BitterSecurity/Decepticon - 4페이지

chain-idor-to-priv-esc

Build chains where IDOR enables privilege escalation and high-impact control-plane actions.

원문 언어: 영어

chain-ssrf-to-rce

Build and validate SSRF pivot chains toward metadata/infra control and final code execution impact.

원문 언어: 영어

chain-xss-to-takeover

Build chains from XSS into account takeover or privileged action execution.

원문 언어: 영어

command-injection

Hunt OS command injection (CWE-78) — user input reaching shell, exec, or system calls. Covers argument-array bypasses, path confusion, and template-string injection in modern frameworks.

원문 언어: 영어

data-and-model-poisoning

Hunt LLM training-data and model poisoning (OWASP LLM04:2025) — adversarial inputs that bias future model behaviour through fine-tuning, RLHF, or continuous-learning loops.

원문 언어: 영어

deserialization

Hunt insecure deserialization (CWE-502) across Python pickle, Java ObjectInputStream / Jackson / SnakeYAML, .NET BinaryFormatter / DataContractJson, PHP unserialize, Ruby Marshal/YAML.load, and Node.js vm. Direct path to unauthenticated RCE.

원문 언어: 영어

excessive-agency

Hunt LLM excessive agency (OWASP LLM06:2025) — agentic systems granted too many tools, too broad permissions per tool, or unsupervised authority to act on the user / business behalf, producing financial loss, data loss, or destructive operations from a single…

원문 언어: 영어

idor

Hunt Insecure Direct Object Reference (CWE-639) — missing authorization checks on object IDs. Covers horizontal vs vertical privilege escalation, UUID vs integer guessing, and GraphQL introspection-driven IDOR discovery.

원문 언어: 영어

improper-output-handling

Hunt improper LLM output handling (OWASP LLM05:2025) — downstream code that trusts unstructured model output and renders / executes / shells it without sanitisation, producing XSS, SSRF, SQL injection, RCE, and SSTI via the model channel.

원문 언어: 영어

misinformation

Hunt LLM misinformation / overreliance (OWASP LLM09:2025) — confident-but-wrong outputs that flow into downstream automated decisions, compliance reports, customer communications, or autonomous code commits without verification.

원문 언어: 영어

path-traversal

Hunt directory traversal and archive traversal (ZipSlip/TarSlip) from user input to filesystem operations.

원문 언어: 영어

prompt-injection

Hunt LLM prompt injection and tool-call hijacking in modern AI-integrated applications (CWE-1427). Covers indirect injection via RAG, tool abuse, exfiltration chains, and jailbreak-to-RCE pivots on agentic systems.

원문 언어: 영어

prototype-pollution

Hunt JavaScript prototype pollution (CWE-1321) — the 2023-2026 meta-vulnerability that chains into RCE, auth bypass, and SSRF on most Node.js stacks.

원문 언어: 영어

sensitive-information-disclosure

Hunt LLM sensitive-information disclosure (OWASP LLM02:2025) — leakage of PII, secrets, internal source, model details, and other-tenant data through model outputs, training-data extraction, or retrieval-side joins.

원문 언어: 영어

sql-injection

Hunt SQL injection (CWE-89) via source-level taint tracking. Covers string concat, format-string, ORM raw queries, second-order injection, and NoSQL injection in MongoDB/DynamoDB.

원문 언어: 영어

ssrf

Hunt Server-Side Request Forgery (CWE-918) through taint analysis from user-controlled URLs to HTTP client sinks. Covers cloud metadata pivoting, DNS rebinding, gopher smuggling, and the IMDSv1 → IAM role chain that turns SSRF into RCE.

원문 언어: 영어

ssti

Hunt server-side template injection across Jinja2/Twig/Freemarker/Velocity/Handlebars and validate progression from expression injection to code execution.

원문 언어: 영어

system-prompt-leakage

Hunt LLM system-prompt leakage (OWASP LLM07:2025) — exfiltration of the privileged system prompt revealing internal rules, secrets baked in, tool inventory, and business logic that should not be client-visible.

원문 언어: 영어

trust-boundary-analysis

Trust boundary mapping and startup sequence audit for developer tools, CLI apps, and plugin systems. Load when the target is a developer tool, CLI, IDE extension, or any application that loads config from the current directory.

원문 언어: 영어

unbounded-consumption

Hunt LLM unbounded consumption (OWASP LLM10:2025) — denial-of-wallet and denial-of-service against LLM endpoints via unrestricted prompt size, runaway tool loops, expensive model selection, and unauthenticated fan-out.

원문 언어: 영어

vector-and-embedding-weaknesses

Hunt vector / embedding weaknesses (OWASP LLM08:2025) — adversarial inputs against the RAG / similarity layer that cause cross-tenant leak, embedding-inversion privacy loss, semantic confusion, and retriever-driven prompt injection.

원문 언어: 영어

xxe

Hunt XML External Entity flaws in parsers and validate file read / SSRF impact with strict negative controls.

원문 언어: 영어

references

External knowledge integration — HackerOne reports, PayloadsAllTheThings, Book of Secret Knowledge, CVE PoC corpora, bug bounty methodologies, and reference pentest agent architectures. Use these to calibrate, look up payloads, and accelerate research.

원문 언어: 영어

detector-overview

Stage 2 vulnerability detector playbook. Reads source around CANDIDATE nodes and promotes real bugs to VULNERABILITY + HYPOTHESIS. Read-only. Load at detector-agent startup.

원문 언어: 영어

exploiter-overview

Stage 5 exploit construction playbook. Weaponizes validated primitives into multi-step chains that reach crown jewels. Load at exploiter-agent startup.

원문 언어: 영어

patcher-overview

Stage 4 patch generation playbook. Minimal diffs for validated findings with mandatory patch_verify. Load at patcher-agent startup.

원문 언어: 영어

scanner-overview

Stage 1 broad-spectrum scanner playbook. Sharded sweep over very large codebases producing CANDIDATE nodes for the Detector to reason about. Load at scanner-agent startup.

원문 언어: 영어

bounty-report-formatter

Bug bounty report formatting for HackerOne, Bugcrowd, Immunefi, and GitHub Security Advisories. Load after validate_finding succeeds and the finding needs to be submitted to a bounty program.

원문 언어: 영어

vulnresearch-orchestrator

Five-stage modular vulnerability pipeline orchestrator. Delegates scan → detect → verify → patch → exploit through OPPLAN objectives. Load at orchestrator startup.

원문 언어: 영어

supply-chain

Hunt LLM supply-chain compromise (OWASP LLM03:2025) — malicious or backdoored models, datasets, adapters, plugins, MCP servers, and tokenizer / framework dependencies that ship inside an AI-integrated product.

원문 언어: 영어

iot-overview

Use when the engagement target is IoT, embedded Linux, RTOS, or any device reachable via UART/JTAG/SWD or by extracting its firmware. Covers firmware acquisition, binwalk extraction, filesystem mounting, default-credential hunting, bootloader attacks,…

원문 언어: 영어

access-control

Missing modifiers, wrong msg.sender checks, default-public functions, missing onlyOwner / onlyRole / onlyDAO authorization.

원문 언어: 영어

flash-loan

Flash-loan exploit patterns — callback reentrancy, oracle amplification, governance attacks, unauthenticated callback handlers.

원문 언어: 영어

oracle-manipulation

Hunt single-block oracle manipulation — spot-price AMM oracles, manipulable TWAP, dependent calculations, missing staleness checks.

원문 언어: 영어

reentrancy

Hunt and validate reentrancy bugs — classic cross-function, same-function, read-only, and cross-contract variants.

원문 언어: 영어

signature-replay

Signature replay attacks — missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay.

원문 언어: 영어

upgradeable-proxy

Proxy upgrade patterns and their bugs — uninitialized implementation, storage slot collisions, selector clashes, unprotected upgrade auth.

원문 언어: 영어

aws-iam-enum

Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.

원문 언어: 영어

imds-pivot

Pivot from SSRF or RCE to cloud Instance Metadata Service (IMDS) — extract IAM role creds, instance identity, user-data secrets.

원문 언어: 영어

k8s-pivot

Kubernetes attack playbook — service-account token theft, RBAC abuse, pod escape, hostPath mount abuse, kube-api-server pivoting.

원문 언어: 영어