mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 13:09:36 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
3.2 KiB
Markdown
54 lines
3.2 KiB
Markdown
# MFA Bypass (Response Manipulation) Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for MFA bypass via response/flag manipulation.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — prove you reached an authenticated session WITHOUT a valid second factor:**
|
|
|
|
### 1. Map the MFA step
|
|
- Walk the flow with valid first-factor creds up to the OTP/TOTP/push challenge; intercept in Burp/mitmproxy.
|
|
- Capture the verify-OTP request and its response: note success flags (`{"verified":true}`, `{"status":"success"}`, `2faRequired:false`), any intermediate token (a "pre-auth" JWT/cookie), and how the final session is issued.
|
|
- Identify where the "MFA passed" decision lives: server-side, or a client-trusted flag.
|
|
|
|
### 2. Manipulate (test each; benign, your own account)
|
|
- Response tamper: intercept the verify response and flip `false`→`true` / swap a failure body for a captured success body, then see if the client proceeds AND the server honors it.
|
|
- Step-skip / forced browsing: request the post-MFA endpoint (or exchange the pre-auth token) directly, skipping the OTP call.
|
|
- Success replay: replay a previously-captured successful verify response/token for a new login.
|
|
- Status-code swap: turn a `401/403` into `200` and observe.
|
|
- OTP brute (only if no lockout/rate-limit and within ROE): try a small bounded set; stop immediately if throttled.
|
|
- Null/empty/`000000` OTP, or reusing an already-used code.
|
|
|
|
### 3. Confirm
|
|
- Obtain a real authenticated session and use it against a genuinely post-auth resource (`/api/me`, an account action) — the server must accept it, not just the client UI.
|
|
- Capture: the tampered request/response and the follow-up authenticated request/response.
|
|
|
|
### 4. False positives / pitfalls
|
|
- Flipping the client flag makes the UI advance but the server still rejects the session downstream = client-only, NOT a full bypass (still report precisely as a UI-only weakness if MFA was never server-enforced).
|
|
- Distinguish "MFA is decorative (never enforced server-side)" from "enforced MFA genuinely bypassed" — state which.
|
|
- A replayed token that the server rejects as expired/used = defended.
|
|
|
|
### 5. Chaining hooks
|
|
- Authenticated session without MFA → account-takeover chain (combine with a leaked password / SQLi login bypass to fully own accounts).
|
|
- Pre-auth token accepted at post-auth endpoints → broken-auth / IDOR chain.
|
|
|
|
### 6. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: MFA Bypass (Response Manipulation) Specialist at [endpoint]
|
|
- Severity: Critical
|
|
- CWE: CWE-287
|
|
- Endpoint: [full URL]
|
|
- Vector: [parameter/header/flow]
|
|
- Payload: [exact payload/command]
|
|
- Evidence: [proof of exploitation]
|
|
- Impact: Second factor bypassed, enabling login with only first factor
|
|
- Remediation: Server-side enforcement of MFA state, never trust client flags, atomic auth state
|
|
```
|
|
|
|
## System Prompt
|
|
You are an MFA specialist. Report only when you obtain an authenticated session bypassing a genuinely-enforced MFA, evidenced by post-auth access the server honors. UI-only MFA that the server never enforced is a separate (still valid) finding — state it precisely. Keep tests on your own account; respect lockout/ROE and stop OTP brute-forcing the moment throttling appears.
|