open-sploit 1.2.0

package/template/skills/hackerone/tools/sensitive_data_tracker.py

@@ -0,0 +1,495 @@
+#!/usr/bin/env python3
+"""
+Sensitive Data Metadata Tracker for HackerOne Bug Bounty Testing
+
+Tracks and documents all credentials, tokens, and sensitive data discovered
+during penetration testing in a structured JSON format.
+"""
+
+import json
+import os
+from datetime import datetime, timezone
+from typing import Dict, List, Optional, Any
+import hashlib
+
+
+class SensitiveDataTracker:
+    """Track sensitive data discovered during penetration testing"""
+
+    CATEGORIES = [
+        "credentials",
+        "api_keys_and_tokens",
+        "private_data",
+        "configuration_data",
+        "user_pii",
+        "other_sensitive"
+    ]
+
+    SEVERITY_LEVELS = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"]
+
+    def __init__(self, program_name: str, asset_identifier: str, output_dir: str):
+        """
+        Initialize sensitive data tracker
+
+        Args:
+            program_name: HackerOne program name
+            asset_identifier: Asset being tested (URL, domain, etc.)
+            output_dir: Directory to save metadata files
+        """
+        self.program_name = program_name
+        self.asset_identifier = asset_identifier
+        self.output_dir = output_dir
+
+        # Ensure output directory exists
+        os.makedirs(output_dir, exist_ok=True)
+
+        # Initialize metadata structure
+        self.metadata = {
+            "program": program_name,
+            "asset_identifier": asset_identifier,
+            "testing_date_start": datetime.now(timezone.utc).isoformat(),
+            "testing_date_end": None,
+            "tester": "Pentester Agent",
+            "sensitive_data_categories": {cat: [] for cat in self.CATEGORIES},
+            "summary": {
+                "total_items_discovered": 0,
+                "by_category": {cat: 0 for cat in self.CATEGORIES},
+                "by_severity": {level: 0 for level in self.SEVERITY_LEVELS},
+                "highest_risk_finding": None
+            },
+            "remediation_status": "pending"
+        }
+
+        self._save_metadata()
+
+    def add_sensitive_data(
+        self,
+        category: str,
+        data_type: str,
+        location: str,
+        finding_id: str,
+        data_preview: Dict[str, Any],
+        severity: str,
+        impact_assessment: Dict[str, Any],
+        evidence: Optional[Dict[str, str]] = None,
+        remediation: Optional[str] = None
+    ) -> None:
+        """
+        Add discovered sensitive data to tracking
+
+        Args:
+            category: Data category (credentials, api_keys_and_tokens, etc.)
+            data_type: Type within category (e.g., username_password, api_key)
+            location: Where data was found
+            finding_id: Associated finding ID
+            data_preview: Preview of data (with redaction)
+            severity: CRITICAL, HIGH, MEDIUM, LOW, INFO
+            impact_assessment: Business impact analysis
+            evidence: Files/screenshots proving discovery
+            remediation: Recommended remediation action
+        """
+
+        if category not in self.CATEGORIES:
+            raise ValueError(f"Invalid category: {category}")
+
+        if severity not in self.SEVERITY_LEVELS:
+            raise ValueError(f"Invalid severity: {severity}")
+
+        item = {
+            "type": data_type,
+            "location": location,
+            "finding_id": finding_id,
+            "discovered_date": datetime.now(timezone.utc).isoformat(),
+            "data": data_preview,
+            "severity": severity,
+            "impact_assessment": impact_assessment,
+            "evidence": evidence or {},
+            "remediation": remediation or "Review and rotate credentials",
+            "status": "discovered"
+        }
+
+        # Add to metadata
+        self.metadata["sensitive_data_categories"][category].append(item)
+
+        # Update summary
+        self.metadata["summary"]["total_items_discovered"] += 1
+        self.metadata["summary"]["by_category"][category] += 1
+        self.metadata["summary"]["by_severity"][severity] += 1
+
+        # Update highest risk finding
+        if severity == "CRITICAL":
+            if not self.metadata["summary"]["highest_risk_finding"]:
+                self.metadata["summary"]["highest_risk_finding"] = finding_id
+
+        # Save immediately to avoid data loss
+        self._save_metadata()
+
+        print(f"[+] Logged {category}/{data_type} (severity: {severity})")
+
+    def add_credentials(
+        self,
+        username: str,
+        password_hash: str,
+        account_type: str,
+        location: str,
+        finding_id: str,
+        hash_algorithm: Optional[str] = None,
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add discovered credentials"""
+
+        data_preview = {
+            "username": username if username else "[REDACTED]",
+            "password_hash": password_hash if password_hash else "[REDACTED]",
+            "account_type": account_type,
+            "hash_algorithm": hash_algorithm
+        }
+
+        impact = {
+            "severity": "CRITICAL",
+            "risk": "Account takeover, privilege escalation",
+            "potential_actions": ["account_takeover", "data_breach"]
+        }
+
+        self.add_sensitive_data(
+            category="credentials",
+            data_type="username_password",
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity="CRITICAL",
+            impact_assessment=impact,
+            evidence=evidence,
+            remediation="Rotate credentials immediately"
+        )
+
+    def add_api_key(
+        self,
+        key_id: str,
+        key_preview: str,
+        scope: List[str],
+        location: str,
+        finding_id: str,
+        token_type: str = "API Key",
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add discovered API key or token"""
+
+        data_preview = {
+            "key_id": key_id if key_id else "[REDACTED]",
+            "key_preview": key_preview,
+            "token_type": token_type,
+            "scope": scope
+        }
+
+        impact = {
+            "severity": "HIGH",
+            "risk": "Unauthorized API access, data exfiltration",
+            "endpoints_accessible": len(scope)
+        }
+
+        self.add_sensitive_data(
+            category="api_keys_and_tokens",
+            data_type=token_type.lower(),
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity="HIGH",
+            impact_assessment=impact,
+            evidence=evidence,
+            remediation="Revoke token immediately and rotate secrets"
+        )
+
+    def add_private_key(
+        self,
+        key_type: str,
+        key_length: int,
+        purpose: str,
+        location: str,
+        finding_id: str,
+        systems_accessible: Optional[List[str]] = None,
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add discovered private key"""
+
+        data_preview = {
+            "key_type": key_type,
+            "key_length": key_length,
+            "purpose": purpose,
+            "systems_accessible": systems_accessible or []
+        }
+
+        impact = {
+            "severity": "CRITICAL",
+            "risk": "Server access, complete system compromise",
+            "systems_affected": len(systems_accessible or [])
+        }
+
+        self.add_sensitive_data(
+            category="private_data",
+            data_type="private_key",
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity="CRITICAL",
+            impact_assessment=impact,
+            evidence=evidence,
+            remediation="Revoke key and rotate all dependent credentials"
+        )
+
+    def add_database_credentials(
+        self,
+        database_type: str,
+        host: str,
+        port: int,
+        database_name: str,
+        location: str,
+        finding_id: str,
+        records_affected: Optional[int] = None,
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add discovered database credentials"""
+
+        data_preview = {
+            "database_type": database_type,
+            "host": host if host else "[REDACTED]",
+            "port": port,
+            "database_name": database_name,
+            "records_accessible": records_affected
+        }
+
+        impact = {
+            "severity": "CRITICAL",
+            "risk": "Complete database access, data exfiltration",
+            "records_affected": records_affected or 0
+        }
+
+        self.add_sensitive_data(
+            category="configuration_data",
+            data_type="database_credentials",
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity="CRITICAL",
+            impact_assessment=impact,
+            evidence=evidence,
+            remediation="Rotate database credentials immediately"
+        )
+
+    def add_user_pii(
+        self,
+        pii_types: List[str],
+        records_affected: int,
+        location: str,
+        finding_id: str,
+        affected_jurisdictions: Optional[List[str]] = None,
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add discovered user PII"""
+
+        data_preview = {
+            "pii_types": pii_types,
+            "records_affected": records_affected,
+            "affected_jurisdictions": affected_jurisdictions or []
+        }
+
+        impact = {
+            "severity": "CRITICAL",
+            "risk": "Privacy violation, regulatory fines, identity theft",
+            "records_exposed": records_affected,
+            "legal_implications": ["GDPR", "CCPA"] if affected_jurisdictions else []
+        }
+
+        self.add_sensitive_data(
+            category="user_pii",
+            data_type="personal_information",
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity="CRITICAL",
+            impact_assessment=impact,
+            evidence=evidence,
+            remediation="Notify affected users per GDPR requirements (72 hours)"
+        )
+
+    def add_configuration_data(
+        self,
+        config_type: str,
+        data_exposed: str,
+        location: str,
+        finding_id: str,
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add exposed configuration data"""
+
+        data_preview = {
+            "config_type": config_type,
+            "description": data_exposed
+        }
+
+        impact = {
+            "severity": "HIGH",
+            "risk": "Information disclosure, enables further attacks",
+            "potential_actions": ["reconnaissance", "targeted_attacks"]
+        }
+
+        self.add_sensitive_data(
+            category="configuration_data",
+            data_type=config_type,
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity="HIGH",
+            impact_assessment=impact,
+            evidence=evidence,
+            remediation="Remove sensitive data from error messages and logs"
+        )
+
+    def add_other_sensitive_data(
+        self,
+        data_type: str,
+        items: List[str],
+        location: str,
+        finding_id: str,
+        severity: str = "MEDIUM",
+        evidence: Optional[Dict[str, str]] = None
+    ) -> None:
+        """Add other sensitive data"""
+
+        data_preview = {
+            "data_type": data_type,
+            "items": items,
+            "count": len(items)
+        }
+
+        impact = {
+            "severity": severity,
+            "risk": f"Exposed {data_type} enables further reconnaissance"
+        }
+
+        self.add_sensitive_data(
+            category="other_sensitive",
+            data_type=data_type,
+            location=location,
+            finding_id=finding_id,
+            data_preview=data_preview,
+            severity=severity,
+            impact_assessment=impact,
+            evidence=evidence
+        )
+
+    def finalize(self) -> None:
+        """Finalize tracking upon testing completion"""
+        self.metadata["testing_date_end"] = datetime.now(timezone.utc).isoformat()
+        self._save_metadata()
+
+    def generate_summary_report(self) -> str:
+        """Generate markdown summary report"""
+
+        report = f"""# Sensitive Data Discovery Report
+
+**Program**: {self.program_name}
+**Asset**: {self.asset_identifier}
+**Testing Start**: {self.metadata['testing_date_start']}
+**Testing End**: {self.metadata.get('testing_date_end', 'In Progress')}
+
+## Summary
+
+**Total Sensitive Items Discovered**: {self.metadata['summary']['total_items_discovered']}
+
+### By Category
+"""
+
+        for cat, count in self.metadata['summary']['by_category'].items():
+            if count > 0:
+                report += f"- {cat.replace('_', ' ').title()}: **{count}** items\n"
+
+        report += "\n### By Severity\n"
+
+        for level, count in self.metadata['summary']['by_severity'].items():
+            if count > 0:
+                report += f"- **{level}**: {count} items\n"
+
+        report += "\n## Highest Risk\n"
+
+        if self.metadata['summary']['highest_risk_finding']:
+            report += f"Most critical findings: {self.metadata['summary']['highest_risk_finding']}\n"
+
+        report += "\n## Required Actions\n"
+        report += "- [ ] Rotate all discovered credentials immediately\n"
+        report += "- [ ] Revoke all API keys and tokens\n"
+        report += "- [ ] Disable compromised accounts\n"
+        report += "- [ ] Notify users if PII was exposed\n"
+        report += "- [ ] Audit access logs\n"
+
+        return report
+
+    def _save_metadata(self) -> None:
+        """Save metadata to JSON file"""
+        filepath = os.path.join(self.output_dir, "sensitive_data_metadata.json")
+
+        with open(filepath, 'w') as f:
+            json.dump(self.metadata, f, indent=2)
+
+    def export_summary(self, output_path: Optional[str] = None) -> str:
+        """Export markdown summary report"""
+        if not output_path:
+            output_path = os.path.join(self.output_dir, "sensitive_data_report.md")
+
+        report = self.generate_summary_report()
+
+        with open(output_path, 'w') as f:
+            f.write(report)
+
+        return output_path
+
+
+# Example usage
+if __name__ == "__main__":
+    # Initialize tracker
+    tracker = SensitiveDataTracker(
+        program_name="ACME Corp Bug Bounty",
+        asset_identifier="https://example.com",
+        output_dir="./findings"
+    )
+
+    # Log discovered credentials
+    tracker.add_credentials(
+        username="admin",
+        password_hash="$2y$10$abc123...",
+        account_type="admin",
+        location="SQL injection in search parameter",
+        finding_id="finding-001",
+        evidence={
+            "poc_script": "findings/finding-001/poc.py",
+            "poc_output": "findings/finding-001/poc_output.txt"
+        }
+    )
+
+    # Log discovered API key
+    tracker.add_api_key(
+        key_id="sk_live_abc123",
+        key_preview="sk_live_****...1234",
+        scope=["read:users", "write:data"],
+        location="Hardcoded in JavaScript",
+        finding_id="finding-003",
+        token_type="API Key"
+    )
+
+    # Log discovered private key
+    tracker.add_private_key(
+        key_type="RSA",
+        key_length=2048,
+        purpose="SSH access to production",
+        location=".git/config",
+        finding_id="finding-005",
+        systems_accessible=["prod-db-01", "prod-api-server"]
+    )
+
+    # Finalize
+    tracker.finalize()
+
+    # Export summary
+    report_path = tracker.export_summary()
+    print(f"\n[+] Report saved to: {report_path}")
+    print(f"[+] Metadata saved to: {os.path.join(tracker.output_dir, 'sensitive_data_metadata.json')}")

package/template/skills/owasp-top-10-testing/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: owasp-top-10-testing
+description: Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.
+license: Apache-2.0
+metadata:
+  author: usestrix
+  homepage: https://docs.strix.ai
+---
+
+# Test against the OWASP Top 10
+
+The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP Top 10 testing" means exercising each category against the real application and reporting what's actually exploitable. Strix's agents do the exploitation; this skill covers running it category-by-category and reporting coverage honestly.
+
+**Use the current edition: [OWASP Top 10:2025](https://owasp.org/Top10/)** (8th installment, superseding 2021). Ask the user before targeting an older edition — some compliance checklists still reference 2021, and a report labelled with the wrong edition is misleading. Key differences from 2021: **SSRF is folded into A01**, **A03 Software Supply Chain Failures** expands the old "Vulnerable and Outdated Components", and **A10 Mishandling of Exceptional Conditions** is new; A02 Security Misconfiguration moved 5→2.
+
+Install, LLM setup, and the managed-cloud alternative: **penetration-testing-with-strix**.
+
+## What is and is not testable by an agent
+
+Be straight with the user about this — claiming a clean sweep of all ten is misleading.
+
+| Category (2025) | Coverage |
+|---|---|
+| A01 Broken Access Control (incl. SSRF) | **Strong** — cross-user/tenant access, privilege escalation, IDOR, and SSRF (including blind, via out-of-band callbacks) are all exploit-validated. Needs two accounts plus a privileged one to prove the authorization half. |
+| A02 Security Misconfiguration | **Strong** — debug endpoints, verbose errors, permissive CORS, missing hardening, default credentials, exposed admin surfaces. |
+| A03 Software Supply Chain Failures | **Partial** — version fingerprinting, and vulnerable/outdated dependency review when source is supplied. Build-system and distribution-infrastructure compromise (the broader half of this category) is out of scope for a runtime scan — pair with SCA plus build-provenance controls. |
+| A04 Cryptographic Failures | **Partial** — transport config, unencrypted data in transit, secrets and tokens leaked in responses. At-rest crypto and key management need source or infra review. |
+| A05 Injection | **Strong** — SQL/NoSQL/command/template injection and XSS, exploit-validated. |
+| A06 Insecure Design | **Partial** — business-logic abuse (price/quantity tampering, workflow skipping, race conditions) is found where reachable; design intent still needs human review and threat modelling. |
+| A07 Authentication Failures | **Strong** — auth bypass, weak session/token handling, password-reset and MFA flaws. |
+| A08 Software or Data Integrity Failures | **Partial** — insecure deserialization and unsigned-update paths where reachable; CI/CD trust boundaries are not runtime-testable. |
+| A09 Security Logging & Alerting Failures | **Not testable from outside** — requires reviewing the logging and alerting pipeline. State this rather than reporting it as passed. |
+| A10 Mishandling of Exceptional Conditions | **Partial** — agents actively probe error handling and fail-open behavior (malformed input, forced errors, race and timeout conditions) and report what leaks or bypasses a control; exhaustive coverage of internal error paths needs source review. |
+
+For APIs, run the same exercise against the **OWASP API Security Top 10 (2023)** — API1 BOLA, API3 Broken Object Property Level Authorization (2019's excessive data exposure + mass assignment merged), API5 broken function-level authorization — using the **api-security-testing** skill.
+
+## Run it
+
+Maximum category coverage comes from giving the agents both the source and a running instance, plus credentials at two privilege levels:
+
+```bash
+strix -n \
+  -t https://github.com/org/app \
+  -t https://staging.example.com \
+  --scan-mode deep --max-budget 30 \
+  --instruction "OWASP Top 10:2025 assessment. Cover every category systematically and map each finding to its 2025 category id.
+Accounts: userA@example.com/<pw> (org 1), userB@example.com/<pw> (org 2), admin@example.com/<pw>.
+Prioritise A01 (cross-org access, privilege escalation, SSRF), A02, A05, A07, A10.
+Out of scope: /billing/*, outbound email."
+```
+
+- `--scan-mode deep` matters here: systematically walking ten categories is not a quick scan.
+- Without a second account, A01 results are structurally incomplete — say so in the report rather than leaving it implied.
+- Need an auditor-facing PDF? Run it through the managed platform and pull the technical report (**managed-pentesting-with-strix**).
+
+## Report honestly
+
+From `strix_runs/<run>/`, group `vulnerabilities/*.md` by category and state, per category: what was attempted, what was proven, and what could not be assessed (A09 always; A03/A04/A06/A08/A10 partially). Label the report with the edition used. Verify each PoC yourself before it goes in front of the user.
+
+A `0` exit code means nothing exploitable was proven **in what was analyzed** — check `run.json` status and cost against `--max-budget`; a budget-capped run is not a completed assessment.
+
+## Then fix and re-test
+
+Remediate with **fix-security-vulnerabilities-with-strix** and re-run to prove each exploit is closed. For ongoing coverage as the app changes, gate pull requests using **ci-security-scanning-with-strix**.

package/template/skills/web-app-penetration-testing/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: web-app-penetration-testing
+description: Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.
+license: Apache-2.0
+metadata:
+  author: usestrix
+  homepage: https://docs.strix.ai
+---
+
+# Pentest a web application
+
+Black-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage.
+
+Install, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the **penetration-testing-with-strix** skill — read it if the target is not a running web app, or if `strix --version` fails. This skill is the web-app-specific workflow.
+
+## 1. Confirm authorization and scope
+
+Before running anything, establish:
+
+- **The target is the user's** (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch.
+- **Which environment.** Prefer staging over production; agents send real exploit payloads and will create/modify data.
+- **Out-of-scope paths** — payment flows, mass-email endpoints, admin destructive actions, third-party SSO providers.
+- **Credentials.** Most real vulnerabilities live behind login. Without a test account, the agents only ever see the marketing surface.
+
+Ask for anything missing rather than guessing.
+
+## 2. Run the scan
+
+```bash
+strix -n -t https://staging.example.com --max-budget 20 \
+  --instruction "Test account: qa@example.com / <password>. In scope: /app/*, /api/*. Do not touch /billing or send email. Focus on access control between the two seeded orgs."
+```
+
+Notes that matter for web apps specifically:
+
+- **Give it credentials via `--instruction`** (or `--instruction-file` for anything long), including how to log in if the flow is unusual (magic link, SSO, MFA-exempt test user).
+- **Two accounts beat one.** Multi-tenant IDOR and broken-access-control bugs — consistently the highest-impact class in web apps — can only be proven when the agent can attempt cross-account access.
+- **Add the repo for white-box depth** when you have the source: `-t https://github.com/org/app -t https://staging.example.com` (or a local path). Source access materially improves coverage of business-logic and authorization flaws.
+- **Localhost works.** Point at `http://host.docker.internal:3000` (Docker Desktop) so the sandbox can reach a dev server on the host.
+- `--scan-mode quick` for a fast dev-loop pass, `standard` (~30 min) for a normal review, `deep` for pre-release assurance. Always set `--max-budget`.
+
+For a hosted run with no Docker/LLM key, or when the user wants a shareable dashboard and an auditor-ready PDF, use the cloud path in **managed-pentesting-with-strix** instead — same engine, same findings.
+
+## 3. Review results
+
+Read `strix_runs/<run>/penetration_test_report.md` first, then per-finding files in `vulnerabilities/`. Each contains the PoC — re-run it yourself to confirm before reporting to the user.
+
+Exit codes: `0` no validated vulns in what was analyzed, `2` vulnerabilities found, `1` fatal error. A `0` is not proof of full coverage — if the budget or turn cap was hit the scan wraps up early, so check `run.json` status and cost against `--max-budget` before calling the app clean.
+
+## 4. Fix and verify
+
+Hand findings to the **fix-security-vulnerabilities-with-strix** skill: patch the root cause, then re-run Strix against the same target to prove the exploit no longer works. Re-testing is the only reliable confirmation a fix landed.
+
+To keep the app tested on every change rather than once, wire Strix into CI with **ci-security-scanning-with-strix**.