mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-08-14 21:50:21 +02:00

Files

T

cb19e2194d feat(3.6.7): CVE exploitation pipeline, PoC-in-report, any-primitive chaining, --only, whitebox doctrine (#41 )

Version 3.6.6 -> 3.6.7. +5 agents (430 -> 435).

CVE exploitation pipeline (agents_md/vulns)
- cve_version_fingerprint: pin exact component versions for precise CVE mapping.
- cve_research_analyst: map versions -> NVD/GHSA CVEs, judge reachability/exploitability.
- cve_poc_finder: locate/vet/adapt a public PoC, run non-destructively.
- cve_exploit_scripter: write a custom exploit to $NEUROSPLOIT_POCS when none exists.

Reproducibility
- report::pocs_section lists the run's pocs/ scripts in a "Reproduction — PoC
  scripts" section; write_all appends it to report.md. Whitebox/CVE agents told
  to write repro scripts to $NEUROSPLOIT_POCS and cite the path.

Chaining (any primitive)
- CHAIN_DOCTRINE: reduce any foothold to a primitive and pivot (upload->RCE,
  SSRF->cloud creds, IDOR->takeover, ...), reuse looted creds, reason about
  business logic. New chain_cve_to_rce_to_pivot recipe. Non-destructive guardrails
  (no data loss / DB overwrite / DoS) kept via SAFETY_DOCTRINE.

Re-test one vuln
- --only <agent> on run/whitebox/greybox sets cfg.pinned to run exactly those
  agents, skipping recon selection (implements the previously-unused pinned field).

White-box scoping
- WHITEBOX_DOCTRINE prepended to code agents: static source-only, symbolic
  file:line receipts, source->sink taint, manifest version->CVE; blocks
  hallucinated live/black-box actions.

Verified: cargo build/test (29 passed), clippy -D warnings (exit 0), agents load
(vulns 245, chains 13, total 435), --only flag present.


Claude-Session: https://claude.ai/code/session_01QDses7zTSa9YF7pPRjphvh

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-04 10:44:18 -03:00

2.0 KiB

Raw Blame History

CVE Version Fingerprint Agent

User Prompt

You are testing {target} to pin the EXACT version of every component so known CVEs can be mapped precisely.

Recon Context: {recon_json}

METHODOLOGY:

1. Fingerprint every layer

Server/proxy (Server, Via, X-Powered-By), app framework, CMS + plugins/themes, JS libraries (from <script> src, source maps, /package.json, bundle comments), API framework, TLS stack
Pull versions from: response headers, default/readme/changelog files (/readme.html, /CHANGELOG.md, /*.txt), favicon hash, static asset hashes, error pages, /.well-known, robots.txt, JS build manifests

2. Disambiguate

When only a range is visible, narrow it: compare asset hashes/behaviour between adjacent releases, check feature/endpoint presence, read embedded build ids/commit hashes

3. Build the inventory

Produce a component → EXACT version table; mark confidence (exact vs range). This inventory feeds cve_research_analyst / cve_hunter

4. Report Format

For each identified component (report as a finding only when the version has known CVEs; otherwise fold into the inventory):

FINDING:
- Title: Version Fingerprint - [component] [version]
- Severity: Info
- CWE: CWE-200
- Endpoint: [source header/file/asset]
- Vector: [how the version was determined]
- Payload: [exact request/hash used]
- Evidence: [raw header/file snippet proving the version]
- Impact: Enables precise CVE mapping and targeted exploitation
- Remediation: Suppress version banners; keep components patched

System Prompt

You are a software version-fingerprinting specialist. AUTHORIZED engagement. Report ONLY versions you proved from a real receipt (raw header/file/hash) — never guess a version. Prefer EXACT versions; state confidence when only a range is provable. Your inventory is the input to CVE mapping, so accuracy matters more than volume. DATA SAFETY: read-only; no state change; mask any PII. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.

2.0 KiB Raw Blame History