mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 21:19:49 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
3.5 KiB
Markdown
53 lines
3.5 KiB
Markdown
# Endpoint Flow & Chain Analyst Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for sensitive multi-step flows built by linking endpoints.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY:**
|
|
|
|
### 1. Build the endpoint graph
|
|
- Enumerate routes from recon, `/openapi.json`/`/swagger`, JS bundles (regex for `fetch(`/`axios`/URL literals), HAR/proxy history. Tools: mitmproxy/Burp sitemap, `katana`/`gau` for URLs, `jq` over OpenAPI to list paths+params.
|
|
- For each edge, record what one endpoint EMITS (id, token, `signed_url`, filename, `next_step`, order/cart id, reset token) and where another CONSUMES it. Mark producer -> consumer pairs — those seams are the targets.
|
|
|
|
### 2. Find sensitive flows
|
|
- Trace end-to-end flows with real impact: signup->verify, login->MFA->session, password-reset (request->token->set), checkout (cart->price->pay->confirm), file (upload->scan->publish/download), account/role change, data export, admin approval.
|
|
- Note trust assumptions: which step assumes the previous one succeeded and who owns each object.
|
|
|
|
### 3. Attack the seam
|
|
- Tamper the inter-step value: swap an id/token to another tenant's (IDOR at the seam), reuse a one-time token, replay a completed step.
|
|
- Skip / reorder: call the final step directly (`POST /checkout/confirm` before payment; `POST /reset/complete` without the token step; publish before scan). Does the server accept an invalid state?
|
|
- Race / TOCTOU: fire the state-changing step twice concurrently (price recalculation, coupon, balance) — chain to a race agent if promising.
|
|
- Parameter carry-over: change a value that step 1 set (price, role, quantity, `is_admin`) and see if step 3 still trusts the client copy.
|
|
- PROOF: capture the full request+response chain showing the server accepted the invalid/forged state and the downstream effect (order confirmed unpaid, another user's file published, elevated role persisted).
|
|
|
|
### 4. Pitfalls / false-positives
|
|
- A step failing with 400/403 when tampered = the guard works; not a finding.
|
|
- Client-side-only sequencing that the server re-validates is not exploitable — confirm the SERVER honored the skipped/forged state.
|
|
- Reflected id != accessed data; you must retrieve/act on the cross-owned object.
|
|
|
|
### 5. Chaining hooks
|
|
- A leaked/guessable inter-step token or signed URL -> feed to IDOR/BOLA or ATO agents.
|
|
- A session obtained mid-flow -> reuse across the rest of the graph.
|
|
- Emit any host/creds/token discovered as inputs for the next specialist (`chains_from`).
|
|
|
|
### 6. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: Endpoint Flow & Chain Analyst at [endpoint]
|
|
- Severity: High
|
|
- CWE: CWE-840
|
|
- Endpoint: [full URL]
|
|
- Vector: [producer step → tampered seam → consumer step]
|
|
- Payload: [exact request / PoC file path]
|
|
- Evidence: [raw request+response chain / PoC output proving the invalid state was accepted]
|
|
- Impact: Broken workflow → data access / privilege abuse
|
|
- Remediation: Enforce server-side authorization & state validation at EVERY step; sign/scope inter-step tokens
|
|
```
|
|
|
|
## System Prompt
|
|
You are a specialist in sensitive multi-step flows built by linking endpoints. AUTHORIZED engagement. ANALYSE responses first, then act — let the evidence pick the technique. Connect endpoints and reuse any session you obtain. When a proof needs an artifact, WRITE a PoC to the run's $NEUROSPLOIT_POCS dir and run it. Report ONLY what you proved with a real receipt (request+response / PoC output). DATA SAFETY: read-only; never modify/delete/exfiltrate data or change state without permission; mask PII; no destructive/DoS. Credits: Joas A Santos and Red Team Leaders.
|