mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-09-29 20:41:51 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
3.4 KiB
Markdown
47 lines
3.4 KiB
Markdown
# Weak Random Number Generation Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for Weak Random Number Generation in security-relevant tokens.
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — collect a real sample set, prove a pattern, then predict a value and verify the prediction.**
|
|
|
|
### 1. Collect samples (many, not one)
|
|
- Session ids, CSRF tokens, password-reset/verification tokens, email-confirm codes, API keys, order/invoice ids, OTPs.
|
|
- Gather 100+ by scripting repeated issuance: register/reset in a loop, capture the token each time, record issuance timestamp alongside.
|
|
- `for i in $(seq 1 200); do curl -s {target}/reset -d "email=nsp_$i@test" -c -; done` then extract tokens.
|
|
|
|
### 2. Analyse for structure
|
|
- Sequential/monotonic: values increment (`1001,1002,1003`) or share a fixed prefix + counter -> decode base64/hex first, many are obfuscated counters.
|
|
- Time-based: token correlates with issuance time (`token = hex(unix_ms)` or `md5(timestamp)`); sort by capture time and look for monotonic decoded values.
|
|
- Low entropy: short length (<16 bytes), limited charset, repeated substrings.
|
|
- Known-weak PRNG signatures: JS `Math.random()`, PHP `rand()`/`mt_rand()` (Mersenne — recoverable from ~624 outputs, `php_mt_seed`), Java `java.util.Random` (48-bit LCG, recover state from 2 longs), pre-seeded/`srand(time())`.
|
|
- Tools: capture into Burp Sequencer (entropy/FIPS tests), or compute Shannon entropy / chi-square offline. Low entropy or a failed randomness test is evidence, not yet proof.
|
|
|
|
### 3. Predict and verify (the proof)
|
|
- Fit the pattern (next counter value; reconstruct PRNG state from captured outputs), PREDICT the next token BEFORE requesting it, then request a fresh one and show it matches.
|
|
- Or predict a token issued to a DIFFERENT (your own second) account and use it to reach that account's reset/verify flow -> demonstrates account-takeover reach, benignly, on your own accounts only.
|
|
|
|
### 4. Decision points / false positives
|
|
- High-entropy 128-bit+ token with no pattern across 100+ samples -> CSPRNG; not a finding.
|
|
- "Sequential-looking" ids that are non-security (public post ids) -> not security-relevant.
|
|
- Apparent time-correlation that fails to actually predict a fresh token -> unproven; report as suspicious low-entropy only, not predictable.
|
|
|
|
### 5. Report
|
|
```
|
|
FINDING:
|
|
- Title: Weak Random in [token type]
|
|
- Severity: Medium
|
|
- CWE: CWE-330
|
|
- Samples: [example tokens — a few from the collected set]
|
|
- Pattern: [sequential/time-based/low-entropy/known-weak-PRNG]
|
|
- Predictability: [can predict next token: yes/no — with the verified prediction receipt]
|
|
- Impact: Token prediction, session hijacking
|
|
- Remediation: Use cryptographic PRNG (secrets, SecureRandom)
|
|
```
|
|
|
|
## System Prompt
|
|
You are a Weak Random specialist. Confirmed when you demonstrate a pattern AND verify it by predicting a token that then matches a freshly-issued one (or reaches your own second account's flow). Collecting samples is mandatory — a single observation, short length, or a failed entropy test alone is suspicion, not proof; decode/deobfuscate before judging (many tokens are base64 counters). Rule out CSPRNG output and non-security ids. Keep it benign: predict against your own accounts only. Chaining: predictable reset/session tokens are a direct account-takeover primitive for the next stage; a predictable API key or CSRF token weakens the auth/CSRF chains that follow.
|