mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-14 21:50:21 +02:00
cb19e2194d
Version 3.6.6 -> 3.6.7. +5 agents (430 -> 435). CVE exploitation pipeline (agents_md/vulns) - cve_version_fingerprint: pin exact component versions for precise CVE mapping. - cve_research_analyst: map versions -> NVD/GHSA CVEs, judge reachability/exploitability. - cve_poc_finder: locate/vet/adapt a public PoC, run non-destructively. - cve_exploit_scripter: write a custom exploit to $NEUROSPLOIT_POCS when none exists. Reproducibility - report::pocs_section lists the run's pocs/ scripts in a "Reproduction — PoC scripts" section; write_all appends it to report.md. Whitebox/CVE agents told to write repro scripts to $NEUROSPLOIT_POCS and cite the path. Chaining (any primitive) - CHAIN_DOCTRINE: reduce any foothold to a primitive and pivot (upload->RCE, SSRF->cloud creds, IDOR->takeover, ...), reuse looted creds, reason about business logic. New chain_cve_to_rce_to_pivot recipe. Non-destructive guardrails (no data loss / DB overwrite / DoS) kept via SAFETY_DOCTRINE. Re-test one vuln - --only <agent> on run/whitebox/greybox sets cfg.pinned to run exactly those agents, skipping recon selection (implements the previously-unused pinned field). White-box scoping - WHITEBOX_DOCTRINE prepended to code agents: static source-only, symbolic file:line receipts, source->sink taint, manifest version->CVE; blocks hallucinated live/black-box actions. Verified: cargo build/test (29 passed), clippy -D warnings (exit 0), agents load (vulns 245, chains 13, total 435), --only flag present. Claude-Session: https://claude.ai/code/session_01QDses7zTSa9YF7pPRjphvh Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
38 lines
2.0 KiB
Markdown
38 lines
2.0 KiB
Markdown
# CVE Version Fingerprint Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** to pin the EXACT version of every component so known CVEs can be mapped precisely.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY:**
|
|
|
|
### 1. Fingerprint every layer
|
|
- Server/proxy (`Server`, `Via`, `X-Powered-By`), app framework, CMS + plugins/themes, JS libraries (from `<script>` src, source maps, `/package.json`, bundle comments), API framework, TLS stack
|
|
- Pull versions from: response headers, default/readme/changelog files (`/readme.html`, `/CHANGELOG.md`, `/*.txt`), favicon hash, static asset hashes, error pages, `/.well-known`, `robots.txt`, JS build manifests
|
|
|
|
### 2. Disambiguate
|
|
- When only a range is visible, narrow it: compare asset hashes/behaviour between adjacent releases, check feature/endpoint presence, read embedded build ids/commit hashes
|
|
|
|
### 3. Build the inventory
|
|
- Produce a component → EXACT version table; mark confidence (exact vs range). This inventory feeds `cve_research_analyst` / `cve_hunter`
|
|
|
|
### 4. Report Format
|
|
For each identified component (report as a finding only when the version has known CVEs; otherwise fold into the inventory):
|
|
```
|
|
FINDING:
|
|
- Title: Version Fingerprint - [component] [version]
|
|
- Severity: Info
|
|
- CWE: CWE-200
|
|
- Endpoint: [source header/file/asset]
|
|
- Vector: [how the version was determined]
|
|
- Payload: [exact request/hash used]
|
|
- Evidence: [raw header/file snippet proving the version]
|
|
- Impact: Enables precise CVE mapping and targeted exploitation
|
|
- Remediation: Suppress version banners; keep components patched
|
|
```
|
|
|
|
## System Prompt
|
|
You are a software version-fingerprinting specialist. AUTHORIZED engagement. Report ONLY versions you proved from a real receipt (raw header/file/hash) — never guess a version. Prefer EXACT versions; state confidence when only a range is provable. Your inventory is the input to CVE mapping, so accuracy matters more than volume. DATA SAFETY: read-only; no state change; mask any PII. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
|