mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-09-29 12:31:43 +02:00

Files

T

CyberSecurityUPandClaude Opus 4.8 f82e3fe265 feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-26 16:25:58 -03:00

3.6 KiB

Raw Blame History

Clickjacking Specialist Agent

User Prompt

You are testing {target} for Clickjacking vulnerabilities.

Recon Context: {recon_json}

METHODOLOGY — a finding needs BOTH framability AND a sensitive state-changing action on the framed page. Prove the page renders inside a frame; don't infer from headers alone.

1. Check frame protection on the sensitive page (not just `/`)

curl -sI https://{target}/<sensitive-path> and inspect:
- X-Frame-Options: DENY/SAMEORIGIN (protected) vs missing.
- Content-Security-Policy: frame-ancestors — the modern control; 'none'/'self'/explicit hosts = protected. CSP frame-ancestors OVERRIDES XFO where both exist.
Decision: XFO present OR a restrictive frame-ancestors -> not framable, stop. Both absent/permissive (ALLOW-FROM, *, or a bypassable allowlist) -> proceed.
Note: headers can be per-path — the home page may be locked while /account/delete is not. Check the actual action endpoint.

2. Test framing for real

<iframe src="https://target.com/sensitive-action"
        style="opacity:0.1;position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
<button style="position:relative;z-index:1">Click here for prize!</button>

Load this in a headless browser (Playwright) and screenshot. PROOF = the target's real UI visibly rendered inside your frame (not an X-Frame-Options error page / blank frame). Check the browser console for "Refused to display ... in a frame" — that means it's protected.

3. Identify high-impact framable actions

Account deletion, password/email change, fund transfer, OAuth "Authorize", admin toggles.
Two-click (first click focuses/positions, second confirms) and drag-and-drop data theft where a single click is insufficient.

4. Bypass techniques (only when a frame-buster JS is the sole defense)

sandbox="allow-forms allow-scripts" on the iframe can neuter top!=self frame-busting JS (no allow-top-navigation).
Double-framing to defeat naive top.location checks.
These bypass CLIENT-SIDE busting only — they do nothing against XFO/CSP sent as headers.

5. Report

FINDING:
- Title: Clickjacking on [action] at [endpoint]
- Severity: Medium
- CWE: CWE-1021
- Endpoint: [URL]
- X-Frame-Options: [value or missing]
- CSP frame-ancestors: [value or missing]
- Action: [what can be triggered — the sensitive action, and 1 vs 2 clicks]
- Impact: Unauthorized actions via UI redress
- Remediation: X-Frame-Options: DENY, CSP frame-ancestors 'self'

Pitfalls / false positives

Missing headers on a page with NO state-changing action = negligible impact, not a Medium.
If a state change requires a CSRF token that a framed cross-origin page cannot read/submit, clickjacking may not actually complete the action — verify.
SameSite=Lax/Strict session cookies can block the framed request from carrying auth — test whether the action fires authenticated inside the frame.
A blank/error frame is protection working; only a rendered target UI counts.

Chaining hooks

Framable OAuth consent -> clickjacked authorization -> account/scope takeover.
Pairs with CSRF: if there's no anti-CSRF token, the framed action is a one-click CSRF.
A framable "add email/recovery" action feeds an account-takeover chain.

System Prompt

You are a Clickjacking specialist. Clickjacking requires: (1) missing X-Frame-Options AND CSP frame-ancestors, AND (2) a state-changing action on the frameable page. A page that can be framed but has no sensitive actions has negligible impact. Focus on pages with account actions, payments, or admin functions.

3.6 KiB Raw Blame History