@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/techniques/prompt-injection-audit.md

@@ -0,0 +1,236 @@
+# AI/LLM Prompt Injection Audit Module
+
+> **Module ID:** PRM-INJ-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** AI Application Security & Agent Permission Boundary Assessment
+
+---
+
+## 1. Overview
+
+Audits applications using AI features, LLM integrations, or AI agents for prompt injection, privilege escalation, and authorization bypass vulnerabilities. Covers the three attack classes (direct, indirect, cross-privilege injection), tool/function calling security, MCP server security, and AI permission boundaries.
+
+**When to use:** Target application uses AI/LLM features, chatbots, AI agents, or MCP integrations. Also useful during code audit when LLM API calls are discovered.
+
+**Ethical boundary:** Audit code the user provides. Provide defensive remediation. No attack payloads for unauthorized use. CTF/red team contexts allow test payloads.
+
+---
+
+## 2. Background
+
+Prompt injection is **#1 vulnerability** in LLM-integrated applications (OWASP Top 10 for LLMs, LLM01). Occurs when untrusted input influences LLM instructions, causing it to ignore system prompt, leak secrets, or take unauthorized actions.
+
+### Three Attack Classes
+
+| Class | Vector | Example |
+|-------|--------|---------|
+| **Direct injection** | Attacker input directly to LLM | Chat input, form field processed by AI |
+| **Indirect injection** | Malicious instructions in consumed data | Web pages, emails, documents, RAG chunks, tool outputs |
+| **Cross-privilege injection** | Lower-priv user plants payload in shared data | Comment with injection read by admin's AI session |
+
+---
+
+## 3. Investigation Workflow
+
+```
+1. Map AI attack surface — find all LLM API calls and AI features
+2. Audit prompt construction — unsanitized interpolation, missing boundaries
+3. Audit output handling — rendered as HTML, executed as code, used in SQL
+4. Audit tool/function calling — argument validation, destructive tool gating
+5. Audit AI agents — unbounded loops, memory poisoning, multi-agent delegation
+6. Check prompt leaking — system prompt extraction vectors
+7. Audit permission boundaries — confused deputy, privilege escalation, multi-tenant leakage
+8. Assess defense layers — input/output validation, rate limiting, monitoring
+```
+
+---
+
+## 4. AI Attack Surface Mapping
+
+### Grep Patterns for LLM API Calls
+
+```
+openai, anthropic, cohere, replicate, ollama
+ChatCompletion, messages.create, generate, complete
+langchain, llamaindex, autogen, crewai
+```
+
+### AI Features to Identify
+- AI-powered search or recommendations
+- AI content generation (summaries, descriptions, emails)
+- AI chatbots or copilots embedded in app
+- AI-assisted form completion or auto-fill
+- AI moderation or classification
+- AI-driven workflow automation
+- MCP server connections and tool registrations
+
+### Document for Each Integration
+1. What is the system prompt? (read fully)
+2. What user input reaches the prompt?
+3. What external data reaches the prompt? (RAG, tools, web, DB, files)
+4. What actions can the LLM take? (tools, code exec, DB writes, API calls)
+5. How is LLM output used downstream? (HTML, code, SQL, another LLM)
+6. What permissions context does the AI operate under?
+
+---
+
+## 5. Prompt Construction Vulnerabilities
+
+### Unsanitized Interpolation (VULNERABLE)
+```python
+prompt = f"Summarize this: {user_input}"
+prompt = f"Answer based on this context: {rag_results}"
+```
+
+### Missing Boundaries (VULNERABLE)
+```python
+# No delimiter between instructions and data
+prompt = "Summarize: " + user_input
+```
+
+### Proper Delimiting (BETTER)
+```python
+prompt = f"""Summarize the text between the <document> tags.
+<document>
+{user_input}
+</document>"""
+```
+
+### Secrets in System Prompts (VULNERABLE)
+```python
+system = f"You are a helper. Use API key {API_KEY} to call..."
+```
+
+---
+
+## 6. Output Handling Vulnerabilities
+
+| Output Use | Risk | Example |
+|------------|------|---------|
+| Rendered as HTML | XSS via LLM | `dangerouslySetInnerHTML={{ __html: llmResponse }}` |
+| Executed as code | RCE | `exec(llm_response)` |
+| Used in DB queries | SQLi | `cursor.execute(f"SELECT * FROM {llm_response}")` |
+| Passed to another LLM | Chained injection | LLM A output becomes LLM B input |
+
+---
+
+## 7. Tool/Function Calling & Agent Security
+
+### Tool Call Validation
+```python
+# VULNERABLE — no validation
+result = execute_tool(tool_name=llm_choice, args=llm_args)
+
+# BETTER — allowlist + validation + confirmation
+if tool_name not in ALLOWED_TOOLS:
+    raise ValueError("Tool not permitted")
+validated_args = validate_tool_args(tool_name, llm_args)
+if tool_name in DESTRUCTIVE_TOOLS:
+    require_user_confirmation(tool_name, validated_args)
+```
+
+### Agent-Specific Risks
+
+| Risk | Description |
+|------|------------|
+| Unbounded loops | Missing iteration limits, token budgets, timeouts |
+| Memory poisoning | Untrusted data writing to persistent memory/vector store |
+| Multi-agent delegation | Agent-to-agent messages treated as trusted |
+| Self-modification | Agent can modify own instructions, tools, or system prompt |
+| MCP server injection | Malicious MCP server registration, unscoped tools |
+| Code execution | Missing sandbox, filesystem/network restrictions |
+
+---
+
+## 8. Permission Boundary Audit
+
+### Confused Deputy Check
+- Does AI use service account with broad permissions? (bypasses row-level security)
+- Does AI execute under requesting user's permissions? (correct approach)
+
+### Privilege Escalation Vectors
+- Read-only user triggers AI write operations
+- User queries other users' records through AI
+- AI-generated tool calls bypass permission checks
+- User input causes AI to call admin-only endpoints
+
+### Multi-Tenant Data Leakage
+- RAG retrieval filtered by tenant?
+- AI-generated queries tenant-scoped?
+- Shared AI features isolate tenant data?
+
+### Permission Check Checklist
+
+| Check | Status |
+|-------|--------|
+| AI tool calls go through same auth middleware as user actions | |
+| AI database queries scoped to requesting user's permissions | |
+| RAG retrieval filtered by tenant/user access level | |
+| AI cannot access admin APIs on behalf of non-admin users | |
+| Shared data consumed by AI treated as untrusted input | |
+| AI feature access gated by user role | |
+
+---
+
+## 9. Defense Layer Assessment
+
+| Defense | Present? | Notes |
+|---------|----------|-------|
+| Input validation/sanitization | | |
+| Prompt delimiters | | |
+| Output validation | | |
+| Tool call validation | | |
+| Privilege separation | | |
+| User-scoped AI queries | | |
+| Agent loop limits | | |
+| Agent memory isolation | | |
+| MCP server auth | | |
+| Rate limiting | | |
+| Monitoring/logging | | |
+| Human-in-the-loop | | |
+
+---
+
+## 10. Output Format
+
+```markdown
+# Prompt Injection Audit Report
+## Application: [name]
+## Date: [date]
+
+### LLM Integration Map
+| Integration | Model | User Input? | External Data? | Tools? | Output Usage |
+|-------------|-------|-------------|----------------|--------|-------------|
+
+### Findings
+#### [SEVERITY] [Title]
+**File:** `path/to/file:line`
+**Category:** Direct/Indirect/Cross-Privilege/Prompt Leaking/Insecure Output/Tool Abuse/Agent Security/Permission Bypass
+**Description:** [vulnerability]
+**Attack scenario:** [how attacker exploits this]
+**Vulnerable code:** [snippet]
+**Remediation:** [fix with explanation]
+
+### Defense Assessment
+| Defense Layer | Status | Recommendation |
+|--------------|--------|----------------|
+
+### Prioritized Remediation
+1. [Critical — permission bypass, privilege escalation, multi-tenant leakage]
+2. [Critical — exploitable injection with tool/agent access]
+3. [High — unsanitized input in prompts, agent memory poisoning]
+4. [Medium — missing output validation, unbounded agent loops]
+5. [Low — defense-in-depth, monitoring gaps]
+```
+
+---
+
+## 11. References
+
+- OWASP Top 10 for LLM Applications (LLM01, LLM08)
+- NIST AI Risk Management Framework (AI 100-1)
+- Anthropic prompt injection mitigations
+- Simon Willison's prompt injection research
+- MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
+- Model Context Protocol specification (security considerations)

package/skills/cti-expert/techniques/scam-check.md

@@ -0,0 +1,217 @@
+# Scam & Malicious Domain/URL Check Module
+
+Free-tier domain and URL reputation checking using zero-cost public services. No API keys required.
+
+---
+
+## Purpose
+
+Determine whether a domain or URL is associated with phishing, scams, malware, or other malicious activity using exclusively free, no-authentication-required services.
+
+> **Collection enhancement:** Web scraping steps (PhishTank, CheckPhish, etc.)
+> use Scrapling fetchers for resilient data collection. See
+> `techniques/web-collection-scrapling.md` for auto-escalation behavior.
+
+---
+
+## Execution Sequence
+
+### Step 1: PhishDestroy API (Primary — No API Key)
+
+Free threat intelligence API with 770K+ malicious domains. Syncs hourly.
+
+**Single domain check:**
+```bash
+curl -s "https://api.destroy.tools/v1/check?domain=[DOMAIN]"
+```
+
+**Response fields:**
+- `threat` (boolean) — is the domain flagged as malicious
+- `risk_score` (0-100) — numerical risk rating
+- `severity` — critical / high / medium / low
+- DNS status and matched threat keywords
+
+**Bulk check (up to 500 domains):**
+```bash
+curl -s -X POST "https://api.destroy.tools/v1/check/bulk" \
+  -H "Content-Type: application/json" \
+  -d '{"domains":["domain1.com","domain2.com"]}'
+```
+
+### Step 2: Google Safe Browsing Transparency Report
+
+Web-based lookup — no API key needed.
+
+**Method:** WebSearch or WebFetch on:
+```
+https://transparencyreport.google.com/safe-browsing/search?url=[DOMAIN]
+```
+
+**What it checks:** Malware, social engineering, unwanted software, potentially harmful applications.
+
+### Step 3: URLScan.io Public Search
+
+Free public search — no API key needed for viewing existing scans.
+
+**Method:** WebSearch for `site:urlscan.io "[DOMAIN]"` or WebFetch:
+```
+https://urlscan.io/search/#page.domain:[DOMAIN]
+```
+
+**What it provides:** Page screenshots, DOM snapshots, HTTP transactions, detected technologies, linked domains, IP associations.
+
+### Step 4: VirusTotal Public Page
+
+Free public lookup — no API key needed for basic results.
+
+**Method:** WebSearch for `site:virustotal.com "[DOMAIN]"` or fetch via `agent-browser`:
+```
+https://www.virustotal.com/gui/domain/[DOMAIN]
+```
+
+**What it provides:** Detection ratio across 70+ security engines, DNS history, WHOIS, subdomains, community comments.
+
+### Step 5: Scamadviser Reputation
+
+Free web-based trust score.
+
+**Method:** WebSearch for `site:scamadviser.com "[DOMAIN]"` or WebFetch:
+```
+https://www.scamadviser.com/check-website/[DOMAIN]
+```
+
+**What it provides:** Trust score (0-100), country of origin, owner info, website age, risk factors.
+
+### Step 6: PhishTank Database Check
+
+Free — no API key required for basic lookups.
+
+**Method:** WebSearch for `site:phishtank.org "[DOMAIN]"` or WebFetch:
+```
+https://phishtank.org/target_search.php?target=[DOMAIN]
+```
+
+**What it checks:** Whether the domain appears in the PhishTank verified phishing database.
+
+### Step 7: CheckPhish Free Scan
+
+Free URL scanning service.
+
+**Method:** WebSearch for `site:checkphish.bolster.ai "[DOMAIN]"` to find existing scan results.
+
+### Step 8: Domain Age & Registration Anomaly Check
+
+Use CLI tools already available (no API key):
+
+```bash
+whois [DOMAIN]
+```
+
+**Red flags to check:**
+- Domain age < 30 days — high risk for phishing/scam
+- Domain age < 90 days — elevated risk
+- Privacy-protected WHOIS on a site claiming to be a known brand
+- Registrar known for abuse-friendly policies
+- Recently updated nameservers (possible domain hijack)
+
+### Step 9: SSL Certificate Analysis
+
+```bash
+echo | openssl s_client -connect [DOMAIN]:443 -servername [DOMAIN] 2>/dev/null | openssl x509 -noout -subject -issuer -dates
+```
+
+**Red flags:**
+- Self-signed certificate on a commercial site
+- Let's Encrypt cert on a site impersonating a major brand (not inherently bad, but combined with other signals)
+- Certificate issued to a different domain than the one being visited
+- Expired certificate
+
+### Step 10: DNS-Based Blocklist Check
+
+Free DNS-based blocklist services — query via `dig`:
+
+```bash
+# Spamhaus DBL (Domain Block List)
+dig [DOMAIN].dbl.spamhaus.org +short
+
+# SURBL
+dig [DOMAIN].multi.surbl.org +short
+
+# URIBL
+dig [DOMAIN].multi.uribl.com +short
+```
+
+**Interpretation:** A non-empty response (typically 127.0.0.x) means the domain is listed.
+
+---
+
+## Output Format
+
+```
+SCAM/MALICIOUS CHECK: [DOMAIN]
+
+VERDICT: [SAFE / SUSPICIOUS / MALICIOUS / UNKNOWN]
+RISK SCORE: [0-100] (composite)
+
+SOURCE RESULTS
+┌─────────────────────┬────────────┬──────────────────────────┐
+│ Source               │ Status     │ Details                  │
+├─────────────────────┼────────────┼──────────────────────────┤
+│ PhishDestroy API     │ [CLEAN/HIT]│ risk_score: X, severity  │
+│ Google Safe Browsing │ [SAFE/FLAG]│ category if flagged      │
+│ URLScan.io           │ [CLEAN/HIT]│ scan count, flags        │
+│ VirusTotal           │ [X/Y]     │ detection ratio          │
+│ Scamadviser          │ [SCORE]   │ trust score 0-100        │
+│ PhishTank            │ [CLEAN/HIT]│ verified phishing Y/N    │
+│ Domain Age           │ [DAYS]    │ registration date        │
+│ SSL Certificate      │ [VALID/??]│ issuer, expiry           │
+│ DNS Blocklists       │ [X/3]     │ which lists triggered    │
+└─────────────────────┴────────────┴──────────────────────────┘
+
+RISK FACTORS
+- [List specific concerns: new domain, flagged by N engines, etc.]
+
+CONFIDENCE: [🟢 HIGH / 🟡 MEDIUM / 🔴 LOW]
+[Explain basis for confidence level]
+
+RECOMMENDATION
+[Clear action guidance: safe to proceed / exercise caution / do not interact]
+```
+
+---
+
+## Composite Risk Score Calculation
+
+| Factor | Weight | Scoring |
+|--------|--------|---------|
+| PhishDestroy risk_score | 25% | Direct score (0-100) |
+| VirusTotal detections | 25% | (detections/total_engines) * 100 |
+| Scamadviser trust | 15% | 100 - trust_score |
+| Domain age | 15% | <30d=100, <90d=70, <1yr=40, >1yr=10 |
+| DNS blocklist hits | 10% | (hits/3) * 100 |
+| PhishTank/GSB flags | 10% | Hit=100, Clean=0 |
+
+**Verdict thresholds:**
+- 0-20: SAFE
+- 21-45: LOW RISK
+- 46-70: SUSPICIOUS
+- 71-100: MALICIOUS
+
+---
+
+## Tool Priority
+
+1. **CLI first** — `whois`, `dig`, `openssl`, `curl` (PhishDestroy API)
+2. **Web search** — for URLScan.io, VirusTotal, Scamadviser indexed results
+3. **WebFetch** — for pages with static content
+4. **agent-browser** — for JavaScript-heavy results pages (VirusTotal, Scamadviser)
+
+---
+
+## Notes
+
+- All services used are free and require no API keys or authentication
+- PhishDestroy API is the only programmatic API called directly; all others use web search/fetch
+- False positives happen — a single flagged source does not confirm malicious intent
+- Domain age alone is not proof of malice — correlate with other signals
+- Always report which specific sources flagged the domain and which cleared it

package/skills/cti-expert/techniques/secret-scanning.md

@@ -0,0 +1,195 @@
+# Secret Scanning Module
+
+> **Module ID:** SEC-SCAN-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Exposed Credential & API Key Discovery
+
+---
+
+## 1. Overview
+
+Scans public repositories and web sources for accidentally committed secrets: API keys, tokens, passwords, private keys, and service credentials.
+
+**When to use:** Org/repo reconnaissance, security posture checks, pre-engagement recon, authorized red-team asset discovery.
+
+**Ethical boundary:** Never use discovered credentials for unauthorized access. Responsible disclosure is mandatory.
+
+---
+
+## 2. Tool Inventory
+
+| Priority | Tool | Purpose | Install |
+|----------|------|---------|---------|
+| Primary | TruffleHog | 800+ detectors, auto-verification | `pip3 install trufflehog` or `docker pull trufflesecurity/trufflehog` |
+| Secondary | Gitleaks | Regex + entropy scanning | `brew install gitleaks` / download from GitHub releases |
+| Tertiary | GitDorker | GitHub dork API queries | `git clone https://github.com/obheda12/GitDorker` |
+| Manual | Google Dorks | Web-based public repo search | No install — browser-based |
+
+---
+
+## 3. Investigation Workflow
+
+```
+1. Identify target scope (org name, domain, repo URLs)
+2. Run TruffleHog on known repos (--verified-only for actionable results)
+3. Run Gitleaks on cloned repos for broader entropy-based coverage
+4. Use GitDorker for GitHub search API across org
+5. Apply manual Google dorks for web-exposed secrets
+6. Deduplicate findings, classify severity
+7. Document and prepare responsible disclosure report
+```
+
+---
+
+## 4. CLI Commands & Expected Output
+
+### TruffleHog — single repo scan
+```bash
+trufflehog github --repo=https://github.com/<org>/<repo> --json
+```
+**Verified secrets only (reduce false positives):**
+```bash
+trufflehog github --repo=https://github.com/<org>/<repo> --only-verified --json
+```
+**Org-wide scan:**
+```bash
+trufflehog github --org=<org_name> --only-verified --json 2>/dev/null | tee trufflehog-results.json
+```
+**Expected output (JSON):**
+```json
+{
+  "SourceMetadata": { "Data": { "Github": { "repository": "...", "commit": "abc123", "file": "config.py", "line": 42 }}},
+  "DetectorName": "AWS",
+  "Verified": true,
+  "Raw": "AKIA..."
+}
+```
+
+### Gitleaks — cloned repo scan
+```bash
+git clone https://github.com/<org>/<repo> /tmp/target-repo
+gitleaks detect --source=/tmp/target-repo --report-format=json --report-path=gitleaks-report.json
+```
+**Scan git history:**
+```bash
+gitleaks detect --source=/tmp/target-repo --log-opts="--all" --report-format=json --report-path=gitleaks-history.json
+```
+**Expected output:**
+```json
+[{
+  "RuleID": "generic-api-key",
+  "Commit": "abc123",
+  "File": "src/config.js",
+  "StartLine": 15,
+  "Secret": "sk-...",
+  "Author": "dev@example.com",
+  "Date": "2024-01-10T09:22:00Z"
+}]
+```
+
+### GitDorker — GitHub search API
+```bash
+cd GitDorker
+python3 GitDorker.py -tf tokens.txt -q <domain.com> -d dorks/BHIS_toplevel_dorks.txt -o gitdorker-output.txt
+```
+**Requires:** Free GitHub token in `tokens.txt`
+
+### Manual Google Dorks
+```
+site:github.com "<domain.com>" password OR api_key OR secret
+site:github.com "<domain.com>" "BEGIN RSA PRIVATE KEY"
+site:github.com "<domain.com>" "Authorization: Bearer"
+site:github.com "<org_name>" ".env" OR "config.json" password
+site:github.com "<domain.com>" "db_password" OR "database_url"
+```
+
+---
+
+## 5. Fallback Cascade
+
+```
+TruffleHog unavailable
+  → Use Gitleaks (install from GitHub releases, no pip needed)
+
+Gitleaks unavailable
+  → Clone repo manually + grep patterns:
+    grep -rE "(api_key|secret|password|token)\s*[=:]\s*['\"][^'\"]{8,}" /tmp/target-repo
+
+GitHub API rate-limited
+  → Use unauthenticated Google dorks
+  → Use Sourcegraph: https://sourcegraph.com/search?q=<domain>+api_key
+
+No tool available
+  → Manual dork via browser:
+    https://github.com/search?q=<domain>+api_key&type=code
+```
+
+---
+
+## 6. Output Interpretation
+
+**TruffleHog `Verified: true`** — credential tested against live API and confirmed valid. Treat as critical.
+
+**TruffleHog `Verified: false`** — pattern matched but liveness unconfirmed. May be rotated or test data.
+
+**Gitleaks findings in commit history** — even if removed from HEAD, credentials may still be valid. Check rotation date.
+
+**Entropy score** — Gitleaks uses Shannon entropy. High entropy (>4.5) strings in assignments signal random keys. Lower entropy = likely human-readable (passwords, not tokens).
+
+---
+
+## 7. Confidence Ratings
+
+| Finding Type | Confidence | Notes |
+|--------------|-----------|-------|
+| TruffleHog verified=true | CRITICAL | Live credential confirmed |
+| TruffleHog verified=false | MEDIUM | May be rotated/test |
+| Gitleaks high entropy match | MEDIUM | Needs manual review |
+| Gitleaks rule-based match | MEDIUM | Context-dependent |
+| Google dork — config file | HIGH | Context-dependent validity |
+| GitDorker match | MEDIUM | Requires manual validation |
+
+---
+
+## 8. Limitations
+
+- **TruffleHog verification** makes live API calls — may trigger security alerts at target
+- **Rate limits:** GitHub Search API — 30 req/min (authenticated), 10/min (unauthenticated)
+- **History gaps:** Force-pushed commits or repo deletions hide secrets from scanners
+- **False positives:** Test credentials, placeholder values, example code inflate counts
+- **Private repos:** Not accessible without credentials — public surface only
+- **Rotation lag:** Credentials may appear in history but already rotated
+- **TruffleHog docker** recommended over pip for latest detector rules
+
+---
+
+## 9. Command Reference
+
+### `/secrets [target]`
+
+**Input:** GitHub org name, repo URL, or domain
+**Process:**
+1. Run TruffleHog org scan with `--only-verified`
+2. Clone top repos, run Gitleaks with `--log-opts="--all"`
+3. Apply GitDorker with standard dork list
+4. Deduplicate, classify by severity
+
+**Severity Classification:**
+- **Critical** — verified live credential (cloud keys, DB passwords, payment tokens)
+- **High** — unverified match for high-value service (Stripe, AWS, GitHub PAT)
+- **Medium** — generic API key or password, requires manual confirmation
+- **Low** — partial match, test/example data, public keys only
+
+**Output:** Sorted finding list with file, line, commit, secret type, severity, and responsible disclosure notes.
+
+---
+
+**Responsible Disclosure Reminder:**
+If live credentials are found during authorized assessment, notify the asset owner privately before any further action. Do not exfiltrate, use, or publicly disclose active credentials.
+
+---
+
+*Secret Scanning Module v1.0.0*
+*Part of Free OSINT Expert Skill - Phase 5*
+*For authorized security assessment and educational purposes only*