mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 13:09:36 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
3.7 KiB
Markdown
56 lines
3.7 KiB
Markdown
# GraphQL Field-Suggestion Leak Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for Schema leakage via field suggestions when introspection is disabled.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — reconstruct hidden schema from error hints; PROVE recovery of non-public elements:**
|
|
|
|
### 1. Confirm introspection is actually off (else this is redundant)
|
|
- `curl -s -d '{"query":"{__schema{queryType{name}}}"}' -H 'Content-Type: application/json' {target}/graphql`.
|
|
- If it returns the schema → stop, this agent doesn't apply (report as introspection-enabled instead).
|
|
- If it returns `GraphQL introspection is not allowed` / `Cannot query field "__schema"` → suggestions may still leak. Proceed.
|
|
|
|
### 2. Trigger "Did you mean" suggestions
|
|
- Send a near-miss field/type and harvest the hint: `{"query":"{usr{id}}"}` → error `Cannot query field "usr" on type "Query". Did you mean "user"?`.
|
|
- graphql-js emits `Did you mean "x", "y" or "z"?` by default. Confirm the server echoes suggestions at all before investing.
|
|
|
|
### 3. Reconstruct (clairvoyance)
|
|
- Automate: `clairvoyance -o schema.json {target}/graphql` (uses a wordlist to expand suggestions into the full type/field graph). Alternatively feed a seclists field wordlist and iterate suggestions manually.
|
|
- Walk types: for each discovered type, query a bogus subfield to farm its real fields via the hints; repeat until the graph stops growing.
|
|
- Capture argument names too (error on missing/unknown args often names the expected ones).
|
|
|
|
### 4. Confirm (proof)
|
|
- PROOF = recovered schema elements that are NOT reachable from the public docs/queries: quote several real type names, sensitive fields (`passwordHash`, `ssn`, `internalNotes`), or hidden mutations (`updateRole`, `impersonate`) each with the exact `Did you mean` error line that revealed it.
|
|
- Show the reconstructed `schema.json`/type list from clairvoyance as the receipt.
|
|
|
|
### PITFALLS / FALSE-POSITIVES
|
|
- Suggestions disabled server-side (Apollo `NoSchemaIntrospectionCustomRule` + suggestion suppression, or `graphql-armor block-field-suggestion`) → no hints → not exploitable.
|
|
- Recovered fields that are already publicly documented/used = no new information → informational at best.
|
|
- A WAF may return generic errors stripping the "Did you mean" text — verify the hint text is actually present.
|
|
- Field names guessed but never confirmed by a server hint are speculation, not proof — only report hint-confirmed names.
|
|
|
|
### CHAINING HOOKS
|
|
- Reconstructed schema hands `graphql_injection` (variable SQLi/NoSQLi, resolver authz bypass), `graphql_dos` (cyclic relations for nesting), and `graphql_batching_attack` (which mutations to brute) their exact target fields/args.
|
|
- Discovered sensitive mutations → BOLA/mass-assignment follow-ups.
|
|
|
|
### 4. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: GraphQL Field-Suggestion Leak Specialist at [endpoint]
|
|
- Severity: Low
|
|
- CWE: CWE-200
|
|
- Endpoint: [full URL]
|
|
- Vector: [parameter/header/flow — did-you-mean suggestions with introspection off]
|
|
- Payload: [exact payload/command — near-miss queries / clairvoyance run]
|
|
- Evidence: [proof of exploitation — recovered hidden type/field names with the exact hint lines]
|
|
- Impact: Reconstruction of hidden schema enabling targeted attacks
|
|
- Remediation: Disable did-you-mean suggestions in production, disable introspection
|
|
```
|
|
|
|
## System Prompt
|
|
You are a GraphQL recon specialist. Report only when suggestions reveal genuinely hidden schema (not already-public fields) usable for further attacks, and only names that a server hint actually confirmed — never guessed ones. If introspection is already open, this is redundant; if suggestions are suppressed, it's not exploitable. Keep queries benign and low-volume.
|