cyberaudit-skill 3.0.0

package/skills/cyberaudit/web/vulnerabilities/CORS.md

@@ -0,0 +1,117 @@
+# 🌐 CORS — CROSS-ORIGIN RESOURCE SHARING GUIDE
+
+═══════════════════════════════════════════════════════════════
+               UNDERSTANDING CORS
+═══════════════════════════════════════════════════════════════
+
+SOP (Same-Origin Policy) = Browser protection
+  By default, the browser blocks cross-origin requests.
+  CORS is a mechanism to selectively RELAX SOP.
+
+Misconfigured CORS = Useless SOP
+
+CORS CONCERNS :
+  → JS fetch/axios requests from the browser
+  → Not curl, Postman, or server-to-server requests
+  → Only what the browser enforces
+
+SO : CORS is protection against browser attacks
+       NOT against direct server-side calls
+
+═══════════════════════════════════════════════════════════════
+               DANGEROUS PATTERNS
+═══════════════════════════════════════════════════════════════
+
+CRITICAL PATTERN — Wildcard with credentials
+  DETECT :
+    Access-Control-Allow-Origin: *
+    Access-Control-Allow-Credentials: true
+
+  IMPACT :
+    Any site can make authenticated requests
+    Session data theft, actions on behalf of the user
+
+  NOTE : Modern browsers refuse * + credentials
+         But some custom configs allow it
+
+CRITICAL PATTERN — Origin reflection without validation
+  DETECT :
+    // Bad "dynamic" implementation
+    const origin = req.headers.origin
+    res.setHeader('Access-Control-Allow-Origin', origin) // Reflect everything!
+    res.setHeader('Access-Control-Allow-Credentials', 'true')
+
+  IMPACT :
+    Any origin is accepted → equivalent to *
+    But with credentials → even worse than *
+
+HIGH PATTERN — null origin accepted
+  DETECT :
+    if (origin === 'null' || allowedOrigins.includes(origin)) {
+      res.setHeader('Access-Control-Allow-Origin', origin)
+    }
+
+  IMPACT :
+    Local files (file://) and sandboxed iframes
+    send Origin: null → access granted
+
+HIGH PATTERN — Overly broad subdomains
+  DETECT :
+    // Poorly written regex
+    if (origin.endsWith('.yourapp.com')) {
+      // evil.yourapp.com.attacker.com → passes!
+    }
+
+    // Better but still risky if subdomains compromised :
+    if (origin.match(/\.yourapp\.com$/)) {
+      // An XSS'd subdomain compromises everything
+    }
+
+═══════════════════════════════════════════════════════════════
+               CORS REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+COMPLETE SECURE CONFIGURATION
+  const ALLOWED_ORIGINS = new Set([
+    'https://yourapp.com',
+    'https://www.yourapp.com',
+    'https://admin.yourapp.com',
+    ...(process.env.NODE_ENV === 'development'
+      ? ['http://localhost:3000', 'http://localhost:3001']
+      : [])
+  ])
+
+  function corsMiddleware(req, res, next) {
+    const origin = req.headers.origin
+
+    if (!origin) {
+      // Request without Origin (curl, Postman, server-to-server)
+      // Allow but without CORS header
+      return next()
+    }
+
+    if (ALLOWED_ORIGINS.has(origin)) {
+      res.setHeader('Access-Control-Allow-Origin', origin)
+      res.setHeader('Access-Control-Allow-Credentials', 'true')
+      res.setHeader('Access-Control-Allow-Methods',
+        'GET, POST, PUT, PATCH, DELETE, OPTIONS')
+      res.setHeader('Access-Control-Allow-Headers',
+        'Content-Type, Authorization, X-Requested-With')
+      res.setHeader('Access-Control-Max-Age', '86400') // Cache preflight
+
+      if (req.method === 'OPTIONS') {
+        return res.status(204).end()
+      }
+    } else {
+      // Silently reject (no CORS header)
+      // The browser will block the request
+    }
+
+    next()
+  }
+
+  // Vary header important for caches
+  app.use((req, res, next) => {
+    res.setHeader('Vary', 'Origin')
+    next()
+  })

package/skills/cyberaudit/web/vulnerabilities/CSRF.md

@@ -0,0 +1,131 @@
+# 🎭 CSRF — CROSS-SITE REQUEST FORGERY GUIDE
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+CSRF = The attacker forces the victim's browser
+       to send an authenticated request without their knowledge.
+
+Prerequisites :
+  → The victim is logged into the target application
+  → The application uses session cookies
+  → No CSRF protection in place
+
+OWASP : A01:2021 (in Broken Access Control)
+CWE   : CWE-352
+
+ATTACK EXAMPLE :
+  1. Victim is logged into bank.com
+  2. Victim visits evil.com
+  3. evil.com contains :
+     <img src="https://bank.com/transfer?to=attacker&amount=1000">
+  4. The browser sends the request with bank.com cookies
+  5. Transfer made without the victim's knowledge
+
+═══════════════════════════════════════════════════════════════
+               PATTERNS TO DETECT
+═══════════════════════════════════════════════════════════════
+
+CSRF DISABLED (Laravel)
+  Route::withoutMiddleware([VerifyCsrfToken::class])
+       ->group(...)
+
+  // In VerifyCsrfToken.php
+  protected $except = [
+      '*',  // CRITICAL : disables CSRF everywhere
+      'api/*',
+  ]
+
+CSRF MISSING (API without protection)
+  // API accepting mutations without CSRF token
+  // AND without Origin verification
+  app.post('/api/delete-account', deleteAccountHandler)
+
+SameSite NOT CONFIGURED
+  res.cookie('session', token, {
+    httpOnly: true,
+    secure: true,
+    // SameSite missing → default depends on browser
+  })
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+APPROACH 1 — SAMESITE COOKIES (modern, recommended)
+  res.cookie('session', token, {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'Strict',  // Or 'Lax' for incoming links
+    // Strict : Cookie sent only on first-party navigation
+    // Lax    : Cookie sent for links, not for sub-resources
+    // None   : Sent everywhere (requires Secure=true)
+  })
+
+  // SameSite=Lax vs Strict :
+  // Strict : login lost if user comes from external link
+  // Lax    : Balance security/UX
+  // → Recommendation : Lax for public apps, Strict for sensitive apps
+
+APPROACH 2 — CSRF TOKEN (classic)
+  LARAVEL :
+    // Automatic with VerifyCsrfToken middleware
+    // In Blade forms :
+    <form method="POST">
+      @csrf
+      ...
+    </form>
+
+    // For JS API calls :
+    fetch('/api/data', {
+      method: 'POST',
+      headers: { 'X-CSRF-TOKEN': document.cookie.match(/XSRF-TOKEN=([^;]+)/)?.[1] }
+    })
+
+  NODE.JS WITH CSURF (deprecated) or csrf-csrf :
+    import { doubleCsrf } from 'csrf-csrf'
+
+    const { generateToken, doubleCsrfProtection } = doubleCsrf({
+      getSecret: () => process.env.CSRF_SECRET,
+      cookieName: '__Host-psifi.x-csrf-token',
+      cookieOptions: { sameSite: 'Strict', secure: true }
+    })
+
+    app.use(doubleCsrfProtection)
+
+APPROACH 3 — ORIGIN VERIFICATION
+  // For APIs without cookies (JWT in headers)
+  // CSRF is not applicable if token is in Authorization header
+  // CORS is the protection in this case
+
+  // Verify Origin for mutations :
+  app.use((req, res, next) => {
+    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
+      const origin = req.headers.origin
+      const referer = req.headers.referer
+
+      const allowedOrigins = ['https://yourapp.com']
+
+      if (origin && !allowedOrigins.includes(origin)) {
+        return res.status(403).json({ error: 'Origin not allowed' })
+      }
+    }
+    next()
+  })
+
+WEBHOOKS — SPECIAL CASE
+  // Webhooks receive POST from third-party services
+  // Exclude from CSRF BUT validate HMAC signature
+
+  // Stripe
+  app.post('/webhooks/stripe',
+    express.raw({ type: 'application/json' }),  // Raw body for signature
+    (req, res) => {
+      const sig = req.headers['stripe-signature']
+      const event = stripe.webhooks.constructEvent(
+        req.body, sig, process.env.STRIPE_WEBHOOK_SECRET
+      )
+      // ... processing
+    }
+  )

package/skills/cyberaudit/web/vulnerabilities/DESERIALIZATION.md

@@ -0,0 +1,96 @@
+# 💣 DESERIALIZATION — VULNERABILITY GUIDE
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+INSECURE DESERIALIZATION =
+  Deserializing untrusted data can lead to :
+  → Remote Code Execution (RCE) via gadget chains
+  → Object injection with malicious behavior
+  → DoS via malformed objects
+
+OWASP : A08:2021 — Software and Data Integrity Failures
+CWE   : CWE-502
+
+MOST AT-RISK LANGUAGES :
+  → PHP (unserialize)
+  → Java (ObjectInputStream)
+  → Python (pickle)
+  → Ruby (Marshal)
+  → Node.js (rare but possible)
+
+═══════════════════════════════════════════════════════════════
+               PATTERNS TO DETECT
+═══════════════════════════════════════════════════════════════
+
+PHP — CRITICAL :
+  unserialize($userInput)
+  unserialize(base64_decode($cookie))
+  unserialize(base64_decode($_COOKIE['cart']))
+  unserialize(file_get_contents($userProvidedPath))
+
+  // Second-order : data deserialized from DB
+  // that was inserted via user input
+
+PYTHON — CRITICAL :
+  pickle.loads(userInput)
+  pickle.load(file_from_user)
+  yaml.load(userInput)  // PyYAML without Loader=yaml.SafeLoader
+
+NODE.JS — LESS COMMON BUT PRESENT :
+  // node-serialize
+  serialize.unserialize(userInput)
+  // eval() in custom parsers
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+PHP :
+  // ❌ Never deserialize user data
+  unserialize($userInput) // Never
+
+  // ✅ Use JSON
+  $data = json_decode($userInput, true)
+
+  // ✅ If serialize() needed for internal cache :
+  //    Ensure data never comes from the user
+  //    Sign serialized data with HMAC
+  $serialized = serialize($data)
+  $hmac = hash_hmac('sha256', $serialized, $secret)
+  $stored = $hmac . ':' . $serialized
+
+  // On read :
+  [$storedHmac, $storedData] = explode(':', $stored, 2)
+  if (!hash_equals($storedHmac, hash_hmac('sha256', $storedData, $secret))) {
+    throw new Exception('Corrupted data')
+  }
+  $data = unserialize($storedData)
+
+PYTHON :
+  # ❌ Never pickle with user input
+  data = pickle.loads(userInput)  # RCE possible
+
+  # ✅ JSON
+  data = json.loads(userInput)
+
+  # ✅ Secure PyYAML
+  data = yaml.load(userInput, Loader=yaml.SafeLoader)
+  # yaml.SafeLoader does not execute Python code
+
+  # If pickle needed for internal cache :
+  # Sign with hmac before storage
+  import hmac, hashlib, pickle
+
+  def safe_serialize(data, secret):
+      pickled = pickle.dumps(data)
+      sig = hmac.new(secret, pickled, hashlib.sha256).digest()
+      return sig + pickled
+
+  def safe_deserialize(data, secret):
+      sig, pickled = data[:32], data[32:]
+      expected = hmac.new(secret, pickled, hashlib.sha256).digest()
+      if not hmac.compare_digest(sig, expected):
+          raise ValueError('Invalid signature')
+      return pickle.loads(pickled)

package/skills/cyberaudit/web/vulnerabilities/HEADERS.md

@@ -0,0 +1,105 @@
+# 🛡️ SECURITY HEADERS — VULNERABILITY GUIDE
+
+═══════════════════════════════════════════════════════════════
+               ESSENTIAL SECURITY HEADERS
+═══════════════════════════════════════════════════════════════
+
+EACH MISSING HEADER = MISSING PROTECTION
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+CONTENT-SECURITY-POLICY (CSP)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ROLE    : Controls authorized sources for each resource type
+  PROTECTS : XSS, script injection, clickjacking, data exfiltration
+  MISSING  : XSS can execute arbitrary code
+
+  CHECK :
+    □ Present on all HTML pages
+    □ Restrictive default-src
+    □ unsafe-inline absent from script-src
+    □ unsafe-eval absent from script-src
+    □ frame-ancestors configured
+    □ base-uri configured (prevents base tag injection)
+    □ form-action configured
+
+  TEST : https://csp-evaluator.withgoogle.com/
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+STRICT-TRANSPORT-SECURITY (HSTS)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ROLE    : Forces the browser to use HTTPS only
+  PROTECTS : SSL stripping, downgrade attacks
+  MISSING  : HTTP connection possible → MitM
+
+  RECOMMENDED VALUE :
+    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+
+  CHECK :
+    □ max-age ≥ 31536000 (1 year)
+    □ includeSubDomains if all subdomains are HTTPS
+    □ preload to be in browser HSTS list
+    □ Server on HTTPS (otherwise this header is ignored)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+X-FRAME-OPTIONS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ROLE    : Prevents loading in an iframe
+  PROTECTS : Clickjacking
+  MISSING  : The app can be loaded in a malicious iframe
+
+  RECOMMENDED VALUE :
+    X-Frame-Options: DENY
+    // OR if embedding needed :
+    X-Frame-Options: SAMEORIGIN
+
+  NOTE : Replaced by CSP frame-ancestors but X-Frame-Options
+         is still supported by older browsers
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+X-CONTENT-TYPE-OPTIONS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ROLE    : Prevents MIME sniffing
+  PROTECTS : Malicious file upload served as HTML/JS
+  MISSING  : Uploaded file interpreted with wrong MIME type
+
+  SINGLE VALUE :
+    X-Content-Type-Options: nosniff
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+REFERRER-POLICY
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ROLE    : Controls info sent in the Referer header
+  PROTECTS : Sensitive URL leakage (tokens in URL, internal paths)
+
+  RECOMMENDED VALUE :
+    Referrer-Policy: strict-origin-when-cross-origin
+    // Sends : origin only for cross-origin, full URL for same-origin
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+PERMISSIONS-POLICY
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ROLE    : Controls available browser APIs
+  PROTECTS : Unauthorized access to camera, mic, geolocation
+
+  RECOMMENDED VALUE :
+    Permissions-Policy: camera=(), microphone=(), geolocation=(),
+                        payment=(), usb=(), bluetooth=()
+    // Disable everything the app does not use
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+HEADERS TO REMOVE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  X-Powered-By     → Reveals Express, PHP version, etc.
+  Server           → Reveals nginx/apache version
+  X-AspNet-Version → Reveals .NET version
+  X-AspNetMvc-Version
+
+  This info helps an attacker target specific CVEs.
+
+═══════════════════════════════════════════════════════════════
+               TEST TOOL
+═══════════════════════════════════════════════════════════════
+
+  → https://securityheaders.com/
+  → https://observatory.mozilla.org/
+  → curl -I https://yourapp.com

package/skills/cyberaudit/web/vulnerabilities/IDOR-BOLA.md

@@ -0,0 +1,153 @@
+# 🎯 IDOR / BOLA — VULNERABILITY GUIDE
+# Insecure Direct Object Reference / Broken Object Level Authorization
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+IDOR = Access to a resource by manipulating its identifier
+       without verifying the user has permission.
+
+BOLA = OWASP API Security term for the same concept on the API side.
+
+It is the most common and most impactful vulnerability
+in modern web applications.
+
+OWASP Top 10 : A01:2021
+OWASP API    : API1:2023
+
+═══════════════════════════════════════════════════════════════
+               DETECTING IDOR
+═══════════════════════════════════════════════════════════════
+
+SEARCH EVERYWHERE AN ID IS USED :
+  URLs          : /api/users/123, /documents/456
+  Body          : { "userId": 123, "orderId": 456 }
+  Query params  : ?accountId=789&fileId=101
+  Headers       : X-User-Id: 123 (custom headers)
+
+TYPES OF IDOR :
+  Sequential numeric IDs   : /order/1042 → /order/1041
+  Base64 IDs               : /file/dXNlcjEyMw==
+  UUIDs exposed in API     : If listing possible → enumeration
+  Predictable file names   : /uploads/invoice_user123_2024.pdf
+  File paths               : /download?path=users/123/file.pdf
+
+VULNERABLE CODE TO DETECT :
+  // Node.js
+  app.get('/api/orders/:id', async (req, res) => {
+    const order = await Order.findById(req.params.id)
+    // NO check that order.userId === req.user.id !
+    res.json(order)
+  })
+
+  // PHP/Laravel
+  public function show($id) {
+    $invoice = Invoice::find($id)
+    return $invoice // NO ownership check!
+  }
+
+  // Prisma/TypeORM
+  async getDocument(id: string) {
+    return this.db.document.findUnique({ where: { id } })
+    // No where userId!
+  }
+
+═══════════════════════════════════════════════════════════════
+               IDOR VARIANTS
+═══════════════════════════════════════════════════════════════
+
+INDIRECT IDOR (most often missed)
+  // A can access B that belongs to C without being C
+  GET /api/projects/123/members
+  // The user is a member of project 123
+  // But do they have the right to see the members?
+
+IDOR VIA RELATIONS
+  GET /api/comments/456
+  // Comment 456 belongs to a private post
+  // But comment access does not check post visibility
+
+IDOR IN BATCH OPERATIONS
+  DELETE /api/messages?ids=1,2,3,4,5
+  // Is each ID verified individually?
+
+IDOR IN WRITE OPERATIONS (often more severe)
+  PUT /api/profiles/123
+  // User 456 modifies profile 123
+
+IDOR VIA EXPORT
+  GET /api/export?userId=123
+  // Exports user 123's data
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+FUNDAMENTAL PRINCIPLE :
+  The user ID ALWAYS comes from the token/session.
+  NEVER from the body, params, or query strings.
+
+UNIVERSAL FIX PATTERN :
+  // Instead of :
+  resource = findById(requestedId)
+
+  // Always :
+  resource = findById(requestedId, WHERE ownerId = currentUserId)
+
+NODE.JS — COMPLETE FIX
+  // Middleware that extracts user from token
+  const getCurrentUser = (req) => {
+    // Already done by JWT middleware
+    return req.user // Comes from the token, not the body
+  }
+
+  // Secured route
+  app.get('/api/orders/:orderId', auth, async (req, res) => {
+    const currentUser = getCurrentUser(req)
+
+    const order = await Order.findOne({
+      where: {
+        id:     req.params.orderId,
+        userId: currentUser.id,  // Ownership check integrated in query
+      }
+    })
+
+    if (!order) {
+      // 404 rather than 403 : don't confirm the resource exists
+      return res.status(404).json({ error: 'Resource not found' })
+    }
+
+    res.json(order)
+  })
+
+USE UUIDS
+  // Instead of sequential IDs :
+  id: 1042, 1043, 1044... → trivial to enumerate
+
+  // Use UUIDs v4 :
+  id: "f47ac10b-58cc-4372-a567-0e02b2c3d479"
+  // Impossible to guess, but ownership check remains mandatory!
+
+IDOR MONITORING
+  // Alert on abnormal access patterns
+  const accessLog = async (userId, resourceId, success) => {
+    await AuditLog.create({
+      userId, resourceId, success,
+      timestamp: new Date(),
+      ip: req.ip,
+    })
+
+    // If >10 denied accesses in 1 minute → alert
+    const recentFailures = await AuditLog.count({
+      where: {
+        userId,
+        success: false,
+        timestamp: { $gt: new Date(Date.now() - 60000) }
+      }
+    })
+
+    if (recentFailures > 10) {
+      await alertSecurityTeam({ userId, type: 'possible_idor_scan' })
+    }
+  }