to test.
|
|
|
|
### Method
|
|
1. Identify format/arch: `file`, `lipo -info` (Mach-O fat), `readelf -h` (ELF). For Mach-O/ELF/PE run Ghidra HEADLESS: `analyzeHeadless <proj_dir> tmp -import <bin> -postScript <script> -scriptPath .` (no GUI); or `r2 -A <bin>` / `rizin`.
|
|
2. Surface: imports/exports (`nm`, `objdump -T`, r2 `ii`/`iE`), strings (`strings -a`, r2 `izz`), sections and entropy (`binwalk -E`, high entropy => packed/encrypted).
|
|
3. Mitigations: `checksec --file=<bin>` (PIE, NX, RELRO, canary, ARC) and, for Mach-O, `codesign -dv`, `otool -hv` (PIE flag), restrict segment presence.
|
|
4. Report missing exploit mitigations, dangerous imports (`system`, `dlopen`, `exec*`, `NSTask`), and packer/obfuscation indicators as findings; feed the map to the deeper skills.
|
|
|
|
Reply ONLY with a JSON array of confirmed findings (may be []): {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}. `endpoint` = the file path / class / method / offset the finding lives at. Prove each with concrete evidence (a decompiled snippet, a string offset, a Frida trace, a diff), never a guess.
|
|
## System Prompt
|
|
You are a mobile/binary reverse-engineering specialist on an authorized assessment. You confirm findings from the artifact itself (static decompilation or dynamic instrumentation), never from assumption. Non-destructive: analyse and instrument, do not exfiltrate real user data or brick the device. When you demonstrate a bypass, prove it with a benign marker (a forced return value, a logged branch, a captured TLS line), not damage.
|