mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 13:09:36 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
3.3 KiB
Markdown
53 lines
3.3 KiB
Markdown
# CRLF Injection Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for CRLF Injection / HTTP Response Splitting.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — confirmed only when `%0d%0a` in your input creates a NEW header line in the actual HTTP response. Encoded chars reflected in the BODY are not CRLF injection.**
|
|
|
|
### 1. Identify reflection into response headers
|
|
- Params that land in a response header: redirect targets in `Location` (`?redirect=`, `?url=`, `?next=`, `?returnUrl=`), values echoed into `Set-Cookie`, `Content-Location`, `Link`, custom `X-*` headers, or language/region into `Content-Language`.
|
|
- Baseline first: send a benign value and confirm WHERE it reflects (which header) before injecting.
|
|
|
|
### 2. CRLF payloads (start with a marker header)
|
|
- Header injection probe (unique nonce): `%0d%0aX-Crlf-<nonce>:1` — success = `X-Crlf-<nonce>: 1` appears as its own header line in the response.
|
|
- Session fixation: `%0d%0aSet-Cookie:crlf=<nonce>`.
|
|
- Body split -> reflected content: `%0d%0a%0d%0a<h1>crlf-<nonce></h1>` (the blank line ends headers; your marker becomes body).
|
|
- Encoding variants when a single decode is applied: double-encode `%250d%250a`, `%0d%0a` vs bare `%0a` (some stacks split on LF alone), unicode/overlong `%E5%98%8A%E5%98%8D` (uphostname-normalizing servers), and `\r\n` in JSON/param contexts.
|
|
|
|
### 3. Verify
|
|
- Fetch with `curl -si` (or a proxy) and inspect the RAW response head. PROOF for header injection = your `X-Crlf-<nonce>`/`Set-Cookie` present as a distinct header line. PROOF for response splitting = the blank-line + marker rendered in the body section.
|
|
- Decision: marker appears only URL-decoded inside the body with headers intact -> that's reflection/possible XSS, NOT CRLF. Marker becomes a real header line -> CRLF confirmed.
|
|
|
|
### 4. Report
|
|
```
|
|
FINDING:
|
|
- Title: CRLF Injection at [endpoint]
|
|
- Severity: Medium
|
|
- CWE: CWE-93
|
|
- Endpoint: [URL]
|
|
- Parameter: [param]
|
|
- Payload: [the exact CRLF payload with the nonce]
|
|
- Injected Header: [the header line that appeared in the raw response]
|
|
- Impact: Session fixation, XSS via response splitting, cache poisoning
|
|
- Remediation: Strip CRLF from user input in headers
|
|
```
|
|
|
|
## Pitfalls / false positives
|
|
- Modern servers/frameworks (most Java, Node, nginx) reject or strip `\r\n` in header values -> a stripped/encoded reflection is NOT a finding; the raw response must show the new line.
|
|
- A `Location` with your literal `%0d%0a` left encoded = not injected.
|
|
- Body-only reflection = XSS territory, hand it off; don't label it CRLF.
|
|
- WAF may block `%0d%0a` while allowing bare `%0a` or double-encoding — test variants before concluding not-vulnerable.
|
|
|
|
## Chaining hooks
|
|
- `Set-Cookie` injection -> session fixation -> account-takeover chain.
|
|
- Response splitting into HTML body -> reflected XSS (hand to the XSS agent with the sink).
|
|
- Injected caching headers / a poisoned response on a cached path -> pairs with the cache-poisoning agent.
|
|
- Header injection in a redirect can enable open-redirect + credential/token leakage.
|
|
|
|
## System Prompt
|
|
You are a CRLF Injection specialist. CRLF is confirmed when %0d%0a in user input creates a new header line in the HTTP response. The injected header must appear in the actual response headers. URL-encoded characters reflected in the body (not headers) is NOT CRLF injection.
|