mirror of
https://github.com/Strategic-Automation/violin.git
synced 2026-08-14 12:33:37 +02:00
feat(skills): update pentest playbooks, recon methodologies, and scope templates
This commit is contained in:
Violin
+30
-3
@@ -64,7 +64,7 @@ Save all tool output under `$ENG_DIR/evidence/<phase>/` using:
|
||||
|
||||
### Platform Awareness
|
||||
Violin is intended for Kali Linux or Parrot OS first. The `terminal` tool may still be bash/zsh, PowerShell, Git Bash, WSL, Docker exec, or a remote shell, depending on where Hermes is running.
|
||||
- **Kali/Parrot fast path:** run tools directly and prefer standard paths such as `/usr/share/seclists/`, `/usr/share/wordlists/`, `/usr/share/nmap/scripts/`, and `/usr/share/exploitdb/`.
|
||||
- **Kali/Parrot fast path:** run tools directly and prefer standard paths such as `/usr/share/seclists/`, `/usr/share/wordlists/`, `/usr/share/nmap/scripts/`, and `/usr/share/exploitdb/`. Package presence is not assumed: `violin_ffuf` checks an explicit wordlist, `$SECLISTS`, SecLists, and DIRB locations in order and returns an actionable error when none exist.
|
||||
- **Docker Kali fallback:** run tools through `docker exec kali-pentest ...` or the `scripts/kali.sh` helper when the host lacks native tools.
|
||||
- **Windows/PowerShell/Git Bash fallback:** detect the shell before assuming path syntax. When chaining file writes into terminal execution, use paths that the active shell can actually resolve.
|
||||
|
||||
@@ -154,6 +154,33 @@ Hypothesis board: `$ENG_DIR/hypotheses.md` (template: `templates/hypothesis-boar
|
||||
|
||||
Per-hypothesis discipline: every active hypothesis carries **confidence**, **timebox**, **cheapest discriminating test**, and explicit **kill criteria**. Run the cheapest discriminating test first; kill the path when evidence contradicts it OR it stops producing new information, and log it in the board's **Decoy Trail** so a disproven technique is never re-entered. Verification and corroboration rules (independent re-check, ≥2 evidence angles, blocker taxonomy) live in `references/evidence-and-verification-discipline.md`.
|
||||
|
||||
Maintain a coverage matrix across routes, HTTP methods, parameters, role boundaries, authentication flows, business logic, redirects, rate limits, SSRF, injection, and object authorization. Each cell must be `tested`, `not_applicable`, or `blocked` with an evidence path or concrete reason. Benchmark engagements store this at `state/coverage-matrix.yaml`; VULN_RESEARCH cannot close while a cell is pending. Every proven issue must have a canonical Validated hypothesis and `evidence/findings/FIND-NNN.md` record before reporting closes.
|
||||
|
||||
### PTT Skill Routing Contract
|
||||
|
||||
`violin_record_ptt` selects one required skill from the active hypothesis. `vuln_class` takes precedence over `candidate_source`, which takes precedence over the phase default. Do not guess: use the route shown by the tool error and record the exact normalized `candidate_source` in the hypothesis.
|
||||
|
||||
| `candidate_source` | Required skill |
|
||||
|---|---|
|
||||
| `domain` | `domain-intel` |
|
||||
| `osint`, `public-records` | `osint-investigation` |
|
||||
| `username`, `identity` | `sherlock` |
|
||||
| `repository`, `supply-chain` | `oss-forensics` |
|
||||
| `codebase`, `source` | `audit-context-building` |
|
||||
| `semgrep` | `semgrep` |
|
||||
| `codeql` | `codeql` |
|
||||
| `sarif` | `sarif-parsing` |
|
||||
|
||||
For vulnerability classes, `jwt`, `idor`, authentication, authorization, and access-control variants require `access-control`; SQLi, XSS, SSRF, command injection, and path traversal require `web-attacks`; source/static/SARIF analysis routes to `audit-context-building`, `semgrep`, or `sarif-parsing`. Use `pentest` only when no more specific route applies. `fp-check` is allowed only for an explicit retrospective false-positive review.
|
||||
|
||||
### Batch Review Continuation
|
||||
|
||||
`violin_review_batch` preserves the active PTT task by default (`status="[~]"`) after it records the batch review and clears sync. Use `status="[x]"` only when that task is genuinely complete; start a new PTT ID only for a new task, not merely to continue the same phase after a review.
|
||||
|
||||
### Authenticated Requests and Redacted Evidence
|
||||
|
||||
Treat token redaction in receipts as expected. Preserve the request purpose, authenticated role/subject, token fingerprint or expiry, and decisive response under `evidence/`; never use `exploits/` as an unredacted credential store. When a test needs a bearer token, acquire and use it within the same guarded process or use the operator-approved ephemeral credential mechanism, then record the resulting response as evidence.
|
||||
|
||||
### Evidence Read-Back (Post-Compression)
|
||||
|
||||
After context compression, re-read evidence and hypotheses — not just the playbook:
|
||||
@@ -191,12 +218,12 @@ This prevents re-running scans, missing cross-phase patterns, and losing the inv
|
||||
## 8. Operator Notes & Workflow Patterns
|
||||
|
||||
* **POSIX Shell Environment (`violin_exec`)**: Commands execute under POSIX shell (`/bin/sh`, dash on Debian/Ubuntu containers). Builtins like `source` do not exist in dash (`source: not found`). Load environment variables using `. file.env` or `export $(cat file.env)` / `export $(grep -v '^#' file | xargs)`.
|
||||
* **Sync Credit Limits & Burst Recovery (`violin_exec_burst`)**: Per-phase sync credit limits apply (Recon: 5, Vuln Research: 10, Exploitation: 10, Post: 20 target executions per sync window) and are shared across execution tools. If a burst is denied with `insufficient sync credit for burst: need N, have M`, split the burst into smaller command sets (size $\le M$) and invoke `violin_review_batch` to clear the batch and refresh sync credit.
|
||||
* **Sync Credit Limits & Burst Recovery (`violin_exec_burst`)**: Per-phase sync credit limits apply (Recon: 10, Vuln Research: 10, Exploitation/Post-Exploitation/PRIVESC/FLAGS: 20 target executions per sync window) and are shared across execution tools. If a burst is denied with `insufficient sync credit for burst: need N, have M`, split the burst into smaller command sets (size $\le M$) and invoke `violin_review_batch` to clear the batch and refresh sync credit.
|
||||
* **Heartbeat Clearance Sequence (`violin_heartbeat_done`)**: When reaching the 50-command heartbeat threshold, clear the gate via: 1) `violin_status`, 2) `violin_review_batch` (if a pending command batch exists), 3) `violin_heartbeat_done(eng_dir=...)`.
|
||||
* **Reverse-Shell Catch Listeners (`violin_listener`)**: Bind host-local interfaces only (`0.0.0.0`, `127.0.0.1`, VPN IP). `violin_listener` rejects binding attempts targeting victim/target addresses.
|
||||
* **Persistent Background Tunnels**: Long-lived commands (`ssh -f -N`, `background=true`) remain running after dispatch. `violin_review_batch` detects active background processes and treats them as acknowledged completed actions.
|
||||
* **Clearing Stuck Active PTT Tasks**: Starting a new task via `violin_record_ptt` will automatically supersede and close an old active `[~]` task (status → `[x]` with `[superseded-by:task-id]` note) as long as no pending unreviewed command batch exists.
|
||||
* **Semantic Anti-Stuck Lock Auto-Release**: Recording a hypothesis (`violin_record_hypothesis`) or submitting a batch review containing completed execution evidence/technique pivot automatically clears progress locks, preventing false anti-stuck blocks during rapid iteration. See `references/anti-stuck.md` for decision logic.
|
||||
* **Semantic Anti-Stuck Lock Recovery**: Hypothesis edits do not clear progress locks by themselves. The lock clears only after recorded research plus a meaningful technique pivot, or genuine evidence-backed progress. See `references/anti-stuck.md` for decision logic.
|
||||
* **Sub-Agent Delegation & Tool Selection**: See `references/platform-delegation.md` for 4-agent parallel recon matrix and tool hierarchy rules.
|
||||
|
||||
---
|
||||
|
||||
@@ -20,7 +20,7 @@ Phase-gated recon workflow: Passive OSINT ──► Tech Detection ──► Act
|
||||
| `violin_httpx` | Tech | `violin_httpx(eng_dir=..., target=...)` |
|
||||
| `violin_nuclei` | Tech | `violin_nuclei(eng_dir=..., target=..., tags="tech")` |
|
||||
| `violin_exec` (nmap) | Active | `violin_exec(eng_dir=..., phase="RECON", command="nmap -sS -sV -sC --top-ports 1000 -T4 -oA $ENG_DIR/evidence/recon/active/nmap-top1000 <target>")` |
|
||||
| `violin_ffuf` | Active | `violin_ffuf(eng_dir=..., target="https://<target>/FUZZ", wordlist="/usr/share/seclists/Discovery/Web-Content/common.txt")` |
|
||||
| `violin_ffuf` | Active | `violin_ffuf(eng_dir=..., phase="RECON", target="https://<target>", url="https://<target>/FUZZ")` (portable default wordlist resolution) |
|
||||
|
||||
---
|
||||
|
||||
@@ -85,7 +85,7 @@ violin_exec(eng_dir=..., phase="RECON", command="nmap -sS -sV -sC --top-ports 10
|
||||
violin_exec(eng_dir=..., phase="RECON", command="nmap -sS -p- -T4 --min-rate=1000 -oA $ENG_DIR/evidence/recon/active/nmap-full-tcp <target>", background=true)
|
||||
|
||||
# 3. Directory & route brute force (ffuf JSON output)
|
||||
violin_ffuf(eng_dir=..., target="https://<target>/FUZZ", wordlist="/usr/share/seclists/Discovery/Web-Content/common.txt")
|
||||
violin_ffuf(eng_dir=..., phase="RECON", target="https://<target>", url="https://<target>/FUZZ")
|
||||
|
||||
# 4. Targeted CVE & misconfig scan (nuclei)
|
||||
violin_nuclei(eng_dir=..., target="https://<target>", tags="cve,misconfig,exposures")
|
||||
@@ -138,10 +138,11 @@ nmap -sS -sV --top-ports 1000 -T4 <target> -oA $ENG_DIR/evidence/recon/active/nm
|
||||
nmap -sS -p- -T4 --min-rate=1000 <target> -oA $ENG_DIR/evidence/recon/active/nmap-full-tcp -v2
|
||||
nmap -sV -sC -p <OPEN_PORTS> <target> -oA $ENG_DIR/evidence/recon/active/nmap-services -v2
|
||||
|
||||
# Directory & file brute forcing
|
||||
ffuf -u https://<target>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -o $ENG_DIR/evidence/recon/active/ffuf-common.json -of json
|
||||
gobuster dir -u https://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -o $ENG_DIR/evidence/recon/active/gobuster-dirs.txt
|
||||
feroxbuster -u https://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -o $ENG_DIR/evidence/recon/active/feroxbuster.txt
|
||||
# Directory & file brute forcing. Resolve a real local wordlist first; do not
|
||||
# assume SecLists is installed merely because the host is Kali or Parrot.
|
||||
ffuf -u https://<target>/FUZZ -w <resolved-wordlist> -o $ENG_DIR/evidence/recon/active/ffuf-common.json -of json
|
||||
gobuster dir -u https://<target> -w <resolved-wordlist> -o $ENG_DIR/evidence/recon/active/gobuster-dirs.txt
|
||||
feroxbuster -u https://<target> -w <resolved-wordlist> -o $ENG_DIR/evidence/recon/active/feroxbuster.txt
|
||||
|
||||
# Vulnerability & takeover scanning
|
||||
nuclei -u https://<target> -t cves/ -t exposures/ -t misconfiguration/ -o $ENG_DIR/evidence/recon/active/nuclei-all.txt
|
||||
@@ -162,6 +163,10 @@ Recon is **complete** when **all** of the following are true:
|
||||
|
||||
If any condition is not met, recon continues or pauses accordingly.
|
||||
|
||||
### Portable Wordlist Resolution
|
||||
|
||||
`violin_ffuf` tries the supplied path, `$SECLISTS/Discovery/Web-Content/common.txt`, `/usr/share/seclists/Discovery/Web-Content/common.txt`, and the common DIRB locations. If none exists, create a focused wordlist from target-derived routes or install SecLists, save the source/limitation in engagement evidence, and pass that existing file explicitly.
|
||||
|
||||
---
|
||||
|
||||
## Preconditions / Scope Gate
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
|------|---------------------------|
|
||||
| `read_file` | Review all evidence, PTT, hypotheses, scope.yaml |
|
||||
| `search_files` | Enumerate evidence files across all phase directories |
|
||||
| `write_file` | Fill report template, create triage table, write findings.yaml |
|
||||
| `write_file` | Fill the report template and derived reporting exports |
|
||||
| `clarify` | Ask about custom report sections, get delivery approval |
|
||||
| `todo` | Track reporting checklist items (quality gates) |
|
||||
|
||||
@@ -28,7 +28,8 @@ Before generating the report, systematically review all evidence collected durin
|
||||
1. **Read the hypothesis board** — `read_file path="$ENG_DIR/hypotheses.md"` to see all theories and their resolution status. Do NOT overwrite or collapse `$ENG_DIR/hypotheses.md` into plain narrative text; final reports belong in `$ENG_DIR/reporting/report.md`.
|
||||
2. **Locate evidence** — navigate to `$ENG_DIR/evidence/` and enumerate all subdirectories and files. Evidence files MUST reside under `$ENG_DIR/evidence/<phase>/` (never inside `$ENG_DIR/state/`).
|
||||
3. **Verify reproducibility** — each validated finding has raw evidence plus a `templates/verification-receipt.yaml` receipt with `state: validated`, `oracle_kind`, `actual_signal`, and artifact paths.
|
||||
4. **Categorize findings** into three tiers:
|
||||
4. **Verify canonical findings** — every Validated hypothesis links an existing `evidence/findings/FIND-NNN.md`. This Markdown record is authoritative; `evidence/reporting/findings.yaml` may be generated as a derived export but cannot replace it.
|
||||
5. **Categorize findings** into three tiers:
|
||||
|
||||
| Tier | Criteria | Action |
|
||||
|------|----------|--------|
|
||||
@@ -231,4 +232,4 @@ Before delivering the report, verify every item:
|
||||
|
||||
- Fabricating or altering evidence
|
||||
- Reporting unverified findings as confirmed
|
||||
- Including PII or client-sensitive data in the report without sanitization
|
||||
- Including PII or client-sensitive data in the report without sanitization
|
||||
|
||||
@@ -8,7 +8,11 @@
|
||||
|
||||
When running target commands via `violin_exec` / `violin_exec_burst`:
|
||||
- **POSIX Shell (`/bin/sh`)**: Commands execute under POSIX shell (`dash` on Debian/Ubuntu containers). Shell builtins like `source` do not exist (`source: not found`). Load environment variables using `. file.env` or `export $(cat file.env)` / `export $(grep -v '^#' file | xargs)`.
|
||||
- **Sync Credit Limits (`violin_exec_burst`)**: Per-phase sync credit limits apply (Recon: 5, Vuln Research: 10, Exploitation: 10, Post: 20 target executions per sync window) and are shared across execution tools. If a burst is denied with `insufficient sync credit for burst: need N, have M`, split the command set into smaller bursts ($\le M$) and invoke `violin_review_batch` to review results and refresh sync credit.
|
||||
- **Sync Credit Limits (`violin_exec_burst`)**: Per-phase sync credit limits apply (Recon: 10, Vuln Research: 10, Exploitation/Post-Exploitation/PRIVESC/FLAGS: 20 target executions per sync window) and are shared across execution tools. If a burst is denied with `insufficient sync credit for burst: need N, have M`, split the command set into smaller bursts ($\le M$) and invoke `violin_review_batch` to review results and refresh sync credit.
|
||||
- **Strict command files**: `commands_file` is engagement-relative and must resolve to a non-symlink regular file inside the engagement, at most 64 KiB and 20 nonblank newline-delimited commands. Absolute paths and traversal are rejected.
|
||||
- **Executor status**: `failed_to_start` means no process existed and no execution/sync credit is claimed. `failed_to_track` means a process started but could not be tracked and was terminated conservatively. `completed`, `timed_out`, `cancelled`, and `output_limited` retain their literal meanings in receipts.
|
||||
- **Audited `execute_code`**: Arbitrary Python is available only with the exact first-line metadata header documented in the README. Its intent receipt is durable before dispatch and it participates in normal scope, phase, PTT, hypothesis, and session gates. Conservatively classified local analysis is labeled and recorded without target sync credit; unknown imports, network/process-capable code, and dynamic execution use normal sync/review accounting. Literal-target checks and receipts do not give it the same containment guarantees as `violin_exec`; prefer typed execution.
|
||||
- **Public vulnerability research**: During `VULN_RESEARCH`, `violin_exec` may use a hostname explicitly listed in `scope.yaml` under `research_hosts` as its `target` for read-only advisory/API queries. Research hosts remain non-assessment endpoints and raw `terminal` network calls remain blocked.
|
||||
- **Heartbeat Clearance Sequence (`violin_heartbeat_done`)**: When reaching the 50-command heartbeat threshold, clear the gate via: 1) `violin_status`, 2) `violin_review_batch` (if a pending command batch exists), 3) `violin_heartbeat_done(eng_dir=...)`.
|
||||
|
||||
## ⚠️ Mandatory: Tool Environment Detection
|
||||
@@ -136,12 +140,12 @@ sqlmap -u "http://<target>/page?id=1" -D <dbname> --tables --batch
|
||||
|
||||
**Directory brute-force**:
|
||||
```bash
|
||||
ffuf -u http://<target>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -o ffuf_dir.json
|
||||
ffuf -u http://<target>/FUZZ -w <resolved-wordlist> -o ffuf_dir.json
|
||||
```
|
||||
|
||||
**VHost discovery**:
|
||||
```bash
|
||||
ffuf -u http://<target>/ -H "Host: FUZZ.<domain>" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o ffuf_vhost.json
|
||||
ffuf -u http://<target>/ -H "Host: FUZZ.<domain>" -w <resolved-dns-wordlist> -o ffuf_vhost.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
@@ -82,6 +82,6 @@ query {
|
||||
|
||||
## 4. API Security Tooling Syntax
|
||||
- **`Arjun`** (Parameter Fuzzing): `arjun -u http://target/api/endpoint -m GET` or `arjun -u http://target/api/endpoint -m POST --json`
|
||||
- **`ffuf`** (API Endpoint & Route Fuzzing): `ffuf -u http://target/api/v1/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt`
|
||||
- **`ffuf`** (API Endpoint & Route Fuzzing): prefer `violin_ffuf(..., url="http://target/api/v1/FUZZ")`, which resolves explicit, `$SECLISTS`, SecLists, and DIRB wordlists; for a raw command use `-w <verified-existing-wordlist>`.
|
||||
- **`Nuclei`** (API Vulnerability Templates): `violin_nuclei -u http://target/api -t exposure/,misconfiguration/`
|
||||
- **`kiterunner`** (API OpenAPI/Swagger Brute Force): `kr scan http://target/api -w routes-large.kite`
|
||||
|
||||
@@ -28,8 +28,8 @@
|
||||
- `nmap -sS -sV -sC -Pn -oA $ENG_DIR/evidence/recon/nmap_top1000 target.com`
|
||||
- Full range: `nmap -p- --min-rate 1000 -oA $ENG_DIR/evidence/recon/nmap_allports target.com`
|
||||
- **Directory & Content Brute-Forcing**:
|
||||
- `gobuster dir -u http://target.com/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -o $ENG_DIR/evidence/recon/gobuster.txt`
|
||||
- `ffuf -u http://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,204,301,302,307,401,403`
|
||||
- `gobuster dir -u http://target.com/ -w <verified-existing-wordlist> -o $ENG_DIR/evidence/recon/gobuster.txt`
|
||||
- `violin_ffuf(..., target="http://target.com", url="http://target.com/FUZZ", extra_args=["-mc", "200,204,301,302,307,401,403"])` auto-resolves common SecLists/DIRB paths when `wordlist` is omitted.
|
||||
- **Vulnerability Scanning & Subdomain Takeover**:
|
||||
- `violin_nuclei -u http://target.com -t cves/,vulnerabilities/ -o $ENG_DIR/evidence/recon/nuclei.txt`
|
||||
- `subzy run --targets $ENG_DIR/evidence/recon/subdomains.txt`
|
||||
|
||||
@@ -32,12 +32,14 @@ Discovered credentials, tokens, session cookies, and API keys must be handled di
|
||||
| Context | Treatment |
|
||||
|---------|-----------|
|
||||
| Chat messages (`clarify`, assistant responses) | **Redact to last 6 characters only** — e.g. `ghp_...aBcDeF` |
|
||||
| Evidence files (`$ENG_DIR/evidence/`) | Full values OK — this is the permanent record |
|
||||
| Secrets vault (`$ENG_DIR/findings/secrets-vault.md`) | Full values — must be in `.gitignore` |
|
||||
| Evidence files (`$ENG_DIR/evidence/`) | Record redacted token fingerprints, subject/role, expiry, and the decisive response — never rely on full values remaining visible in receipts |
|
||||
| Operator credential system | Keep full values only in the operator-approved ephemeral credential mechanism; Violin does not provide an unredacted engagement secret store |
|
||||
| Screenshots | Blur or crop sensitive data before saving as evidence |
|
||||
| PII (names, emails of non-target users) | Redact everywhere — chat, evidence, report |
|
||||
| Test credentials provided in scope | Keep unchanged — they're test data |
|
||||
|
||||
For authenticated testing, obtain and use a token in the same guarded command/process (for example, authenticate into a shell variable and immediately issue the scoped request). This keeps the executable flow reproducible while allowing the runtime to redact the receipt. Do not write plaintext tokens to `exploits/`, reports, findings, or an engagement-local scratch file.
|
||||
|
||||
If you accidentally log a full credential to a chat channel (not an evidence file), immediately note the incident in the retrospective.
|
||||
|
||||
### 1.3 Rate Limit Enforcement
|
||||
@@ -122,8 +124,9 @@ review-required. Do not use agent judgment to override a blocked result.
|
||||
| Raw tool output | `$ENG_DIR/evidence/<phase>/<tool>-<target>.txt` | Plain text |
|
||||
| Screenshots | `$ENG_DIR/evidence/<phase>/screenshots/` | PNG |
|
||||
| Request/response pairs | `$ENG_DIR/evidence/<phase>/http/` | `.req` / `.resp` or markdown |
|
||||
| Findings | `$ENG_DIR/evidence/reporting/findings.yaml` | YAML (structured) |
|
||||
| Secrets / tokens | `$ENG_DIR/findings/secrets-vault.md` | Markdown (must be gitignored) |
|
||||
| Canonical findings | `$ENG_DIR/evidence/findings/FIND-NNN.md` | Markdown (guard-created) |
|
||||
| Reporting findings export | `$ENG_DIR/evidence/reporting/findings.yaml` | YAML (derived, non-authoritative) |
|
||||
| Secrets / tokens | Operator-approved ephemeral credential mechanism | Never store plaintext in the engagement |
|
||||
|
||||
### 2.2 Evidence Integrity Rules
|
||||
|
||||
@@ -139,9 +142,9 @@ review-required. Do not use agent judgment to override a blocked result.
|
||||
| Target URL/Domain | ✅ Full | ✅ Full | ❌ N/A |
|
||||
| Open port / service | ✅ Full | ✅ Full | ❌ N/A |
|
||||
| SQLi PoC (1 row) | ✅ Parameter used | ✅ Full output | ❌ N/A |
|
||||
| Auth token / JWT | ❌ Last 6 only | ✅ Full | ✅ Full |
|
||||
| Cracked password | ❌ Last 6 only | ✅ Full | ✅ Full |
|
||||
| API key / secret | ❌ Last 6 only | ✅ Full | ✅ Full |
|
||||
| Auth token / JWT | ❌ Last 6 only | ✅ Redacted fingerprint/context only | ✅ Operator-managed only |
|
||||
| Cracked password | ❌ Last 6 only | ✅ Redacted fingerprint/context only | ✅ Operator-managed only |
|
||||
| API key / secret | ❌ Last 6 only | ✅ Redacted fingerprint/context only | ✅ Operator-managed only |
|
||||
| Database dump (sample) | ❌ Summary only | ✅ Full | ✅ Full |
|
||||
| User PII (non-target) | ❌ Not in chat | ❌ Not in evidence | ❌ Not anywhere |
|
||||
| Screenshot | ✅ With sensitive data blurred | ✅ High resolution | ❌ N/A |
|
||||
|
||||
@@ -24,6 +24,9 @@ research_hosts:
|
||||
- github.com
|
||||
- raw.githubusercontent.com
|
||||
- api.github.com
|
||||
- nvd.nist.gov
|
||||
- services.nvd.nist.gov
|
||||
- api.osv.dev
|
||||
- 0xdf.gitlab.io
|
||||
|
||||
# Operator-controlled assessment infrastructure. These hosts may be used as
|
||||
|
||||
Reference in New Issue
Block a user