cyberaudit-skill 3.0.0

package/skills/cyberaudit/shared/SEVERITY-SCORING.md

@@ -0,0 +1,102 @@
+# 🎯 SCORING GUIDE — CYBERAUDIT SKILL
+# How to accurately assess each vulnerability
+
+═══════════════════════════════════════════════════════════════
+               CVSS 3.1 SCORING METHOD
+═══════════════════════════════════════════════════════════════
+
+CVSS VECTOR : AV:[X]/AC:[X]/PR:[X]/UI:[X]/S:[X]/C:[X]/I:[X]/A:[X]
+
+AV — ATTACK VECTOR (How does the attacker reach the target?)
+  N = Network      : Via internet (worst case)
+  A = Adjacent     : Same local network
+  L = Local        : Local access required
+  P = Physical     : Physical access required (best case)
+
+AC — ATTACK COMPLEXITY (Difficult to exploit?)
+  L = Low    : No special conditions
+  H = High   : Specific conditions required (race condition, etc.)
+
+PR — PRIVILEGES REQUIRED (Required privileges?)
+  N = None   : Anonymous (worst case)
+  L = Low    : Normal user
+  H = High   : Admin/Root required
+
+UI — USER INTERACTION (User interaction needed?)
+  N = None     : Direct exploitation
+  R = Required : Victim must click/take an action
+
+S — SCOPE (Impact beyond the vulnerable component?)
+  U = Unchanged : Impact limited to the component
+  C = Changed   : Impact on other components (worse)
+
+C — CONFIDENTIALITY IMPACT
+  H = High   : All data exposed
+  L = Low    : Partial data exposed
+  N = None   : No confidentiality impact
+
+I — INTEGRITY IMPACT
+  H = High   : All data modifiable
+  L = Low    : Partial modification possible
+  N = None   : No integrity impact
+
+A — AVAILABILITY IMPACT
+  H = High   : Service completely unavailable
+  L = Low    : Partial degradation
+  N = None   : No availability impact
+
+═══════════════════════════════════════════════════════════════
+               REAL-WORLD SCORING EXAMPLES
+═══════════════════════════════════════════════════════════════
+
+SQL INJECTION ON PUBLIC LOGIN
+  AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+  Score : 10.0 CRITICAL
+  Reason : Network, easy, anonymous, no interaction,
+           total impact on entire system
+
+IDOR ON AUTHENTICATED API  
+  AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
+  Score : 7.1 HIGH
+  Reason : Network, easy, but auth required,
+           full read but limited modification
+
+REFLECTED XSS WITH CSP
+  AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
+  Score : 4.7 MEDIUM
+  Reason : CSP mitigates impact, interaction required,
+           higher complexity with partial CSP
+
+MISSING X-CONTENT-TYPE-OPTIONS HEADER
+  AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
+  Score : 3.1 LOW
+  Reason : Complex exploitation, interaction required,
+           limited impact
+
+═══════════════════════════════════════════════════════════════
+               SCORING DECISIONS FOR THE AGENT
+═══════════════════════════════════════════════════════════════
+
+WHEN TO RAISE ONE LEVEL:
+  → Endpoint is accessible without authentication
+  → PII/financial/health data is involved
+  → Exploitation is documented with a public PoC
+  → The vulnerability is in the critical path (auth, payment)
+  → No other protection layers
+
+WHEN TO LOWER ONE LEVEL:
+  → Authentication required to exploit
+  → Only non-sensitive data impacted
+  → WAF or other protection in place and effective
+  → Internal network access only
+  → Exploitation requires very specific conditions
+
+ABSOLUTE SCORING RULES:
+  → Hardcoded prod secrets = CRITICAL minimum (always)
+  → SQLi without auth on user data = CRITICAL (always)
+  → Debug mode in production = HIGH minimum (always)
+  → MD5/SHA1 password = CRITICAL (always)
+  → JWT algorithm:none = CRITICAL (always)
+  → AsyncStorage with auth token = HIGH (always)
+  → Missing certificate pinning on financial app = CRITICAL
+  → Missing certificate pinning on standard app = HIGH

package/skills/cyberaudit/shared/THREAT-MODELING.md

@@ -0,0 +1,112 @@
+# 🎯 THREAT MODELING — CYBERAUDIT SKILL
+# Threat modeling framework for agents
+
+═══════════════════════════════════════════════════════════════
+               APPLIED STRIDE METHOD
+═══════════════════════════════════════════════════════════════
+
+STRIDE = 6 universal threat categories
+
+S — SPOOFING (Identity spoofing)
+  Question : "Can an attacker pretend to be someone else?"
+  Web      : Auth bypass, forged JWT, session hijacking, phishing
+  Mobile   : Spoofed certificate, fake app, deeplink hijacking
+  Control : Strong authentication, certificate pinning, MFA
+
+T — TAMPERING (Falsification)
+  Question : "Can an attacker modify data?"
+  Web      : SQLi, CSRF, mass assignment, man-in-the-middle
+  Mobile   : Binary tampering, traffic interception, storage modification
+  Control : Data integrity, signatures, HTTPS, validation
+
+R — REPUDIATION (Non-repudiation)
+  Question : "Can an attacker deny their actions?"
+  Web      : Insufficient logs, missing audit trail
+  Mobile   : No logging of sensitive actions
+  Control : Complete logging, timestamp, action signing
+
+I — INFORMATION DISCLOSURE (Information disclosure)
+  Question : "Can an attacker access confidential data?"
+  Web      : IDOR, error messages, source maps, exposed secrets
+  Mobile   : Plaintext storage, sensitive logs, binary strings
+  Control : Encryption, least privilege, output filtering
+
+D — DENIAL OF SERVICE (Denial of service)
+  Question : "Can an attacker make the service unavailable?"
+  Web      : No rate limiting, expensive requests not limited
+  Mobile   : Battery drain attacks, excessive network requests
+  Control : Rate limiting, timeouts, circuit breakers
+
+E — ELEVATION OF PRIVILEGE (Privilege escalation)
+  Question : "Can an attacker obtain more rights?"
+  Web      : BFLA, mass role assignment, IDOR on admin
+  Mobile   : Jailbreak bypass, root privilege abuse
+  Control : Strict RBAC, rights verification, least privilege
+
+═══════════════════════════════════════════════════════════════
+               ATTACK TREE BY APP TYPE
+═══════════════════════════════════════════════════════════════
+
+E-COMMERCE (Priorities)
+  1. Payment bypass (business logic)
+  2. Credit card data theft
+  3. Account takeover → fraudulent purchase
+  4. Price manipulation
+  5. Personal data theft (GDPR)
+
+SaaS B2B (Priorities)
+  1. Access to other tenants' data (isolation)
+  2. Admin account takeover
+  3. Mass data export
+  4. API abuse / scraping
+  5. Privilege escalation between plans
+
+HEALTH / FINANCE APP (Priorities)
+  1. Access to others' medical/financial data
+  2. Modification of critical data
+  3. Credential compromise
+  4. Regulatory non-compliance (HIPAA, PCI-DSS)
+  5. Insufficient logging for legal audit
+
+FINANCIAL MOBILE APP (Priorities)
+  1. Token/session theft on compromised device
+  2. Transaction interception (MitM)
+  3. Amount manipulation
+  4. Screenshot / recording of sensitive data
+  5. Root/jailbreak bypass of protections
+
+═══════════════════════════════════════════════════════════════
+               COMMON KILL CHAINS
+═══════════════════════════════════════════════════════════════
+
+KILL CHAIN 1 — ACCOUNT TAKEOVER VIA RESET PASSWORD
+  1. Account enumeration via /forgot-password
+     (different message depending on whether email exists)
+  2. Predictable reset token or no expiration
+  3. Token intercepted or brute forced
+  4. Account compromised → access to all data
+
+KILL CHAIN 2 — DATA BREACH VIA CHAINED IDOR
+  1. Discovery of an endpoint with sequential ID
+     GET /api/orders/1234
+  2. Enumeration : 1234, 1235, 1236...
+  3. Extraction of all orders/data
+  4. Personal data of all users exposed
+
+KILL CHAIN 3 — RCE VIA FILE UPLOAD + PATH TRAVERSAL
+  1. Upload a .php file disguised as .jpg
+     (MIME type spoofed)
+  2. File stored in a web-accessible directory
+  3. Direct access to the uploaded file
+  4. PHP code execution → shell → RCE
+
+KILL CHAIN 4 — MOBILE DATA BREACH VIA BACKUP
+  1. Android app without backup restrictions
+     android:allowBackup="true"
+  2. ADB backup extracted without root required
+  3. AsyncStorage/SharedPreferences read in plaintext
+  4. Authentication tokens extracted
+  5. Session hijacking on any device
+
+These kill chains must be documented when the exploitation
+conditions are met in the audited code.

package/skills/cyberaudit/web/WEB-CHECKLIST.md

@@ -0,0 +1,222 @@
+# ✅ MASTER CHECKLIST WEB — CYBERAUDIT SKILL
+# The ultimate checklist — Never skip a line
+
+═══════════════════════════════════════════════════════════════
+  INSTRUCTIONS: Check each item. Document every ❌.
+  A ❌ = a potential finding to investigate.
+  A ⚠️ = context-dependent, investigate and justify.
+═══════════════════════════════════════════════════════════════
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 1 — SECRETS AND CONFIGURATION
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ No API key in source code
+  □ No password in source code
+  □ No private key in source code
+  □ No token in source code
+  □ No secret in comments
+  □ No secret in test files
+  □ No .env file committed in git
+  □ .env in .gitignore (check the file)
+  □ Environment variables validated at startup
+  □ Debug/development mode disabled in prod
+  □ Error handling does not reveal stack trace in prod
+  □ Headers revealing technology removed
+    (X-Powered-By, Server, X-AspNet-Version)
+  □ Version information not publicly exposed
+  □ Debug/info endpoints disabled in prod
+    (/phpinfo, /debug, /.env, /server-status, etc.)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 2 — AUTHENTICATION
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Passwords hashed with bcrypt/argon2/scrypt
+  □ MD5, SHA1, SHA256 (without salt) never used for passwords
+  □ Unique salt per password
+  □ Strong password policy (minimum length)
+  □ Rate limiting on login attempts
+  □ Lockout after N failures (or CAPTCHA)
+  □ JWT: verify() used (not decode())
+  □ JWT: algorithm explicitly specified
+  □ JWT: algorithm "none" refused
+  □ JWT: expiration configured (access ≤ 15min)
+  □ JWT: refresh tokens with rotation
+  □ JWT: revocation possible (blacklist or rotation)
+  □ Sessions: cryptographically random ID
+  □ Sessions: regeneration after login
+  □ Sessions: invalidation on logout
+  □ Sessions: inactivity expiration configured
+  □ Reset password: random and unique token
+  □ Reset password: short expiration (15-30min)
+  □ Reset password: single-use token
+  □ Reset password: message not revealing account existence
+  □ OAuth: state parameter validated (anti-CSRF)
+  □ OAuth: redirect_uri strictly validated
+  □ MFA: available on sensitive accounts
+  □ Default credentials nonexistent
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 3 — AUTHORIZATION
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Auth verification server-side on EVERY endpoint
+  □ Public routes explicitly defined (whitelist)
+  □ RBAC implemented and verified server-side
+  □ Ownership verified for every resource access
+    (Can the user access THIS object?)
+  □ Predictable IDs avoided (UUIDs or opaque IDs)
+  □ Mass assignment: whitelist of allowed fields
+  □ Sensitive fields excluded from mass updates
+    (role, is_admin, balance, verified, etc.)
+  □ Admin function access verified, not just hidden
+  □ Privilege elevation via parameter impossible
+  □ Pagination: server-side limit enforced
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 4 — INJECTION
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ SQL queries: only parameterized or ORM
+  □ No variable interpolation in SQL queries
+  □ NoSQL queries: injection operators impossible
+  □ OS commands: exec/system with user input absent
+  □ Templates: user input not injected into engines
+  □ File paths: confined to allowed directory
+  □ Uploaded filenames: regenerated randomly
+  □ XML: external entities disabled
+  □ GraphQL: introspection disabled in prod
+  □ GraphQL: query depth and complexity limited
+  □ Logs: log injection impossible (newlines filtered)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 5 — XSS AND OUTPUT
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ All HTML output encoded/escaped
+  □ Direct innerHTML absent (or sanitized)
+  □ dangerouslySetInnerHTML with DOMPurify if used
+  □ Blade {!! !!} with HTMLPurifier if used
+  □ URLs in href validated (not javascript:)
+  □ Correct Content-Type on all responses
+  □ JSON: Content-Type: application/json (not text/html)
+  □ CSP configured and restrictive
+  □ X-Content-Type-Options: nosniff present
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 6 — CSRF AND CLICKJACKING
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ CSRF tokens on all POST forms
+  □ CSRF verification server-side
+  □ SameSite=Strict or Lax on session cookies
+  □ Webhooks: HMAC signature verified
+  □ X-Frame-Options or CSP frame-ancestors configured
+  □ Destructive actions require explicit confirmation
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 7 — SECURITY HEADERS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Content-Security-Policy configured
+  □ Strict-Transport-Security configured (HSTS)
+    (max-age=31536000; includeSubDomains; preload)
+  □ X-Frame-Options: DENY or SAMEORIGIN
+  □ X-Content-Type-Options: nosniff
+  □ Referrer-Policy configured
+  □ Permissions-Policy configured
+  □ Cache-Control: no-store on sensitive data
+  □ HTTPS only (no HTTP downgrade possible)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 8 — CORS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Access-Control-Allow-Origin: * absent on authenticated APIs
+  □ CORS origins whitelisted explicitly
+  □ credentials: true never combined with origin: *
+  □ CORS methods limited to necessary
+  □ CORS headers limited to necessary
+  □ Preflight properly handled
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 9 — FILE UPLOAD
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ MIME type verified server-side (not just extension)
+  □ Whitelist of allowed extensions
+  □ Maximum size enforced
+  □ Filename regenerated randomly
+  □ Files stored outside webroot
+  □ Code execution impossible in upload folder
+  □ Antivirus scan on uploads (if critical)
+  □ Image resize/recompress to strip metadata
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 10 — DEPENDENCIES
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ npm audit / yarn audit / composer audit: clean?
+  □ No critical or high CVE unaddressed
+  □ Lock files committed (package-lock.json, yarn.lock, composer.lock)
+  □ Direct dependencies only from npm/packagist
+  □ Main framework up to date (or close)
+  □ Abandoned dependencies identified and replaced
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 11 — RATE LIMITING & DOS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Global rate limiting configured
+  □ Specific rate limiting on: login, register, reset-password
+  □ Rate limiting on expensive endpoints (upload, export, search)
+  □ Pagination: page size limited server-side
+  □ Timeouts configured on outgoing requests
+  □ Body size limited (no infinite upload in memory)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 12 — LOGGING AND MONITORING
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Auth events logged (login, logout, failures)
+  □ Sensitive actions logged (deletion, role modification)
+  □ Logs do not contain sensitive data
+    (no passwords, tokens, card numbers in logs)
+  □ Logs structured (JSON) and centralized
+  □ Alerts configured on suspicious events
+  □ Logs integrity-protected (append-only or SIEM)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 13 — SSRF
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ No HTTP request based on a user-provided URL
+    without strict validation
+  □ If URL fetch necessary: whitelist of allowed domains
+  □ Access to cloud metadata blocked
+    (169.254.169.254, fd00:ec2::254)
+  □ Access to internal network (10.x, 172.x, 192.168.x) blocked
+  □ Redirect following: limited and validated
+  □ DNS rebinding: protections in place
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 14 — CRYPTOGRAPHY
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  □ Modern algorithms only:
+    Encryption    : AES-256-GCM, ChaCha20-Poly1305
+    Data hashing  : SHA-256 minimum
+    Password hash : bcrypt, argon2, scrypt
+    Asymmetric    : RSA-2048+, ECDSA P-256+
+  □ DES, 3DES, RC4, MD5, SHA1 absent
+  □ Encryption keys stored separately from data
+  □ Unique IV/Nonce per encryption
+  □ Cryptographically secure random generation
+    (crypto.randomBytes, openssl_random_pseudo_bytes)
+  □ Sensitive data encrypted in database
+  □ Encryption keys rotated regularly
+
+═══════════════════════════════════════════════════════════════
+SCORE : [___ compliant items] / [___ applicable items] = ____%
+═══════════════════════════════════════════════════════════════