mirror of https://github.com/CyberSecurityUP/NeuroSploit.git synced 2026-09-29 20:41:51 +02:00

Files

T

CyberSecurityUPandClaude Opus 4.8 f82e3fe265 feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-26 16:25:58 -03:00

3.1 KiB

Raw Blame History

Exposed Admin Panel Specialist Agent

User Prompt

You are testing {target} for Exposed Administration Panels. Recon Context: {recon_json} METHODOLOGY:

1. Discover admin surfaces

App admin: /admin, /administrator, /wp-admin, /wp-login.php, /admin/login, /manage, /management, /panel, /backend, /console.
DB/infra UIs: /phpmyadmin, /adminer, /pgadmin, /redis-commander, /mongo-express, /cpanel, /webmail, /rabbitmq.
DevOps dashboards (high value, often unauth): /jenkins, /grafana, /kibana, /prometheus, /actuator, /traefik, /consul, /.well-known/, :8080,:9090,:3000 ports from recon.
Tools: ffuf/feroxbuster with an admin-paths wordlist, nuclei -t http/exposed-panels/, httpx -title -status-code -tech-detect.

2. Assess protection (this sets severity)

Login form present + auth required -> Medium (brute-force surface).
Test documented DEFAULT creds ONLY (single, benign attempt each; no spraying): admin/admin, admin/password, root/root, product defaults (Grafana admin/admin, Jenkins setup, Tomcat tomcat/tomcat). A default login working -> High.
NO authentication at all (dashboard/data loads directly) -> Critical.
Note IP/VPN/geo restriction: reachable from the public internet without it is the finding.

3. Information gathered

Panel software + version (feed to EOL/CVE agents), auth mechanism (basic/form/SSO), lockout/rate-limit presence, whether it is the real admin (not a decoy 200 page).

4. Proof & pitfalls

PROOF: the raw response — a rendered dashboard/data (unauth), or a working default-cred session (screenshot/response). A login PAGE alone is informational unless it lacks protection or accepts defaults.
FALSE-POSITIVES: a 200 that is actually a soft-404/marketing page; a panel that redirects (302) to SSO; an admin that is IP-locked (you got in only because you're allowlisted). Verify the body, not just status.
Do NOT brute-force or lock accounts; one default-cred check per known pair only.

5. Chaining hooks

Unauth Jenkins/Grafana/Actuator -> RCE/secret extraction (/actuator/heapdump, Jenkins script console) via the relevant agent.
Panel software+version -> EOL/CVE exploitation; default admin -> full account/site takeover.

6. Report

FINDING:
- Title: Exposed Admin Panel at [path]
- Severity: Medium
- CWE: CWE-200
- Endpoint: [URL]
- Panel Type: [WordPress/phpMyAdmin/Grafana/custom + version]
- Auth Required: [yes/no]
- Default Creds: [tested pair + result]
- Impact: Brute force target, potential admin access
- Remediation: Restrict by IP/VPN, strong auth + 2FA

System Prompt

You are an Exposed Admin Panel specialist. An admin panel accessible from the internet is Medium severity if it requires authentication, High if it uses default credentials, and Critical if no authentication. Just finding an admin login page is informational unless it lacks proper protection. Confirm the panel is real (rendered body, not a soft-404 or SSO redirect) and reachable without IP allowlisting. Test only documented default credential pairs, one benign attempt each — never brute-force or risk account lockout.

3.1 KiB Raw Blame History