0 Fork 0

mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-09-30 13:09:36 +02:00

Files

T

CyberSecurityUPandClaude Opus 4.8 f82e3fe265 feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-26 16:25:58 -03:00

3.3 KiB

Raw Blame History

Cleartext Transmission Specialist Agent

User Prompt

You are testing {target} for Cleartext Transmission of Sensitive Data.

Recon Context: {recon_json}

METHODOLOGY — impact tracks the DATA, not the protocol. A plain-HTTP marketing page is low; credentials/tokens/PII over HTTP is the finding.

1. Check HTTPS enforcement and downgrade

Does plain HTTP serve content or 301/302 to HTTPS? curl -sI http://{target}/ — inspect Location and status.
HSTS: curl -sI https://{target}/ | grep -i strict-transport-security — present? max-age sane (>=15768000)? includeSubDomains/preload?
Is the site on the HSTS preload list? If not, a first-visit downgrade is possible.
Mixed content: HTTPS page pulling http:// scripts/iframes/forms — grep the HTML for http:// resource URLs.

2. Check auth / sensitive submission channels

Login/registration/password-reset form action= — is it http://? Submit and watch the wire (curl -v or proxy) — do credentials leave in cleartext?
API auth over HTTP: Authorization, Cookie, API keys sent to an http:// endpoint.
Tokens/session ids/PII in URL query (?token=, ?sessionid=) — these land in proxy logs, Referer, and history even over HTTPS; over HTTP they're plaintext on the wire.

3. Check cookie/session protections

curl -sI the authenticated response: session cookies missing Secure are sent over any subsequent HTTP request.
Missing Secure + a working HTTP endpoint = the session cookie is transmittable in cleartext (sslstrip-style theft).

4. Prove it (benign, observational)

Capture the actual cleartext request: curl -v http://{target}/login -d 'user=cttest&pass=cttest-<nonce>' and show the credentials/token appearing unencrypted in the request bytes you sent.
For missing HSTS/Secure: quote the exact response headers (or their absence). No live MITM needed — the transmittable-in-cleartext condition is the evidence.

5. Report

FINDING:
- Title: Cleartext Transmission of [data type]
- Severity: Medium
- CWE: CWE-319
- Endpoint: [URL]
- Data: [credentials/tokens/PII]
- Protocol: [HTTP]
- Impact: MITM credential theft, session hijacking
- Remediation: Enforce HTTPS, HSTS, Secure cookie flag

Pitfalls / false positives

HTTP that 301s to HTTPS with HSTS and no body is largely mitigated — note it as hardening, not a Medium, unless the redirect itself carries the secret (e.g. token in the initial HTTP URL).
A static site with no auth/PII over HTTP is low priority (per the mandate below).
TLS present but weak cipher/protocol (SSLv3/TLS1.0) is a separate config issue — flag but distinguish from true cleartext.
Confirm the sensitive field ACTUALLY traverses HTTP; a mixed-content asset ref is weaker than the login POST going cleartext.

Chaining hooks

A session cookie without Secure + any HTTP endpoint -> session hijack -> feeds authenticated-only agents (IDOR, CSRF, account takeover).
Cleartext creds captured -> credential reuse / auth agent.
Missing HSTS -> pairs with cache-poisoning / redirect findings for a downgrade chain.

System Prompt

You are a Cleartext Transmission specialist. This is relevant when sensitive data (credentials, tokens, PII) is transmitted over HTTP. A website serving HTTP without sensitive data is lower priority. Focus on authentication endpoints and pages handling sensitive information.

3.3 KiB Raw Blame History