Add files via upload

ai_research/prompt_engineering/bug_bounty_prompt_generator/ai_prompt_maker.py

@@ -0,0 +1,54 @@
+__author__ = "Omar Santos"
+__version__ = "0.1.0"
+__license__ = "MIT"
+__description__ = "This script generates AI-powered prompts for various vulnerabilities in a web application. This could be used to help with bug bounty hunting and ethical hacking. It demonstrates the use of LangChain, OpenAI, and AI."
+
+# Importing the required libraries
+import os
+from dotenv import load_dotenv
+from langchain_openai import ChatOpenAI
+from langchain.prompts import ChatPromptTemplate
+from langchain.schema.output_parser import StrOutputParser
+from langchain.schema.runnable import RunnableLambda
+
+# Loading environment variables from .env
+load_dotenv()
+
+# Creating an instance of the ChatOpenAI model with the model name
+model = ChatOpenAI(model="gpt-4o-mini")
+
+# Defining the prompt templates
+prompt_template = ChatPromptTemplate.from_messages(
+    [
+        ("system", "You are an expert Prompt Writer for Large Language Models and an expert in the subject of ethical hacking and bug bounty hunting. Start the prompt by stating that it is an expert in the subject. Be specific, descriptive and as detailed as possible about the desired outcome. You will help an ethical hacker to perform reconnaissance on a specific target for that given vulnerability and provide examples of exploits and how to exploit them."),
+        ("human", "Create a prompt to help with {vulnerability}."),
+    ]
+)
+
+# Defining additional processing steps using RunnableLambda
+uppercase_output = RunnableLambda(lambda x: x.upper())
+count_words = RunnableLambda(lambda x: f"Word count: {len(x.split())}\n{x}")
+
+# Creating the combined chain using LangChain Expression Language (LCEL)
+chain = prompt_template | model | StrOutputParser() | uppercase_output | count_words
+
+# Creating the 'prompts' directory if it doesn't exist
+os.makedirs("prompts", exist_ok=True)
+
+# Reading vulnerabilities from the top_vulns.txt file
+with open("top_vulns.txt", "r") as file:
+    vulnerabilities = [line.strip() for line in file if line.strip()]
+
+# Processing each vulnerability
+for vulnerability in vulnerabilities:
+    print(f"\nProcessing vulnerability: {vulnerability}")
+    result = chain.invoke({"vulnerability": vulnerability})
+    print(result)
+    
+    # Saving the result to a file
+    filename = f"prompts/{vulnerability.replace(' ', '_').lower()}_prompt.txt"
+    with open(filename, "w") as output_file:
+        output_file.write(result)
+    
+    print(f"Saved prompt to: {filename}")
+    print("-" * 80)  # Separator between results

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/business_logic_errors_prompt.txt

@@ -0,0 +1,37 @@
+Word count: 511
+**PROMPT FOR ETHICAL HACKING AND BUG BOUNTY HUNTING: BUSINESS LOGIC ERRORS**
+
+YOU ARE AN EXPERT IN THE FIELD OF ETHICAL HACKING AND BUG BOUNTY HUNTING, WITH A SPECIALIZED FOCUS ON IDENTIFYING AND EXPLOITING BUSINESS LOGIC ERRORS WITHIN WEB APPLICATIONS. YOUR GOAL IS TO ASSIST ETHICAL HACKERS IN PERFORMING THOROUGH RECONNAISSANCE ON A SPECIFIC TARGET TO UNCOVER POTENTIAL BUSINESS LOGIC VULNERABILITIES. 
+
+BUSINESS LOGIC ERRORS OCCUR WHEN AN APPLICATION’S FUNCTIONS DO NOT OPERATE AS INTENDED, ALLOWING AN ATTACKER TO MANIPULATE THE APPLICATION'S WORKFLOW FOR UNINTENDED PURPOSES. THESE VULNERABILITIES OFTEN ARISE FROM FLAWED ASSUMPTIONS IN THE DESIGN AND IMPLEMENTATION OF BUSINESS PROCESSES.
+
+### DESIRED OUTCOMES:
+1. **TARGET IDENTIFICATION**: DEFINE THE TARGET APPLICATION, ITS FUNCTIONALITIES, AND THE BUSINESS PROCESSES IT SUPPORTS.
+2. **RECONNAISSANCE TECHNIQUES**: OUTLINE SPECIFIC RECONNAISSANCE METHODS TO GATHER NECESSARY INFORMATION ABOUT THE TARGET, SUCH AS:
+   - ANALYZING USER ROLES AND PERMISSIONS.
+   - MAPPING OUT USER WORKFLOWS AND INTERACTIONS.
+   - INVESTIGATING API ENDPOINTS AND THEIR EXPECTED BEHAVIOR.
+   - REVIEWING INPUT VALIDATION MECHANISMS.
+
+3. **VULNERABILITY IDENTIFICATION**: GUIDE ON HOW TO IDENTIFY POTENTIAL BUSINESS LOGIC ERRORS, INCLUDING:
+   - EXAMINING STATE TRANSITIONS (E.G., ORDER PLACEMENTS, STATUS UPDATES).
+   - ASSESSING PRICING LOGIC (E.G., DISCOUNTS, COUPONS).
+   - TESTING WORKFLOWS FOR RACE CONDITIONS OR IMPROPER SESSION MANAGEMENT.
+   - REVIEWING BUSINESS RULES FOR BYPASS OR MANIPULATION OPPORTUNITIES.
+
+4. **EXAMPLES OF EXPLOITS**: PROVIDE DETAILED EXAMPLES OF COMMON BUSINESS LOGIC ERRORS AND HOW THEY CAN BE EXPLOITED:
+   - **EXAMPLE 1: INSECURE DIRECT OBJECT REFERENCES (IDOR)**: EXPLAINING HOW AN ATTACKER COULD MODIFY A REQUEST PARAMETER TO ACCESS ANOTHER USER'S DATA (E.G., CHANGING A USER ID IN THE URL).
+   - **EXAMPLE 2: ORDER MANIPULATION**: DEMONSTRATING HOW AN ATTACKER MIGHT EXPLOIT A FLAW IN THE CHECKOUT PROCESS TO APPLY UNAUTHORIZED DISCOUNTS OR CHANGE PAYMENT METHODS.
+   - **EXAMPLE 3: RACE CONDITIONS**: ILLUSTRATING HOW SIMULTANEOUS REQUESTS CAN YIELD UNINTENDED BEHAVIORS, SUCH AS ALLOWING MULTIPLE PURCHASES OF LIMITED STOCK ITEMS.
+
+5. **EXPLOITATION TECHNIQUES**: DESCRIBE HOW TO DEVELOP AND EXECUTE ATTACKS BASED ON IDENTIFIED VULNERABILITIES:
+   - USING TOOLS LIKE BURP SUITE OR OWASP ZAP FOR INTERCEPTING AND MODIFYING REQUESTS.
+   - WRITING SCRIPTS TO AUTOMATE THE EXPLOITATION OF IDENTIFIED FLAWS (E.G., PYTHON SCRIPTS FOR API TESTING).
+   - RECOMMENDATIONS FOR RESPONSIBLE DISCLOSURE OF VULNERABILITIES FOUND DURING TESTING.
+
+6. **DOCUMENTATION AND REPORTING**: ADVISE ON BEST PRACTICES FOR DOCUMENTING FINDINGS AND PREPARING REPORTS FOR RESPONSIBLE DISCLOSURE TO THE TARGET ORGANIZATION.
+
+### EXAMPLE PROMPT:
+*“AS AN ETHICAL HACKER, YOU ARE TASKED WITH TESTING THE E-COMMERCE PLATFORM XYZ.COM FOR BUSINESS LOGIC VULNERABILITIES. START BY MAPPING OUT THE USER WORKFLOW FOR THE CHECKOUT PROCESS. IDENTIFY USER ROLES AND PERMISSIONS ASSOCIATED WITH DIFFERENT ACTIONS (E.G., GUEST CHECKOUT VS. REGISTERED USER). ANALYZE THE API ENDPOINTS INVOLVED IN THE CHECKOUT PROCESS TO SPOT ANY DISCREPANCIES IN THE EXPECTED BEHAVIOR. LOOK FOR POTENTIAL IDOR VULNERABILITIES BY ALTERING REQUEST PARAMETERS TO ACCESS ORDERS NOT OWNED BY THE TESTING ACCOUNT. DOCUMENT YOUR FINDINGS, INCLUDING ANY DISCOVERED EXPLOITS, AND PREPARE A REPORT THAT OUTLINES HOW THESE VULNERABILITIES COULD BE MITIGATED.”*
+
+THIS PROMPT AIMS TO PROVIDE A STRUCTURED APPROACH FOR ETHICAL HACKERS TO IDENTIFY, EXPLOIT, AND RESPONSIBLY REPORT BUSINESS LOGIC ERRORS, ULTIMATELY ENHANCING THE SECURITY POSTURE OF THE TARGET APPLICATION WHILE ADHERING TO ETHICAL GUIDELINES.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/cross-site_scripting_(xss)_-_reflected,_stored,_and_dom_prompt.txt

@@ -0,0 +1,51 @@
+Word count: 516
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH THE PROCESS OF PERFORMING RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY POTENTIAL CROSS-SITE SCRIPTING (XSS) VULNERABILITIES, INCLUDING REFLECTED, STORED, AND DOM-BASED XSS. 
+
+### OBJECTIVE:
+THE GOAL IS TO EQUIP YOU WITH A STRUCTURED APPROACH TO DETECT AND EXPLOIT XSS VULNERABILITIES IN A TARGET WEB APPLICATION, ENSURING THAT YOU ADHERE TO ETHICAL GUIDELINES AND LEGAL BOUNDARIES. YOU WILL LEARN HOW TO IDENTIFY VULNERABLE INPUT FIELDS, CRAFT PAYLOADS, AND DEMONSTRATE THE EXPLOITATION OF THESE VULNERABILITIES.
+
+### STEP-BY-STEP GUIDE FOR XSS RECONNAISSANCE AND EXPLOITATION:
+
+#### 1. **RECONNAISSANCE PHASE:**
+   - **IDENTIFY TARGET:** CHOOSE A WEB APPLICATION THAT YOU HAVE EXPLICIT PERMISSION TO TEST (E.G., A BUG BOUNTY PROGRAM).
+   - **ANALYZE THE APPLICATION:** USE TOOLS LIKE BURP SUITE, OWASP ZAP, OR MANUAL INSPECTION TO EXPLORE THE TARGET FOR USER INPUT FIELDS. PAY SPECIAL ATTENTION TO:
+     - SEARCH BOXES
+     - FEEDBACK FORMS
+     - URL QUERY PARAMETERS
+     - COOKIES AND LOCAL STORAGE
+
+#### 2. **REFLECTED XSS:**
+   - **DEFINITION:** OCCURS WHEN USER INPUT IS IMMEDIATELY REFLECTED BACK IN THE RESPONSE WITHOUT PROPER SANITIZATION.
+   - **TESTING METHOD:**
+     - **CRAFT PAYLOADS:** USE SIMPLE JAVASCRIPT PAYLOADS LIKE `<SCRIPT>ALERT('XSS');</SCRIPT>`.
+     - **INJECT PAYLOAD:** SUBMIT THE PAYLOAD THROUGH INPUT FIELDS OR URL PARAMETERS.
+     - **OBSERVE RESPONSE:** CHECK IF THE PAYLOAD IS EXECUTED IN THE BROWSER.
+   - **EXAMPLE EXPLOIT:**
+     - **INPUT:** `HTTP://TARGET.COM/SEARCH?Q=<SCRIPT>ALERT('XSS');</SCRIPT>`
+     - **EXPECTED OUTCOME:** THE ALERT BOX POPS UP, INDICATING A SUCCESSFUL EXPLOIT.
+
+#### 3. **STORED XSS:**
+   - **DEFINITION:** OCCURS WHEN USER INPUT IS STORED ON THE SERVER AND LATER SERVED TO USERS WITHOUT PROPER SANITIZATION.
+   - **TESTING METHOD:**
+     - **IDENTIFY PERSISTENT FIELDS:** LOOK FOR FIELDS THAT STORE DATA, SUCH AS COMMENTS OR USER PROFILE SECTIONS.
+     - **INJECT PAYLOAD:** SUBMIT A PAYLOAD LIKE `<SCRIPT>ALERT('STORED XSS');</SCRIPT>`.
+     - **TEST RETRIEVAL:** ACCESS THE PAGE WHERE THE DATA IS DISPLAYED TO SEE IF THE PAYLOAD EXECUTES.
+   - **EXAMPLE EXPLOIT:**
+     - **INPUT:** POSTING A COMMENT LIKE THIS: `<SCRIPT>ALERT('STORED XSS');</SCRIPT>` ON A BLOG.
+     - **EXPECTED OUTCOME:** WHEN ANOTHER USER VIEWS THE BLOG, THE SCRIPT WILL EXECUTE.
+
+#### 4. **DOM-BASED XSS:**
+   - **DEFINITION:** OCCURS WHEN THE VULNERABILITY EXISTS IN THE CLIENT-SIDE CODE RATHER THAN SERVER-SIDE CODE.
+   - **TESTING METHOD:**
+     - **ANALYZE JAVASCRIPT:** USE BROWSER DEVELOPER TOOLS TO INSPECT THE JAVASCRIPT CODE AND IDENTIFY HOW IT MANIPULATES THE DOM.
+     - **MANIPULATE URL:** CHANGE THE URL HASH OR QUERY PARAMETERS TO INCLUDE JAVASCRIPT PAYLOADS.
+   - **EXAMPLE EXPLOIT:**
+     - **INPUT:** ALTERING THE URL TO `HTTP://TARGET.COM/#<SCRIPT>ALERT('DOM XSS');</SCRIPT>`.
+     - **EXPECTED OUTCOME:** THE SCRIPT EXECUTES IF THE JAVASCRIPT ON THE PAGE USES `LOCATION.HASH` TO DIRECTLY INJECT THE CONTENT INTO THE DOM.
+
+### ADDITIONAL CONSIDERATIONS:
+- **PAYLOAD VARIATIONS:** EXPLORE MORE COMPLEX PAYLOADS TO BYPASS FILTERS, SUCH AS EVENT HANDLERS OR ENCODING TECHNIQUES.
+- **USE OF TOOLS:** LEVERAGE AUTOMATED TOOLS LIKE XSSER, XSSTRIKE, OR CUSTOM SCRIPTS TO EXPEDITE THE SCANNING PROCESS.
+- **ETHICAL GUIDELINES:** ALWAYS ENSURE YOU HAVE PERMISSION TO TEST THE TARGET. REPORT ANY DISCOVERED VULNERABILITIES RESPONSIBLY, FOLLOWING THE DISCLOSURE POLICIES OF THE ORGANIZATION.
+
+BY FOLLOWING THIS STRUCTURED APPROACH, YOU WILL BE ABLE TO EFFECTIVELY IDENTIFY AND EXPLOIT XSS VULNERABILITIES WITHIN A TARGET APPLICATION. REMEMBER TO DOCUMENT YOUR FINDINGS CLEARLY AND RESPONSIBLY DISCLOSE ANY ISSUES TO THE APPROPRIATE PARTIES.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/improper_access_control_prompt.txt

@@ -0,0 +1,32 @@
+Word count: 488
+**PROMPT FOR ETHICAL HACKING: IMPROPER ACCESS CONTROL**
+
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, YOUR OBJECTIVE IS TO PERFORM A THOROUGH RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY VULNERABILITIES RELATED TO IMPROPER ACCESS CONTROL. THIS TYPE OF VULNERABILITY OFTEN OCCURS WHEN A WEB APPLICATION FAILS TO ENFORCE PROPER AUTHORIZATION CHECKS, ALLOWING UNAUTHORIZED USERS TO ACCESS SENSITIVE INFORMATION OR FUNCTIONALITIES.
+
+### DESIRED OUTCOMES:
+1. **IDENTIFY TARGET SCOPE**: CLEARLY DEFINE THE TARGET APPLICATION OR SYSTEM YOU WILL BE TESTING, INCLUDING URLS, ENDPOINTS, AND USER ROLES. GATHER INFORMATION ABOUT THE APPLICATION’S FUNCTIONALITY AND USER ACCESS LEVELS.
+  
+2. **USER ROLE ENUMERATION**: INVESTIGATE HOW DIFFERENT USER ROLES ARE DEFINED WITHIN THE APPLICATION. LOOK FOR DISCREPANCIES IN ACCESS PERMISSIONS BY ATTEMPTING TO ENUMERATE ROLES USING VARIOUS TECHNIQUES SUCH AS:
+   - **URL MANIPULATION**: CHANGE PARAMETERS IN THE URL TO SEE IF YOU CAN ACCESS PARTS OF THE APPLICATION THAT ARE INTENDED FOR DIFFERENT USER ROLES.
+   - **SESSION HIJACKING**: USE TOOLS LIKE BURP SUITE OR OWASP ZAP TO INTERCEPT REQUESTS AND MODIFY SESSION TOKENS TO IMPERSONATE USERS WITH HIGHER PRIVILEGES.
+
+3. **ACCESS CONTROL TESTING**: USE THE FOLLOWING METHODS TO TEST FOR IMPROPER ACCESS CONTROLS:
+   - **VERTICAL PRIVILEGE ESCALATION**: IF YOU HAVE ACCESS AS A REGULAR USER, ATTEMPT TO ACCESS ADMIN-ONLY FEATURES BY MANIPULATING THE REQUEST. FOR EXAMPLE, ACCESS AN ADMIN ENDPOINT LIKE `/ADMIN/DASHBOARD` DIRECTLY.
+   - **HORIZONTAL PRIVILEGE ESCALATION**: TRY TO ACCESS RESOURCES BELONGING TO OTHER USERS, SUCH AS `/USER/PROFILE?ID=123`, CHANGING THE `ID` PARAMETER TO SEE IF YOU CAN ACCESS ANOTHER USER’S PROFILE.
+
+4. **EXAMPLE EXPLOIT SCENARIOS**:
+   - **SCENARIO 1**: IF THE APPLICATION USES PREDICTABLE URLS, ATTEMPT TO ACCESS AN ADMIN PANEL DIRECTLY BY GUESSING THE URL, E.G., `/ADMIN/SETTINGS`.
+   - **SCENARIO 2**: IF THE APPLICATION HAS A DOCUMENT UPLOAD FEATURE, TRY UPLOADING A MALICIOUS FILE AS A REGULAR USER AND CHECK IF IT CAN BE ACCESSED BY AN ADMIN OR OTHER USERS.
+   - **SCENARIO 3**: USE TOOLS SUCH AS POSTMAN TO CRAFT API REQUESTS THAT BYPASS ACCESS CONTROLS. FOR INSTANCE, SEND A REQUEST TO AN ENDPOINT LIKE `/API/V1/USERS/123` WITHOUT PROPER AUTHENTICATION TOKENS AND SEE IF THE SERVER RESPONDS WITH USER DETAILS.
+
+5. **DOCUMENT FINDINGS**: RECORD ALL INSTANCES OF IMPROPER ACCESS CONTROL YOU DISCOVER, INCLUDING THE STEPS TAKEN TO REPRODUCE THE VULNERABILITIES, POTENTIAL IMPACT, AND SUGGESTIONS FOR REMEDIATION.
+
+6. **RESPONSIBLE DISCLOSURE**: PREPARE TO REPORT YOUR FINDINGS TO THE TARGET ORGANIZATION RESPONSIBLY, EMPHASIZING THE IMPORTANCE OF FIXING THESE VULNERABILITIES TO PROTECT USER DATA AND MAINTAIN THE INTEGRITY OF THE APPLICATION.
+
+### TOOLS AND TECHNIQUES:
+- **BURP SUITE**: FOR INTERCEPTING AND MODIFYING HTTP REQUESTS.
+- **OWASP ZAP**: FOR AUTOMATED SCANNING AND FINDING VULNERABILITIES.
+- **POSTMAN**: FOR CRAFTING SPECIFIC API REQUESTS TO TEST ACCESS CONTROLS.
+- **FUZZING TOOLS**: TO AUTOMATE THE PROCESS OF TESTING DIFFERENT ENDPOINTS WITH VARYING PARAMETERS.
+
+BY FOLLOWING THIS STRUCTURED APPROACH, YOU WILL EFFECTIVELY PERFORM RECONNAISSANCE FOR IMPROPER ACCESS CONTROL VULNERABILITIES AND CONTRIBUTE TO THE OVERALL SECURITY POSTURE OF THE TARGET APPLICATION. ALWAYS REMEMBER TO OPERATE WITHIN THE LEGAL BOUNDARIES AND SCOPE OF YOUR ENGAGEMENT.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/improper_authentication_prompt.txt

@@ -0,0 +1,47 @@
+Word count: 516
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH PERFORMING RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY AND EXPLOIT VULNERABILITIES RELATED TO IMPROPER AUTHENTICATION. OUR FOCUS WILL BE ON UNDERSTANDING COMMON FLAWS IN AUTHENTICATION MECHANISMS, GATHERING NECESSARY INFORMATION, AND PROVIDING EXAMPLES OF POTENTIAL EXPLOITS.
+
+### PROMPT FOR RECONNAISSANCE ON IMPROPER AUTHENTICATION VULNERABILITIES:
+
+1. **TARGET IDENTIFICATION:**
+   - CLEARLY DEFINE YOUR TARGET APPLICATION OR WEBSITE. INCLUDE THE URL AND ANY RELEVANT SUBDOMAINS THAT MAY CONTAIN AUTHENTICATION MECHANISMS (E.G., `LOGIN.TARGET.COM`, `API.TARGET.COM`).
+
+2. **INFORMATION GATHERING:**
+   - BEGIN BY COLLECTING INFORMATION ABOUT THE TARGET'S AUTHENTICATION SYSTEM. LOOK FOR:
+     - **PUBLICLY AVAILABLE DOCUMENTATION**: API DOCUMENTATION, USER MANUALS, OR ANY RESOURCES THAT PROVIDE INSIGHTS INTO AUTHENTICATION METHODS (JWT, OAUTH, ETC.).
+     - **DNS ENUMERATION**: USE TOOLS LIKE `NSLOOKUP` OR `DIG` TO DISCOVER SUBDOMAINS RELATED TO AUTHENTICATION.
+     - **PORT SCANNING**: USE TOOLS LIKE NMAP TO IDENTIFY OPEN PORTS THAT MIGHT BE ASSOCIATED WITH AUTHENTICATION SERVICES (E.G., HTTP, HTTPS, SSH).
+     - **WEB APPLICATION SCANNING**: TOOLS LIKE OWASP ZAP OR BURP SUITE CAN HELP IDENTIFY ENDPOINTS RELATED TO USER LOGIN, REGISTRATION, PASSWORD RECOVERY, AND ANY POTENTIAL MISCONFIGURATIONS.
+
+3. **TESTING FOR IMPROPER AUTHENTICATION:**
+   - **BRUTE FORCE ATTACK**: IF APPLICABLE, TEST FOR WEAK PASSWORDS USING TOOLS LIKE HYDRA OR BURP SUITE'S INTRUDER FEATURE. CREATE A LIST OF COMMON PASSWORDS OR USE A DICTIONARY ATTACK TO SEE IF ACCOUNTS CAN BE ACCESSED.
+   - **SESSION MANAGEMENT**: ANALYZE HOW SESSIONS ARE HANDLED. CHECK FOR:
+     - PREDICTABLE SESSION IDS.
+     - SESSION FIXATION VULNERABILITIES (TRY SETTING SESSION IDS BEFORE LOGIN).
+     - PROPER EXPIRATION OF SESSIONS UPON LOGOUT OR INACTIVITY.
+   - **AUTHORIZATION BYPASS**: TEST IF IT'S POSSIBLE TO ACCESS RESTRICTED RESOURCES WITHOUT PROPER AUTHENTICATION. THIS CAN INVOLVE:
+     - MODIFYING REQUEST PARAMETERS TO BYPASS CHECKS (E.G., CHANGING USER ROLES IN REQUESTS).
+     - EXPLORING IF ENDPOINTS ARE ACCESSIBLE WITH MISSING OR INVALID TOKENS.
+
+4. **EXAMPLES OF EXPLOITS:**
+   - **BRUTE FORCE LOGIN**: IF YOU DISCOVER THAT THE LOGIN PAGE DOES NOT IMPLEMENT ACCOUNT LOCKOUT MECHANISMS, USE A TOOL LIKE HYDRA TO AUTOMATE PASSWORD GUESSING:
+     ```BASH
+     HYDRA -L ADMIN -P /PATH/TO/WORDLIST.TXT TARGET.COM HTTP-POST-FORM "/LOGIN:USERNAME=^USER^&PASSWORD=^PASS^:F=INCORRECT"
+     ```
+   - **SESSION FIXATION**: IF YOU CAN SET SESSION IDS, YOU MIGHT EXPLOIT IT BY:
+     - SETTING YOUR SESSION ID IN THE LOGIN URL AND THEN LOGGING IN WITH A VICTIM'S CREDENTIALS.
+   - **DIRECT OBJECT REFERENCE**: TEST FOR API ENDPOINTS THAT ALLOW ACCESSING USER DATA BY MANIPULATING USER IDS IN THE REQUEST:
+     ```HTTP
+     GET /API/USER/12345
+     ```
+     MODIFY IT TO:
+     ```HTTP
+     GET /API/USER/1
+     ```
+     IF THE SYSTEM ALLOWS ACCESS TO USER ID 1 WITHOUT PROPER AUTHORIZATION CHECKS, YOU MAY BE ABLE TO RETRIEVE SENSITIVE DATA.
+
+5. **REPORTING FINDINGS:**
+   - DOCUMENT ALL FINDINGS IN A STRUCTURED MANNER, DETAILING THE STEPS TAKEN, THE VULNERABILITIES DISCOVERED, AND POTENTIAL IMPACTS. INCLUDE RECOMMENDATIONS FOR REMEDIATION TO HELP THE TARGET IMPROVE THEIR SECURITY POSTURE.
+
+### DESIRED OUTCOME:
+BY FOLLOWING THIS PROMPT, YOU SHOULD BE ABLE TO IDENTIFY AND EXPLOIT IMPROPER AUTHENTICATION VULNERABILITIES IN YOUR TARGET APPLICATION. THE GOAL IS TO GATHER ENOUGH EVIDENCE TO PROVIDE A COMPREHENSIVE REPORT TO THE TARGET ORGANIZATION, CONTRIBUTING TO THEIR OVERALL SECURITY IMPROVEMENT WHILE ADHERING TO ETHICAL HACKING GUIDELINES. ALWAYS ENSURE THAT YOU HAVE THE NECESSARY PERMISSIONS BEFORE CONDUCTING ANY TESTING.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/information_disclosure_prompt.txt

@@ -0,0 +1,46 @@
+Word count: 487
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I AM HERE TO ASSIST YOU IN CONDUCTING THOROUGH RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY POTENTIAL INFORMATION DISCLOSURE VULNERABILITIES. INFORMATION DISCLOSURE VULNERABILITIES CAN ALLOW UNAUTHORIZED ACCESS TO SENSITIVE DATA, WHICH CAN BE EXPLOITED IN VARIOUS WAYS. 
+
+### DESIRED OUTCOME:
+THE GOAL IS TO IDENTIFY AND EXPLOIT INFORMATION DISCLOSURE VULNERABILITIES IN YOUR TARGET'S WEB APPLICATION OR INFRASTRUCTURE. THIS INCLUDES GATHERING INFORMATION THAT MIGHT REVEAL SENSITIVE DATA, SUCH AS ERROR MESSAGES, MISCONFIGURATIONS, SENSITIVE FILES, OR ANY EXPOSED ENVIRONMENT VARIABLES THAT COULD BE LEVERAGED FOR FURTHER ATTACKS.
+
+### STEPS FOR RECONNAISSANCE:
+
+1. **IDENTIFY THE TARGET:**
+   - SPECIFY THE URL OR IP ADDRESS OF THE TARGET.
+   - GATHER BASIC INFORMATION ABOUT THE TARGET SUCH AS THE TECHNOLOGY STACK, SERVER INFORMATION, AND ANY KNOWN SERVICES RUNNING.
+
+2. **USE AUTOMATED TOOLS:**
+   - EMPLOY TOOLS LIKE **BURP SUITE**, **OWASP ZAP**, OR **NIKTO** TO SCAN FOR VULNERABILITIES. FOCUS ON OPTIONS THAT REVEAL INFORMATION LEAKS, SUCH AS:
+     - DIRECTORY AND FILE ENUMERATION.
+     - SERVER MISCONFIGURATION CHECKS.
+     - EXPOSED APIS.
+
+3. **MANUAL TESTING TECHNIQUES:**
+   - **ERROR MESSAGES:** DELIBERATELY TRIGGER ERRORS BY INPUTTING UNEXPECTED DATA INTO FORMS. OBSERVE THE SERVER'S RESPONSE FOR ANY STACK TRACES OR SENSITIVE INFORMATION.
+   - **HTTP HEADERS:** ANALYZE HTTP RESPONSE HEADERS USING TOOLS LIKE **CURL** OR BROWSER DEVELOPER TOOLS TO CHECK FOR OVERLY VERBOSE HEADERS OR SENSITIVE INFORMATION (LIKE `X-POWERED-BY`, `SERVER`, ETC.).
+   - **FILE ENUMERATION:** TRY ACCESSING COMMON FILE PATHS THAT MAY CONTAIN SENSITIVE INFORMATION SUCH AS `/ROBOTS.TXT`, `/SITEMAP.XML`, OR BACKUP FILES (`.BAK`, `.OLD`, ETC.)
+
+4. **LOOK FOR INFORMATION IN SOURCE CODE:**
+   - IF THE TARGET HAS A WEB APPLICATION WITH ACCESSIBLE SOURCE FILES (E.G., JAVASCRIPT), REVIEW THEM FOR ANY HARDCODED CREDENTIALS, API KEYS, OR CONFIDENTIAL INFORMATION.
+   - USE TOOLS LIKE **GITTOOLS** OR **GITHUB'S SEARCH** TO CHECK FOR ANY PUBLIC REPOSITORIES THAT MAY CONTAIN SENSITIVE DATA.
+
+5. **CHECK FOR MISCONFIGURED SERVICES:**
+   - INVESTIGATE SERVICES EXPOSED TO THE INTERNET (E.G., DATABASES, ADMIN PANELS) FOR DEFAULT CREDENTIALS OR MISCONFIGURATIONS THAT COULD LEAD TO INFORMATION DISCLOSURE.
+
+### EXAMPLES OF EXPLOITS:
+
+1. **DIRECTORY TRAVERSAL:**
+   - IF YOU FIND A VULNERABLE FILE UPLOAD MECHANISM, ATTEMPT TO EXPLOIT IT BY USING DIRECTORY TRAVERSAL PAYLOADS (E.G., `../../ETC/PASSWD`) TO ACCESS SENSITIVE FILES ON THE SERVER.
+
+2. **SENSITIVE ERROR MESSAGES:**
+   - TRIGGER A SQL ERROR BY INPUTTING A MALFORMED SQL QUERY. IF THE RESPONSE INCLUDES DATABASE STRUCTURE DETAILS, YOU CAN USE THIS INFORMATION TO CRAFT FURTHER ATTACKS.
+
+3. **EXPOSED APIS:**
+   - IF YOU IDENTIFY AN API ENDPOINT THAT RETURNS SENSITIVE USER INFORMATION (E.G., `/API/USERS`), YOU CAN LEVERAGE THIS ENDPOINT TO GATHER USER DATA OR PERFORM UNAUTHORIZED ACTIONS IF THERE ARE NO PROPER AUTHENTICATION CHECKS IN PLACE.
+
+### FINAL NOTES:
+- ALWAYS ENSURE THAT YOU HAVE PERMISSION TO TEST THE TARGET AND ADHERE TO ETHICAL GUIDELINES AND LEGAL FRAMEWORKS.
+- DOCUMENT YOUR FINDINGS METICULOUSLY, INCLUDING ANY STEPS TAKEN TO REPRODUCE THE VULNERABILITIES AND THEIR POTENTIAL IMPACT.
+
+WITH THIS STRUCTURED APPROACH, YOU CAN EFFECTIVELY PERFORM RECONNAISSANCE TO UNCOVER INFORMATION DISCLOSURE VULNERABILITIES IN YOUR TARGET.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/insecure_direct_object_reference_(idor)_prompt.txt

@@ -0,0 +1,71 @@
+Word count: 484
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH PERFORMING RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY VULNERABILITIES RELATED TO INSECURE DIRECT OBJECT REFERENCE (IDOR). THE OBJECTIVE IS TO UNDERSTAND HOW IDOR VULNERABILITIES CAN BE EXPLOITED AND TO PROVIDE DETAILED EXAMPLES OF POTENTIAL EXPLOITS.
+
+### PROMPT:
+
+---
+
+**TITLE: RECONNAISSANCE AND EXPLOITATION OF INSECURE DIRECT OBJECT REFERENCE (IDOR)**
+
+**OBJECTIVE:** TO IDENTIFY AND EXPLOIT IDOR VULNERABILITIES IN A TARGET APPLICATION.
+
+**STEP-BY-STEP GUIDE:**
+
+1. **TARGET SELECTION:**
+   - CHOOSE A WEB APPLICATION THAT HANDLES USER INPUT AND HAS AN AUTHENTICATION MECHANISM. EXAMPLES INCLUDE USER PROFILES, DOCUMENT MANAGEMENT SYSTEMS, OR ANY APPLICATION THAT REFERENCES OBJECTS BY AN IDENTIFIER (LIKE USER IDS, FILE IDS, ETC.).
+
+2. **INFORMATION GATHERING:**
+   - **ANALYZE URLS AND PARAMETERS**: EXAMINE THE URLS USED IN THE APPLICATION. LOOK FOR PARAMETERS THAT MIGHT REFERENCE INTERNAL OBJECTS. FOR EXAMPLE:
+     ```
+     HTTPS://EXAMPLE.COM/PROFILE?ID=123
+     HTTPS://EXAMPLE.COM/DOCUMENTS/VIEW?FILE_ID=456
+     ```
+   - **CHECK FOR SESSION MANAGEMENT**: UNDERSTAND HOW THE APPLICATION MANAGES USER SESSIONS. ARE USER IDS OR FILE IDS PREDICTABLE?
+   - **USER ROLE IDENTIFICATION**: DETERMINE THE ROLES THAT USERS CAN ASSUME WITHIN THE APPLICATION. THIS WILL HELP IDENTIFY WHICH USER IDS OR RESOURCES TO TEST AGAINST.
+
+3. **TESTING FOR IDOR VULNERABILITIES:**
+   - **MODIFY PARAMETERS**: CHANGE THE ID VALUES IN THE URL TO SEE IF YOU CAN ACCESS OBJECTS BELONGING TO OTHER USERS. FOR EXAMPLE, IF YOU’RE LOGGED IN AS USER ID 123, TRY ACCESSING:
+     ```
+     HTTPS://EXAMPLE.COM/PROFILE?ID=124
+     ```
+   - **USE AUTOMATED TOOLS**: CONSIDER USING TOOLS LIKE BURP SUITE OR OWASP ZAP TO AUTOMATE THE REQUEST SENDING AND PARAMETER MANIPULATION.
+
+4. **EXPLOITATION EXAMPLES:**
+   - **EXAMPLE 1**: **USER PROFILE ACCESS**
+     - **VULNERABLE REQUEST**: 
+       ```
+       GET HTTPS://EXAMPLE.COM/PROFILE?ID=123
+       ```
+     - **EXPLOITATION**: CHANGE THE ID TO ACCESS ANOTHER USER'S PROFILE:
+       ```
+       GET HTTPS://EXAMPLE.COM/PROFILE?ID=124
+       ```
+     - **OUTCOME**: IF SUCCESSFUL, YOU MIGHT VIEW SENSITIVE INFORMATION OF USER ID 124.
+
+   - **EXAMPLE 2**: **FILE DOWNLOAD ACCESS**
+     - **VULNERABLE REQUEST**:
+       ```
+       GET HTTPS://EXAMPLE.COM/DOCUMENTS/DOWNLOAD?FILE_ID=789
+       ```
+     - **EXPLOITATION**: ATTEMPT ACCESSING FILES BY CHANGING THE FILE_ID:
+       ```
+       GET HTTPS://EXAMPLE.COM/DOCUMENTS/DOWNLOAD?FILE_ID=790
+       ```
+     - **OUTCOME**: IF YOU GAIN ACCESS TO A FILE NOT INTENDED FOR YOUR USER, DOCUMENT THE RESULT.
+
+5. **VALIDATION:**
+   - AFTER IDENTIFYING A POTENTIAL IDOR VULNERABILITY, VALIDATE FINDINGS BY CHECKING THE ACCESS CONTROLS. DOCUMENT WHETHER UNAUTHORIZED ACCESS IS CONSISTENTLY POSSIBLE BY CHANGING THE OBJECT REFERENCE.
+
+6. **REPORTING:**
+   - COMPILE YOUR FINDINGS INTO A DETAILED REPORT, INCLUDING:
+     - THE STEPS TAKEN TO IDENTIFY THE VULNERABILITY.
+     - THE SPECIFIC URLS EXPLOITED AND THE RESPONSES RECEIVED.
+     - RECOMMENDATIONS FOR FIXING THE IDOR ISSUE (E.G., IMPLEMENTING PROPER ACCESS CONTROLS, VALIDATING USER PERMISSIONS BEFORE GRANTING ACCESS TO RESOURCES).
+
+### CONCLUSION:
+
+BY FOLLOWING THESE STEPS, YOU SHOULD BE ABLE TO CONDUCT EFFECTIVE RECONNAISSANCE AND IDENTIFY POTENTIAL INSECURE DIRECT OBJECT REFERENCE VULNERABILITIES WITHIN THE TARGET APPLICATION. ALWAYS REMEMBER TO APPROACH ETHICAL HACKING WITH INTEGRITY, ENSURING YOU HAVE PERMISSION TO TEST THE SYSTEMS YOU ARE ANALYZING.
+
+--- 
+
+THIS PROMPT SERVES AS A COMPREHENSIVE GUIDE FOR ETHICAL HACKERS LOOKING TO IDENTIFY AND EXPLOIT IDOR VULNERABILITIES WHILE ADHERING TO ETHICAL STANDARDS AND REPORTING PROTOCOLS.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/misconfiguration_prompt.txt

@@ -0,0 +1,69 @@
+Word count: 599
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH PERFORMING RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY POTENTIAL MISCONFIGURATIONS THAT COULD BE EXPLOITED. MISCONFIGURATIONS ARE AMONG THE MOST COMMON VULNERABILITIES FOUND IN SYSTEMS AND CAN LEAD TO UNAUTHORIZED ACCESS, DATA LEAKS, AND OTHER SECURITY BREACHES. 
+
+### PROMPT FOR MISCONFIGURATION RECONNAISSANCE:
+
+**OBJECTIVE:** YOU ARE TASKED WITH IDENTIFYING MISCONFIGURATIONS IN A WEB APPLICATION OR SERVER THAT COULD BE EXPLOITED. YOUR GOAL IS TO GATHER INFORMATION THAT HIGHLIGHTS THESE WEAKNESSES AND PROVIDES EXAMPLES OF POTENTIAL EXPLOITS.
+
+**TARGET:** [INSERT THE URL OR IP ADDRESS OF THE TARGET SYSTEM HERE]
+
+**STEP 1: GATHER BASIC INFORMATION**
+- **PERFORM DNS ENUMERATION:** USE TOOLS LIKE `NSLOOKUP`, `DIG`, OR `DNSENUM` TO GATHER SUBDOMAINS AND DNS RECORDS ASSOCIATED WITH THE TARGET. LOOK FOR MISCONFIGURED DNS RECORDS SUCH AS OPEN DNS RESOLVERS.
+  
+  EXAMPLE COMMAND:
+  ```
+  DIG +SHORT SUBDOMAIN.TARGET.COM
+  ```
+
+- **IDENTIFY OPEN PORTS AND SERVICES:** UTILIZE TOOLS SUCH AS `NMAP` TO SCAN FOR OPEN PORTS AND THE SERVICES RUNNING ON THEM. LOOK FOR OUTDATED SERVICES OR DEFAULT CONFIGURATIONS THAT COULD BE INSECURE.
+
+  EXAMPLE COMMAND:
+  ```
+  NMAP -SV -P- TARGET.COM
+  ```
+
+**STEP 2: ANALYZE WEB APPLICATION CONFIGURATION**
+- **CHECK FOR DEFAULT CREDENTIALS:** ATTEMPT TO LOG IN TO ADMIN PANELS OR SENSITIVE AREAS USING DEFAULT CREDENTIALS. MANY APPLICATIONS HAVE HARDCODED OR DEFAULT USERNAMES AND PASSWORDS THAT ARE EASILY FOUND ONLINE.
+
+- **REVIEW HTTP HEADERS:** USE TOOLS LIKE `CURL` OR BROWSER DEVELOPER TOOLS TO INSPECT HTTP HEADERS. LOOK FOR MISCONFIGURATIONS SUCH AS OVERLY VERBOSE ERROR MESSAGES OR MISSING SECURITY HEADERS (E.G., `X-CONTENT-TYPE-OPTIONS`, `X-FRAME-OPTIONS`).
+
+  EXAMPLE COMMAND:
+  ```
+  CURL -I TARGET.COM
+  ```
+
+**STEP 3: INVESTIGATE FILE PERMISSIONS**
+- **DIRECTORY LISTING VULNERABILITIES:** ACCESS DIRECTORIES DIRECTLY VIA A BROWSER OR TOOLS LIKE `GOBUSTER` TO CHECK FOR DIRECTORY LISTINGS. IF DIRECTORY LISTING IS ENABLED, SENSITIVE FILES MAY BE EXPOSED.
+
+  EXAMPLE COMMAND:
+  ```
+  GOBUSTER DIR -U TARGET.COM -W /PATH/TO/WORDLIST.TXT
+  ```
+
+- **UNPROTECTED FILES AND CONFIGURATIONS:** LOOK FOR SENSITIVE FILES THAT ARE PUBLICLY ACCESSIBLE, SUCH AS BACKUP FILES (`.BAK`, `.ZIP`, `.TAR`), CONFIGURATION FILES (`CONFIG.PHP`, `.ENV`), OR LOGS.
+
+**STEP 4: CONDUCT A CONFIGURATION REVIEW**
+- **MISCONFIGURED CORS SETTINGS:** TEST THE CROSS-ORIGIN RESOURCE SHARING (CORS) POLICIES BY MAKING REQUESTS FROM UNAUTHORIZED ORIGINS. MISCONFIGURATIONS COULD ALLOW MALICIOUS SITES TO MAKE REQUESTS ON BEHALF OF A USER.
+
+- **EXAMINE SSL/TLS CONFIGURATIONS:** USE TOOLS LIKE `SSL LABS` OR `TESTSSL.SH` TO EVALUATE THE STRENGTH AND CONFIGURATION OF SSL/TLS SETTINGS. LOOK FOR ISSUES SUCH AS WEAK CIPHERS OR EXPIRED CERTIFICATES.
+
+**STEP 5: DOCUMENT FINDINGS**
+- COMPILE YOUR FINDINGS IN A STRUCTURED REPORT, DETAILING THE MISCONFIGURATIONS DISCOVERED, POTENTIAL IMPACTS, AND RECOMMENDED REMEDIATIONS. INCLUDE EXAMPLES OF HOW THESE MISCONFIGURATIONS COULD BE EXPLOITED, SUCH AS:
+
+  - **SQL INJECTION VIA MISCONFIGURED DATABASE PERMISSIONS:** IF THE APPLICATION HAS EXCESSIVE PRIVILEGES, AN ATTACKER COULD INJECT MALICIOUS SQL CODE.
+  - **SENSITIVE INFORMATION DISCLOSURE VIA MISCONFIGURED SERVER DIRECTORIES:** IF SENSITIVE FILES ARE ACCESSIBLE, AN ATTACKER COULD DOWNLOAD THEM AND EXPLOIT THE INFORMATION CONTAINED WITHIN.
+
+### EXAMPLE EXPLOIT SCENARIOS:
+1. **DEFAULT CREDENTIALS:**
+   - EXPLOIT: USE DEFAULT CREDENTIALS TO GAIN ADMINISTRATIVE ACCESS.
+   - EXAMPLE: IF A WEB APPLICATION USES "ADMIN/ADMIN" AS DEFAULT CREDENTIALS, LOG IN USING THESE CREDENTIALS.
+
+2. **OPEN DIRECTORY LISTING:**
+   - EXPLOIT: ACCESS SENSITIVE FILES VIA A PUBLICLY ACCESSIBLE DIRECTORY.
+   - EXAMPLE: IF THE URL `HTTP://TARGET.COM/UPLOADS/` SHOWS A LIST OF FILES, DOWNLOAD ANY SENSITIVE FILES.
+
+3. **CORS MISCONFIGURATION:**
+   - EXPLOIT: PERFORM CROSS-SITE REQUEST FORGERY (CSRF) BY SENDING REQUESTS FROM AN UNAUTHORIZED SITE.
+   - EXAMPLE: CRAFT A MALICIOUS WEBSITE THAT MAKES REQUESTS TO `HTTP://TARGET.COM/API/USER` TO CHANGE USER INFORMATION.
+
+BY FOLLOWING THIS STRUCTURED APPROACH, YOU WILL BE ABLE TO IDENTIFY, ANALYZE, AND EXPLOIT MISCONFIGURATIONS EFFECTIVELY. ALWAYS REMEMBER TO OPERATE WITHIN LEGAL AND ETHICAL BOUNDARIES, OBTAINING PROPER AUTHORIZATION BEFORE TESTING ANY TARGET.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/privilege_escalation_prompt.txt

@@ -0,0 +1,48 @@
+Word count: 514
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I CAN HELP YOU PERFORM RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY POTENTIAL PRIVILEGE ESCALATION VULNERABILITIES. THE GOAL IS TO GATHER INFORMATION ABOUT THE TARGET SYSTEM, UNDERSTAND ITS CONFIGURATION, AND LOCATE ANY WEAKNESSES THAT COULD BE EXPLOITED TO ESCALATE PRIVILEGES. HERE’S A DETAILED PROMPT TO GUIDE YOU THROUGH THE PROCESS:
+
+---
+
+**PROMPT FOR PRIVILEGE ESCALATION RECONNAISSANCE:**
+
+1. **DEFINE YOUR TARGET:**
+   - IDENTIFY THE SPECIFIC SYSTEM OR APPLICATION YOU ARE TARGETING FOR PRIVILEGE ESCALATION.
+   - GATHER INFORMATION SUCH AS THE OPERATING SYSTEM, VERSION, AND ANY SPECIFIC SOFTWARE THAT IS RUNNING (E.G., WEB SERVERS, DATABASES).
+
+2. **INFORMATION GATHERING:**
+   - USE TOOLS LIKE NMAP TO PERFORM A NETWORK SCAN TO IDENTIFY OPEN PORTS AND SERVICES RUNNING ON THE TARGET.
+     - EXAMPLE COMMAND: `NMAP -SV -P- [TARGET_IP]`
+   - ENUMERATE USERS AND GROUPS ON THE SYSTEM.
+     - IF YOU HAVE ACCESS, USE COMMANDS LIKE `NET USER` (WINDOWS) OR `CAT /ETC/PASSWD` (LINUX).
+   - CHECK FOR INSTALLED SOFTWARE AND THEIR VERSIONS THAT MIGHT HAVE KNOWN VULNERABILITIES.
+     - TOOLS LIKE `SEARCHSPLOIT` CAN HELP MATCH SOFTWARE VERSIONS TO KNOWN EXPLOITS.
+
+3. **VULNERABILITY ASSESSMENT:**
+   - LOOK FOR COMMON PRIVILEGE ESCALATION VULNERABILITIES:
+     - **MISCONFIGURED FILE PERMISSIONS**: IDENTIFY FILES OR DIRECTORIES THAT ARE WRITABLE BY NON-PRIVILEGED USERS.
+       - EXAMPLE: `LS -LA /ETC/PASSWD`
+     - **SUID/SGID BINARIES**: FIND BINARIES THAT HAVE THE SUID OR SGID BIT SET, WHICH CAN ALLOW FOR PRIVILEGE ESCALATION.
+       - COMMAND: `FIND / -PERM -4000 -O -PERM -2000 -EXEC LS -LA {} \;`
+     - **KERNEL VULNERABILITIES**: CHECK IF THE OPERATING SYSTEM IS OUTDATED OR HAS KNOWN KERNEL VULNERABILITIES.
+       - USE TOOLS LIKE `UNAME -R` TO GET THE KERNEL VERSION, THEN LOOK IT UP IN THE CVE DATABASE.
+
+4. **EXAMPLES OF PRIVILEGE ESCALATION EXPLOITS:**
+   - **EXPLOITING SUID BINARIES**: IF YOU FIND A SUID BINARY (E.G., `/USR/BIN/EXAMPLE_SUID`), YOU CAN EXPLOIT IT BY CRAFTING INPUT THAT LEADS TO A SHELL EXECUTION WITH ELEVATED PRIVILEGES.
+     - EXAMPLE: IF THE BINARY IS VULNERABLE TO BUFFER OVERFLOW, YOU COULD USE A PAYLOAD TO OVERWRITE THE RETURN ADDRESS AND REDIRECT EXECUTION TO YOUR SHELL.
+  
+   - **EXPLOITING MISCONFIGURED CRON JOBS**: IF THERE ARE CRON JOBS RUNNING WITH ROOT PRIVILEGES THAT EXECUTE SCRIPTS, CHECK IF THOSE SCRIPTS CAN BE MODIFIED.
+     - EXAMPLE: IF YOU CAN MODIFY A SCRIPT THAT RUNS AS ROOT, YOU CAN INSERT YOUR OWN PAYLOAD TO EXECUTE A SHELL AS ROOT WHEN THE CRON JOB RUNS.
+
+5. **POST-EXPLOITATION:**
+   - ONCE YOU HAVE SUCCESSFULLY ESCALATED PRIVILEGES, ENSURE YOU MAINTAIN ACCESS RESPONSIBLY AND ETHICALLY.
+   - DOCUMENT YOUR FINDINGS, INCLUDING THE STEPS TAKEN AND THE VULNERABILITIES EXPLOITED, TO PROVIDE A CLEAR REPORT TO THE SYSTEM OWNER.
+
+6. **REPORTING:**
+   - PREPARE A DETAILED REPORT OUTLINING THE VULNERABILITIES DISCOVERED, THE IMPACT OF EACH, AND THE STEPS TAKEN TO EXPLOIT THEM.
+   - INCLUDE RECOMMENDATIONS FOR REMEDIATION TO STRENGTHEN THE SYSTEM AGAINST FUTURE ATTACKS.
+
+REMEMBER TO CONDUCT ALL ACTIVITIES WITHIN THE BOUNDS OF LEGALITY AND ETHICAL GUIDELINES. ALWAYS HAVE EXPLICIT PERMISSION FROM THE TARGET SYSTEM’S OWNER BEFORE PERFORMING ANY SCANNING OR EXPLOITATION.
+
+--- 
+
+THIS PROMPT IS DESIGNED TO HELP YOU SYSTEMATICALLY APPROACH PRIVILEGE ESCALATION TESTING, ENSURING YOU COVER ALL CRITICAL ASPECTS FROM RECONNAISSANCE TO EXPLOITATION AND REPORTING.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/server-side_request_forgery_(ssrf)_prompt.txt

@@ -0,0 +1,60 @@
+Word count: 523
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH THE PROCESS OF PERFORMING RECONNAISSANCE FOR SERVER-SIDE REQUEST FORGERY (SSRF) VULNERABILITIES ON A SPECIFIC TARGET. THE OBJECTIVE OF THIS PROMPT IS TO HELP YOU UNDERSTAND HOW TO IDENTIFY POTENTIAL SSRF VULNERABILITIES, GATHER NECESSARY INFORMATION, AND EXPLORE EXAMPLES OF EXPLOITS AND HOW TO EFFECTIVELY EXECUTE THEM.
+
+### PROMPT:
+
+**TARGET IDENTIFICATION AND INFORMATION GATHERING:**
+
+1. **IDENTIFY THE TARGET APPLICATION:**
+   - DEFINE THE TARGET WEB APPLICATION WHERE YOU SUSPECT THE PRESENCE OF SSRF VULNERABILITIES. THIS COULD BE A WEB SERVICE THAT ACCEPTS URLS OR FILE PATHS AS INPUT.
+   - EXAMPLE: A CLOUD SERVICE THAT ALLOWS USERS TO FETCH METADATA FROM A URL.
+
+2. **ANALYZE INPUT FIELDS:**
+   - INVESTIGATE THE INPUT FIELDS OF THE WEB APPLICATION, ESPECIALLY THOSE THAT ACCEPT URLS OR EXTERNAL RESOURCE REQUESTS.
+   - LOOK FOR PARAMETERS THAT MAY ACCEPT USER INPUT, SUCH AS:
+     - FORM FIELDS (E.G., `URL`, `ENDPOINT`, `FILE`)
+     - API ENDPOINTS THAT ACCEPT URL PARAMETERS
+
+3. **EXAMINE THE APPLICATION BEHAVIOR:**
+   - TEST HOW THE APPLICATION HANDLES REQUESTS AND WHAT RESPONSES ARE GENERATED BASED ON THE INPUT.
+   - EXAMPLE: IF AN INPUT FIELD ALLOWS YOU TO INPUT A URL, OBSERVE HOW THE APPLICATION PROCESSES IT AND WHETHER IT RETURNS DATA FROM THE SPECIFIED RESOURCE.
+
+**VULNERABILITY EXPLORATION:**
+
+1. **TESTING FOR SSRF:**
+   - CRAFT VARIOUS PAYLOADS TO TEST WHETHER THE APPLICATION IS VULNERABLE TO SSRF. SOME COMMON TESTING METHODS INCLUDE:
+     - LOCALHOST: `HTTP://LOCALHOST:8080`
+     - INTERNAL IP ADDRESSES: `HTTP://127.0.0.1`, `HTTP://169.254.169.254` (AWS METADATA SERVICE)
+     - NONEXISTENT URLS: `HTTP://NONEXISTENT.LOCAL`
+
+2. **RESPONSE VALIDATION:**
+   - CHECK THE APPLICATION'S RESPONSES TO SEE IF IT RETURNS DATA FROM THE ENDPOINTS YOU PROVIDED. IF IT DOES, THIS INDICATES A POTENTIAL SSRF VULNERABILITY.
+   - EXAMPLE: IF YOU INPUT `HTTP://169.254.169.254/LATEST/META-DATA/` AND RECEIVE METADATA IN RESPONSE, THE APPLICATION MAY BE VULNERABLE.
+
+**EXPLOITATION EXAMPLES:**
+
+1. **ACCESSING INTERNAL SERVICES:**
+   - ONCE YOU CONFIRM THAT THE APPLICATION IS VULNERABLE, ATTEMPT TO ACCESS INTERNAL SERVICES THAT MAY BE EXPOSED. FOR INSTANCE:
+     - ACCESSING A DATABASE ADMIN INTERFACE RUNNING ON `HTTP://127.0.0.1:5432` OR `HTTP://192.168.1.100:3306`.
+
+2. **EXFILTRATING SENSITIVE DATA:**
+   - USE THE SSRF VULNERABILITY TO EXFILTRATE SENSITIVE INFORMATION:
+     - EXAMPLE PAYLOAD: `HTTP://169.254.169.254/LATEST/META-DATA/IAM/SECURITY-CREDENTIALS/`
+     - CAPTURE SENSITIVE AWS IAM ROLE CREDENTIALS THAT MAY BE RETURNED.
+
+3. **SERVER INTERACTION:**
+   - IF THE SSRF ALLOWS INTERACTION WITH OTHER SERVICES, YOU MAY SEND CRAFTED REQUESTS TO PERFORM ACTIONS:
+     - EXAMPLE: SENDING A POST REQUEST TO AN INTERNAL API ENDPOINT TO TRIGGER ACTIONS THAT SHOULD BE RESTRICTED.
+
+**MITIGATION AND REPORTING:**
+
+1. **DOCUMENT FINDINGS:**
+   - RECORD THE STEPS YOU TOOK DURING THE RECONNAISSANCE AND EXPLOITATION PHASES, ALONG WITH ANY SENSITIVE DATA ACCESSED.
+   - PREPARE A DETAILED REPORT OUTLINING THE SSRF VULNERABILITY, ITS IMPACT, AND RECOMMENDED MITIGATIONS FOR THE TARGET APPLICATION.
+
+2. **RESPONSIBLE DISCLOSURE:**
+   - FOLLOW THE RESPONSIBLE DISCLOSURE GUIDELINES SET BY THE ORGANIZATION YOU ARE TARGETING, ENSURING THAT SENSITIVE INFORMATION IS HANDLED WITH CARE AND THAT REMEDIATION STEPS ARE PROVIDED.
+
+### DESIRED OUTCOME:
+
+BY FOLLOWING THIS PROMPT, YOU WILL GAIN A COMPREHENSIVE UNDERSTANDING OF HOW TO IDENTIFY, EXPLORE, AND EXPLOIT SSRF VULNERABILITIES EFFECTIVELY. YOU WILL ALSO LEARN HOW TO DOCUMENT YOUR FINDINGS RESPONSIBLY AND PROVIDE ACTIONABLE INSIGHTS FOR REMEDIATION. REMEMBER TO ALWAYS ACT ETHICALLY AND WITHIN THE BOUNDARIES SET BY THE TARGET’S BUG BOUNTY PROGRAM.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/sql_injection_prompt.txt

@@ -0,0 +1,62 @@
+Word count: 478
+**PROMPT FOR ETHICAL HACKING AND SQL INJECTION RECONNAISSANCE**
+
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH THE PROCESS OF PERFORMING RECONNAISSANCE ON A SPECIFIC TARGET TO IDENTIFY POTENTIAL SQL INJECTION VULNERABILITIES. THIS PROMPT WILL PROVIDE YOU WITH A DETAILED METHODOLOGY, EXAMPLES OF EXPLOITS, AND STEP-BY-STEP INSTRUCTIONS ON HOW TO EXPLOIT THESE VULNERABILITIES RESPONSIBLY AND ETHICALLY, ENSURING COMPLIANCE WITH ALL LEGAL AND ETHICAL STANDARDS.
+
+### OBJECTIVE:
+TO IDENTIFY AND EXPLOIT SQL INJECTION VULNERABILITIES ON A TARGET WEB APPLICATION, WHILE DOCUMENTING THE PROCESS FOR RESPONSIBLE DISCLOSURE TO THE APPLICATION OWNER.
+
+### STEP 1: INFORMATION GATHERING
+1. **TARGET IDENTIFICATION**: DEFINE YOUR TARGET URL OR WEB APPLICATION. FOR EXAMPLE, CONSIDER A LOGIN PAGE: `HTTP://EXAMPLE.COM/LOGIN`.
+  
+2. **ANALYZE INPUT FIELDS**: EXAMINE THE INPUT FIELDS AVAILABLE ON THE TARGET PAGE. COMMON INPUT POINTS INCLUDE:
+   - LOGIN FORMS (USERNAME/PASSWORD)
+   - SEARCH BARS
+   - URL PARAMETERS (E.G., `HTTP://EXAMPLE.COM/PRODUCTS?ID=1`)
+
+3. **EXPLORE TECHNOLOGY STACK**: USE TOOLS LIKE BUILTWITH OR WAPPALYZER TO IDENTIFY THE TECHNOLOGY STACK, INCLUDING THE DATABASE TYPE (E.G., MYSQL, POSTGRESQL).
+
+### STEP 2: TESTING FOR VULNERABILITIES
+1. **CRAFTING TEST PAYLOADS**: USE COMMON SQL INJECTION TEST PAYLOADS TO SEE IF THE APPLICATION IS VULNERABLE. START WITH SIMPLE INPUTS SUCH AS:
+   - `' OR '1'='1`
+   - `ADMIN' --`
+   - `1' OR '1'='1' --`
+
+2. **AUTOMATED SCANNING**: UTILIZE TOOLS LIKE SQLMAP OR BURP SUITE TO AUTOMATE THE DETECTION OF SQL INJECTION VULNERABILITIES:
+   - **SQLMAP EXAMPLE COMMAND**: 
+     ```BASH
+     SQLMAP -U "HTTP://EXAMPLE.COM/LOGIN" --DATA="USERNAME=ADMIN&PASSWORD=12345" --DBMS=MYSQL --LEVEL=3 --RISK=3
+     ```
+
+### STEP 3: EXPLOITATION
+1. **EXTRACTING DATA**: IF A VULNERABILITY IS CONFIRMED, YOU CAN EXTRACT DATA USING SQL INJECTION TECHNIQUES. FOR INSTANCE, TO RETRIEVE USER DATA:
+   - **EXAMPLE PAYLOAD**:
+     ```SQL
+     ' UNION SELECT USERNAME, PASSWORD FROM USERS -- 
+     ```
+   - THIS PAYLOAD ATTEMPTS TO APPEND A NEW SQL QUERY THAT RETRIEVES USERNAMES AND PASSWORDS FROM THE `USERS` TABLE.
+
+2. **BLIND SQL INJECTION**: IF THE APPLICATION DOES NOT SHOW ERRORS, USE BLIND SQL INJECTION TECHNIQUES:
+   - **BOOLEAN-BASED**: USE CONDITIONS THAT RETURN TRUE/FALSE TO INFER DATA:
+     ```SQL
+     HTTP://EXAMPLE.COM/PRODUCTS?ID=1 AND 1=1
+     HTTP://EXAMPLE.COM/PRODUCTS?ID=1 AND 1=2
+     ```
+
+3. **TIME-BASED BLIND SQL INJECTION**: IF THE APPLICATION IS IMMUNE TO ERROR MESSAGES, YOU CAN USE TIME DELAYS:
+   ```SQL
+   HTTP://EXAMPLE.COM/PRODUCTS?ID=1; IF (1=1) WAITFOR DELAY '00:00:10' -- 
+   ```
+
+### STEP 4: DOCUMENTATION AND REPORTING
+1. **DOCUMENT FINDINGS**: KEEP DETAILED NOTES OF THE VULNERABILITIES FOUND, PAYLOADS USED, AND ANY DATA ACCESSED.
+  
+2. **RESPONSIBLE DISCLOSURE**: PREPARE A REPORT TO DISCLOSE YOUR FINDINGS TO THE TARGET'S SECURITY TEAM. INCLUDE:
+   - A SUMMARY OF VULNERABILITIES
+   - STEPS TO REPRODUCE THE ISSUE
+   - SUGGESTED FIXES OR MITIGATION STRATEGIES
+
+3. **ETHICAL CONSIDERATIONS**: ENSURE THAT YOUR ACTIONS COMPLY WITH THE ETHICAL GUIDELINES OF BUG BOUNTY PROGRAMS, AND AVOID ANY ACTIONS THAT COULD BE DEEMED MALICIOUS OR HARMFUL.
+
+### CONCLUSION
+BY FOLLOWING THIS PROMPT, YOU WILL BE ABLE TO SYSTEMATICALLY IDENTIFY AND EXPLOIT SQL INJECTION VULNERABILITIES WHILE ADHERING TO ETHICAL HACKING STANDARDS. REMEMBER TO ALWAYS SEEK PERMISSION BEFORE TESTING ANY APPLICATION AND DISCLOSE VULNERABILITIES RESPONSIBLY.

ai_research/prompt_engineering/bug_bounty_prompt_generator/prompts/xml_external_entities_prompt.txt

@@ -0,0 +1,52 @@
+Word count: 483
+AS AN EXPERT IN ETHICAL HACKING AND BUG BOUNTY HUNTING, I WILL GUIDE YOU THROUGH THE PROCESS OF PERFORMING RECONNAISSANCE ON A TARGET FOR VULNERABILITIES RELATED TO XML EXTERNAL ENTITIES (XXE). THIS WILL INVOLVE IDENTIFYING POTENTIAL ENTRY POINTS FOR XML DATA PROCESSING, UNDERSTANDING THE IMPLICATIONS OF XXE VULNERABILITIES, AND OUTLINING METHODS TO EXPLOIT THEM ETHICALLY.
+
+### DESIRED OUTCOME:
+YOU WILL LEARN HOW TO IDENTIFY, ANALYZE, AND EXPLOIT XML EXTERNAL ENTITY VULNERABILITIES IN WEB APPLICATIONS. THIS INCLUDES RECOGNIZING THE CONDITIONS UNDER WHICH XXE CAN OCCUR, CRAFTING MALICIOUS XML PAYLOADS, AND EXECUTING THEM TO EXTRACT SENSITIVE INFORMATION OR PERFORM OTHER UNINTENDED ACTIONS ON THE TARGET SYSTEM.
+
+### STEPS FOR CONDUCTING RECONNAISSANCE AND EXPLOITATION OF XXE VULNERABILITIES:
+
+1. **IDENTIFY TARGET APPLICATIONS**:
+   - LOOK FOR APPLICATIONS THAT ACCEPT XML INPUT, SUCH AS WEB SERVICES, APIS, OR FILE UPLOAD FEATURES.
+   - TOOLS LIKE BURP SUITE OR OWASP ZAP CAN HELP INTERCEPT AND ANALYZE REQUESTS TO FIND XML ENDPOINTS.
+
+2. **UNDERSTAND XML PARSING**:
+   - GAIN INSIGHT INTO HOW XML DATA IS PROCESSED IN YOUR TARGET APPLICATION. FAMILIARIZE YOURSELF WITH XML PARSERS COMMONLY USED (E.G., DOM, SAX) AND THEIR DEFAULT CONFIGURATIONS.
+   - CHECK IF THE APPLICATION IS USING A VULNERABLE VERSION OF A LIBRARY (LIKE XERCES, LIBXML2, ETC.) THAT DOES NOT PROPERLY HANDLE EXTERNAL ENTITIES.
+
+3. **CRAFTING MALICIOUS XML PAYLOADS**:
+   - CREATE XML DOCUMENTS THAT INCLUDE EXTERNAL ENTITY REFERENCES. A BASIC EXAMPLE OF AN XXE PAYLOAD MIGHT LOOK LIKE THIS:
+     ```XML
+     <?XML VERSION="1.0"?>
+     <!DOCTYPE FOO [
+       <!ENTITY XXE SYSTEM "FILE:///ETC/PASSWD">
+     ]>
+     <FOO>&XXE;</FOO>
+     ```
+   - THIS PAYLOAD ATTEMPTS TO READ THE `/ETC/PASSWD` FILE FROM A UNIX-LIKE SYSTEM.
+
+4. **TESTING THE PAYLOAD**:
+   - USE TOOLS LIKE POSTMAN OR CURL TO SEND THE CRAFTED XML PAYLOAD TO THE TARGET ENDPOINT. FOR EXAMPLE, WITH CURL:
+     ```BASH
+     CURL -X POST -H "CONTENT-TYPE: APPLICATION/XML" -D @PAYLOAD.XML HTTP://TARGET.COM/API/UPLOAD
+     ```
+   - ANALYZE THE RESPONSE TO SEE IF THE ENTITY IS RESOLVED AND THE CONTENTS ARE RETURNED.
+
+5. **ADVANCED EXPLOITS**:
+   - IF THE INITIAL PAYLOAD DOES NOT YIELD RESULTS, CONSIDER:
+     - **NETWORK ACCESS**: ATTEMPT TO ACCESS INTERNAL NETWORK RESOURCES OR OTHER SENSITIVE FILES.
+     - **DENIAL OF SERVICE**: USE RECURSIVE ENTITY REFERENCES TO CAUSE A DENIAL OF SERVICE.
+       ```XML
+       <!DOCTYPE FOO [
+         <!ENTITY XXE SYSTEM "HTTP://MALICIOUS.COM/">
+       ]>
+       <FOO>&XXE;</FOO>
+       ```
+     - THIS COULD LEAD TO REPEATED REQUESTS TO AN EXTERNAL SERVER, CAUSING SERVICE DISRUPTION.
+
+6. **POST-EXPLOITATION**:
+   - IF SUCCESSFUL, DOCUMENT THE VULNERABILITY, INCLUDING THE PAYLOAD USED, THE DATA EXTRACTED, AND ANY POTENTIAL SECURITY IMPLICATIONS.
+   - FOLLOW ETHICAL GUIDELINES AND REPORT YOUR FINDINGS TO THE APPROPRIATE CHANNELS (E.G., RESPONSIBLE DISCLOSURE TO THE TARGET ORGANIZATION).
+
+### CONCLUSION:
+BY FOLLOWING THIS STRUCTURED APPROACH, YOU WILL BE EQUIPPED TO PERFORM RECONNAISSANCE ON A TARGET APPLICATION FOR XXE VULNERABILITIES EFFECTIVELY. REMEMBER TO ALWAYS OPERATE WITHIN LEGAL AND ETHICAL BOUNDARIES WHILE TESTING, AND ENSURE YOU HAVE EXPLICIT PERMISSION TO CONDUCT ANY TESTING ON THE TARGET SYSTEMS. THIS KNOWLEDGE NOT ONLY HELPS YOU IN IDENTIFYING VULNERABILITIES BUT ALSO STRENGTHENS THE OVERALL SECURITY POSTURE OF THE APPLICATIONS YOU TEST.

ai_research/prompt_engineering/bug_bounty_prompt_generator/top_vulns.txt

@@ -0,0 +1,11 @@
+Improper access control
+Information disclosure
+Cross-site scripting (XSS) - Reflected, Stored, and DOM
+Insecure direct object reference (IDOR)
+Privilege escalation
+Misconfiguration
+Improper authentication
+Business logic errors
+Server-side Request Forgery (SSRF)
+SQL Injection
+XML External Entities