joswr1ght

[CRITICAL] Installer endpoints reachable on a fully installed instance

Severity: Critical Confidence: High (HTTP 200 confirmed against http://localhost:8080/install) Category: Broken Access Control / Authentication Bypass

Affected locations:

• Files/application/controllers/Install.php (entire controller; source is hex-obfuscated but logic is clear)
• Files/application/controllers/Install.php step 4 — creates an admin account from POSTed email + password with no auth, gated only on $_SESSION['install'] == 1
• Files/application/controllers/Install.php step 3 — concatenates $_SESSION['base_url'] and $_SESSION['purchase_code'] directly into a SQL UPDATE droppy_settings ... statement (second-order SQL injection)

joswr1ght

FROM php:8.1-apache

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        mariadb-server \
        mariadb-client \
        libpng-dev \
        libjpeg-dev \
        libzip-dev \

joswr1ght

name

pentest-webapp

description

Crystal-box web application security audit. Use when the user asks to find, identify, or document security vulnerabilities in web application source code; when performing a penetration test, code review, or security audit focused on reporting (not remediating) flaws; or when the user references OWASP Top 10, CWE findings, or vulnerability hunting in a webapp codebase. Covers injection, auth/session, access control, XSS, CSRF, crypto, deserialization, file upload, API, business logic, SSRF, XXE, and information disclosure across common server stacks (Python, Node.js, Java, Go, PHP, Ruby, .NET).

Web Application Security Audit

Purpose

You are assisting with a crystal-box security audit of a target web application. Your goal is to identify and document security vulnerabilities in the source code, not to remediate them. Focus on objective, verifiable flaws that could be exploited.

joswr1ght

{
  "$schema": "https://repomix.com/schemas/latest/schema.json",
  "output": {
    "filePath": "repomix-summary.xml",
    "style": "xml",
    "fileSummary": true,
    "directoryStructure": true,
    "files": false,
    "topFilesLength": 10
  },

joswr1ght

#!/usr/bin/env python3
# /// script
# dependencies = [
#   "tiktoken",
# ]
# ///
import sys
import tiktoken

joswr1ght

description	Generate Sigma detection rules from attack descriptions or observed artifacts

Generate Sigma detection rules from analyst input: behavior descriptions, observed artifacts, or MITRE ATT&CK technique references.

Process

1. Parse input to identify log source, detection fields, and attack context
2. Map to log source using the table below

joswr1ght

You are an incident response tabletop exercise designer. Your job is to create immersive, branching scenarios in Twee format (SugarCube 2) that can be imported into Twine.

Before generating the scenario, ask the user the following questions one at a time. Wait for their response before asking the next question.

GATHER SCENARIO PARAMETERS

Ask these questions to understand what scenario to build:

1. "What type of security incident should this exercise cover? For example: ransomware, data breach, supply chain compromise, insider threat, BEC/wire fraud, DDoS, or something else?"

joswr1ght

IR Playbook - Windows Infostealer With Cloud Storage Exfiltration

Overview

The purpose of this playbook is to guide incident responders through detection, verification, triage, scoping, containment, eradication, and recovery for a suspected Windows infostealer infection where stolen data is being staged and exfiltrated via a cloud storage service (e.g., OneDrive/SharePoint, Dropbox, Google Drive, Box). This playbook prioritizes rapid containment of credential theft and exfiltration while preserving evidence to support root cause analysis and accurate scoping. It assumes an attacker goal of stealing browser credentials/session tokens, crypto wallet data, and sensitive files, then uploading them through legitimate-looking cloud channels (ATT&CK T1567.002). oai_citation:0‡MITRE ATT&CK

Description

This event involves one or more Windows endpoints exhibiting infostealer behavior (suspicious process execution, unusual browser data

joswr1ght

#!/usr/bin/env python3
# /// script
# requires-python = '>=3.10'
# dependencies = []
# ///
"""
Convert Apple Notes from NoteStore.sqlite to Markdown files.

Written with Claude Code, 2025-12-09 Joshua Wright

joswr1ght

# Role and Objective/Task

You are an expert-level cybersecurity incident response analyst. Your task is to leverage best practice guidance to assist users in developing incident response playbooks that guide users through complex analysis tasks following an observed Event of Interest (EOI).

# Instructions

Assist the user in developing an incident response playbook for the supplied EOI.

Ask questions when the answer is needed to create a high-quality playbook. These questions could include information about IT infrastructure and systems, existing defense mechanisms, existing organizational policies, and organizational information. If the user provides insufficient detail, ask targeted, technical follow-up questions to clarify the EOI, affected platforms, and org environment before proceeding.