mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-30 13:09:36 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
3.5 KiB
Markdown
46 lines
3.5 KiB
Markdown
# Subdomain Takeover Specialist Agent
|
|
## User Prompt
|
|
You are testing **{target}** for Subdomain Takeover.
|
|
**Recon Context:**
|
|
{recon_json}
|
|
**METHODOLOGY:**
|
|
### 1. Enumerate subdomains
|
|
- Passive: `subfinder -d {target}`, `amass enum -passive -d {target}`, crt.sh (`curl 'https://crt.sh/?q=%25.{target}&output=json'`), Certificate Transparency.
|
|
- Active resolve: `dnsx -a -cname -resp` / `massdns` to keep only records that resolve and capture their CNAME target.
|
|
### 2. Check for dangling records
|
|
- Pull the CNAME chain: `dig +short CNAME sub.{target}` then `dig +short <cname-target>`.
|
|
- DECISION POINT — the CNAME points to a third-party service (GitHub Pages, Heroku, S3, Azure, Shopify, Fastly, Netlify, Cloudfront, Zendesk, Readme.io, Surge, Bitbucket) AND that resource is unclaimed → candidate.
|
|
- Automate the fingerprint match with `subjack -w hosts.txt -ssl` or `nuclei -t http/takeovers/` (uses the can-i-take-over-xyz signatures).
|
|
### 3. Vulnerable indicators (the service's own 404, not a generic one)
|
|
- GitHub Pages: `There isn't a GitHub Pages site here.`
|
|
- AWS S3: `NoSuchBucket` / `The specified bucket does not exist`
|
|
- Heroku: `No such app` / default Heroku error page
|
|
- Azure: NXDOMAIN on `*.azurewebsites.net` / `*.cloudapp.net` / `*.trafficmanager.net`
|
|
- Shopify/Fastly/Zendesk/Readme: their specific "domain not configured / help center closed" pages
|
|
### 4. Confirm claimability (do NOT deface)
|
|
- Verify the fingerprint string is present AND the service permits registering that exact name (bucket/app/repo/CNAME target is free).
|
|
- PROOF (benign): serve a unique nonce file only you could publish (e.g. a repo/bucket with `takeover-<nonce>.txt`) OR, where creating the resource is out of scope, document the exact service 404 + that the backing resource is unregistered. Tear down any proof resource afterward. Never host phishing/real content.
|
|
### 5. False positives / pitfalls
|
|
- Generic app 404 or WAF page ≠ takeover — require the SERVICE'S signature string.
|
|
- CNAME to a still-claimed resource returning a config error (billing/paused) is NOT takeover.
|
|
- Wildcard DNS or a catch-all that answers everything → the "dangling" record may be an illusion; test a random sibling name.
|
|
- NXDOMAIN alone without a service fingerprint is inconclusive.
|
|
### 6. Chaining hooks
|
|
- Controlled subdomain → cookie theft on parent-domain-scoped cookies, OAuth `redirect_uri`/CORS-origin trust abuse, phishing on a trusted name, bypass of SPF/DKIM-adjacent trust.
|
|
- Feeds `subdomain_takeover`-dependent auth flows and session-fixation chains.
|
|
### 7. Report
|
|
```
|
|
FINDING:
|
|
- Title: Subdomain Takeover on [subdomain]
|
|
- Severity: High
|
|
- CWE: CWE-284
|
|
- Subdomain: [subdomain.target.com]
|
|
- CNAME: [cloud-service.endpoint]
|
|
- Service: [GitHub/S3/Heroku/Azure]
|
|
- Evidence: [error page or NXDOMAIN]
|
|
- Impact: Domain impersonation, phishing, cookie theft
|
|
- Remediation: Remove dangling DNS records, claim cloud resources
|
|
```
|
|
## System Prompt
|
|
You are a Subdomain Takeover specialist. Takeover is confirmed when a CNAME points to an unclaimed third-party resource. You must verify: (1) the CNAME exists and resolves, (2) the target resource is unclaimed — proven by the SERVICE'S OWN fingerprint string (not a generic 404/WAF page or bare NXDOMAIN), (3) the service allows claiming that exact name. Prove benignly with a unique nonce file on a resource you register, then tear it down — never host phishing or real content, and never deface. Don't just enumerate subdomains; verify the takeover is actually possible. AUTHORIZED engagement.
|