Skip to content

Commit bdcfb6b

Browse files
ZieraxZierax
authored
Add New Security Assessment Prompts and API Provider Configurations (#25)
* Add business logic vulnerability assessment guidelines Added guidelines for assessing business logic vulnerabilities in web applications, focusing on various manipulation techniques and potential flaws. Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> * Create API security analysis guidelines for GraphQL and REST Added detailed guidelines for API security analysis focusing on GraphQL and REST vulnerabilities. Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> * Create client_side.txt for web security analysis Added guidelines for conducting client-side security analysis, focusing on various vulnerabilities and security practices. Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> * Add configuration for Google Gemini 1.5 Flash API Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> * Add configuration for Google Gemini 1.5 Pro Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> * Add configuration for Anthropic Claude 4 Opus Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> * Update README with new inference examples Added examples for new Anthropic and Google Gemini inference models. Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com> --------- Signed-off-by: Ziad <153237520+Zierax@users.noreply.github.com>
1 parent d05debd commit bdcfb6b

File tree

7 files changed

+306
-1
lines changed

7 files changed

+306
-1
lines changed

‎configs/README.md‎

Lines changed: 103 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,12 @@ If you intend to fork or contribute to burpference, ensure that you have exclude
1313
- [Example Ollama `/generate`/`/chat` inference model:](#example-ollama-generatechat-inference-model)
1414
- [Anthropic Inference](#anthropic-inference)
1515
- [Example Anthropic `/messages` inference with `claude-3-5-sonnet-20241022`:](#example-anthropic-messages-inference-with-claude-3-5-sonnet-20241022)
16+
- [Example Anthropic `/messages` inference with `claude-opus-4-20250514`:](#example-anthropic-messages-inference-with-claude-opus-4-20250514)
1617
- [OpenAI Inference](#openai-inference)
1718
- [Example OpenAI `/completions` inference with `gpt-4o-mini`:](#example-openai-completions-inference-with-gpt-4o-mini)
19+
- [Google Gemini Inference](#google-gemini-inference)
20+
- [Example Gemini 1.5 Flash inference](#example-gemini-15-flash-inference)
21+
- [Example Gemini 1.5 Pro inference](#example-gemini-15-pro-inference)
1822
- [HuggingFace Serveless Inference](#huggingface-serveless-inference)
1923
- [Example HuggingFace `/text-generation` inference](#example-huggingface-text-generation-inference)
2024
- [Cohere `/v2/chat` Inference](#cohere-v2chat-inference)
@@ -80,6 +84,22 @@ In order to serve inference as part of burpference, the model must be running on
8084
}
8185
```
8286

87+
#### Example Anthropic `/messages` inference with `claude-opus-4-20250514`:
88+
89+
```json
90+
{
91+
"api_type": "anthropic",
92+
"headers": {
93+
"x-api-key": "{$ANTHROPIC_API_KEY}", <-- replace with your API key in the local config file
94+
"Content-Type": "application/json",
95+
"anthropic-version": "2023-06-01"
96+
},
97+
"max_tokens": 4096, <-- adjust based on your required usage
98+
"host": "https://api.anthropic.com/v1/messages",
99+
"model": "claude-opus-4-20250514" <-- adjust based on your required usage
100+
}
101+
```
102+
83103
---
84104

85105
### OpenAI Inference
@@ -100,6 +120,88 @@ In order to serve inference as part of burpference, the model must be running on
100120
}
101121
```
102122

123+
---
124+
125+
### Google Gemini Inference
126+
127+
#### Example Gemini 1.5 Flash inference
128+
129+
```json
130+
{
131+
"api_type": "gemini",
132+
"headers": {
133+
"Content-Type": "application/json"
134+
},
135+
"host": "https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent",
136+
"api_key": "{$GOOGLE_API_KEY}", <-- replace with your API key in the local config file
137+
"model": "gemini-1.5-flash",
138+
"generation_config": {
139+
"temperature": 0.2,
140+
"top_p": 0.95,
141+
"top_k": 40,
142+
"max_output_tokens": 8192
143+
},
144+
"safety_settings": [
145+
{
146+
"category": "HARM_CATEGORY_HARASSMENT",
147+
"threshold": "BLOCK_NONE"
148+
},
149+
{
150+
"category": "HARM_CATEGORY_HATE_SPEECH",
151+
"threshold": "BLOCK_NONE"
152+
},
153+
{
154+
"category": "HARM_CATEGORY_SEXUALLY_EXPLICIT",
155+
"threshold": "BLOCK_NONE"
156+
},
157+
{
158+
"category": "HARM_CATEGORY_DANGEROUS_CONTENT",
159+
"threshold": "BLOCK_NONE"
160+
}
161+
]
162+
}
163+
```
164+
165+
#### Example Gemini 1.5 Pro inference
166+
167+
```json
168+
{
169+
"api_type": "gemini",
170+
"headers": {
171+
"Content-Type": "application/json"
172+
},
173+
"host": "https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-pro:generateContent",
174+
"api_key": "{$GOOGLE_API_KEY}", <-- replace with your API key in the local config file
175+
"model": "gemini-1.5-pro",
176+
"generation_config": {
177+
"temperature": 0.1,
178+
"top_p": 0.95,
179+
"top_k": 40,
180+
"max_output_tokens": 8192
181+
},
182+
"safety_settings": [
183+
{
184+
"category": "HARM_CATEGORY_HARASSMENT",
185+
"threshold": "BLOCK_NONE"
186+
},
187+
{
188+
"category": "HARM_CATEGORY_HATE_SPEECH",
189+
"threshold": "BLOCK_NONE"
190+
},
191+
{
192+
"category": "HARM_CATEGORY_SEXUALLY_EXPLICIT",
193+
"threshold": "BLOCK_NONE"
194+
},
195+
{
196+
"category": "HARM_CATEGORY_DANGEROUS_CONTENT",
197+
"threshold": "BLOCK_NONE"
198+
}
199+
]
200+
}
201+
```
202+
203+
---
204+
103205
### HuggingFace Serveless Inference
104206

105207
#### Example HuggingFace `/text-generation` inference
@@ -146,4 +248,4 @@ In order to serve inference as part of burpference, the model must be running on
146248

147249
By default, the system prompt sent as pretext to the model is defined [here](../prompts/proxy_prompt.txt), feel free to edit, tune and tweak as you see fit. This is also true for the scanner extension tab.
148250

149-
---
251+
---

‎configs/anthropic_claude_4_opus.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"api_type": "anthropic",
3+
"headers": {
4+
"x-api-key": "{$ANTHROPIC_API_KEY}",
5+
"Content-Type": "application/json",
6+
"anthropic-version": "2023-06-01"
7+
},
8+
"max_tokens": 4096,
9+
"host": "https://api.anthropic.com/v1/messages",
10+
"model": "claude-opus-4-20250514",
11+
"temperature": 0.2,
12+
"top_p": 0.95
13+
}

‎configs/google_gemini_1.5_flash.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"api_type": "gemini",
3+
"headers": {
4+
"Content-Type": "application/json"
5+
},
6+
"host": "https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent",
7+
"api_key": "{$GOOGLE_API_KEY}",
8+
"model": "gemini-1.5-flash",
9+
"generation_config": {
10+
"temperature": 0.2,
11+
"top_p": 0.95,
12+
"top_k": 40,
13+
"max_output_tokens": 8192
14+
},
15+
"safety_settings": [
16+
{
17+
"category": "HARM_CATEGORY_HARASSMENT",
18+
"threshold": "BLOCK_NONE"
19+
},
20+
{
21+
"category": "HARM_CATEGORY_HATE_SPEECH",
22+
"threshold": "BLOCK_NONE"
23+
},
24+
{
25+
"category": "HARM_CATEGORY_SEXUALLY_EXPLICIT",
26+
"threshold": "BLOCK_NONE"
27+
},
28+
{
29+
"category": "HARM_CATEGORY_DANGEROUS_CONTENT",
30+
"threshold": "BLOCK_NONE"
31+
}
32+
]
33+
}

‎configs/google_gemini_1.5_pro.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"api_type": "gemini",
3+
"headers": {
4+
"Content-Type": "application/json"
5+
},
6+
"host": "https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-pro:generateContent",
7+
"api_key": "{$GOOGLE_API_KEY}",
8+
"model": "gemini-1.5-pro",
9+
"generation_config": {
10+
"temperature": 0.1,
11+
"top_p": 0.95,
12+
"top_k": 40,
13+
"max_output_tokens": 8192
14+
},
15+
"safety_settings": [
16+
{
17+
"category": "HARM_CATEGORY_HARASSMENT",
18+
"threshold": "BLOCK_NONE"
19+
},
20+
{
21+
"category": "HARM_CATEGORY_HATE_SPEECH",
22+
"threshold": "BLOCK_NONE"
23+
},
24+
{
25+
"category": "HARM_CATEGORY_SEXUALLY_EXPLICIT",
26+
"threshold": "BLOCK_NONE"
27+
},
28+
{
29+
"category": "HARM_CATEGORY_DANGEROUS_CONTENT",
30+
"threshold": "BLOCK_NONE"
31+
}
32+
]
33+
}

‎prompts/api_graphql.txt‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
You are an API security specialist conducting in-depth analysis of modern API architectures including REST, GraphQL, and emerging API technologies.
2+
Your objective is to examine HTTP requests and responses for API-specific vulnerabilities, design weaknesses, and implementation flaws.
3+
4+
This analysis will focus on:
5+
6+
- GraphQL Security: Query depth/complexity attacks, introspection exposure, batching abuse, field-level authorization
7+
- REST API Patterns: HTTP method tampering, mass assignment, API versioning issues, unsafe redirects
8+
- API Gateway Security: Routing vulnerabilities, bypass techniques, rate limit evasion
9+
- Microservices Communication: Internal API exposure, service mesh security, inter-service authentication
10+
- API Documentation Leakage: Exposed Swagger/OpenAPI specs, debug endpoints, test APIs in production
11+
12+
Look specifically for:
13+
- GraphQL query complexity and depth limit bypass
14+
- Introspection enabled in production environments
15+
- Batching attacks for rate limit bypass
16+
- Excessive data exposure through overfetching
17+
- Missing field-level authorization in GraphQL resolvers
18+
- HTTP verb tampering (GET to POST, etc.)
19+
- Mass assignment vulnerabilities in API endpoints
20+
- API versioning security gaps (v1 vs v2 endpoints)
21+
- Insufficient input validation on nested objects
22+
- Server-side request forgery via API parameters
23+
- API key exposure in requests/responses
24+
- Lack of schema validation
25+
- Improper error handling revealing internal structure
26+
- Missing pagination controls leading to data dumping
27+
- Insecure direct object references in API resources
28+
29+
Analyze for API-specific attack patterns:
30+
- GraphQL alias abuse for DoS
31+
- Recursive queries and circular references
32+
- Mutation chaining for privilege escalation
33+
- Subscription hijacking
34+
- REST parameter pollution
35+
- Content-Type confusion attacks
36+
- API endpoint enumeration techniques
37+
38+
Use deep technical analysis to identify API vulnerabilities by providing exploitation examples and attack scenarios.
39+
40+
If you identify any vulnerabilities, include the severity of the finding as prepend (case-sensitive) in your response with any of the levels:
41+
- "CRITICAL"
42+
- "HIGH"
43+
- "MEDIUM"
44+
- "LOW"
45+
- "INFORMATIONAL"
46+
47+
Not every request and response may have indicators. Be concise yet deterministic in your analysis.
48+
49+
The HTTP request and response pair are provided below this line:

‎prompts/business_logic.txt‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
You are a web application penetration tester conducting a specialized assessment focused on business logic vulnerabilities and application workflow flaws.
2+
Your objective is to examine HTTP requests and responses for logic-based security issues that bypass intended application behavior.
3+
4+
This analysis will focus on:
5+
6+
- Workflow Manipulation: Identify step-skipping, race conditions, and state manipulation opportunities
7+
- Price/Quantity Manipulation: Detect arithmetic flaws, negative values, and financial logic errors
8+
- Resource Exhaustion: Analyze rate limiting bypass, batch operation abuse, and resource allocation flaws
9+
- Trust Boundary Violations: Examine client-side validation reliance and parameter tampering
10+
- Time-Based Logic Flaws: Identify timing attacks, expiration bypasses, and temporal logic errors
11+
12+
Look specifically for:
13+
- Missing server-side validation of critical operations
14+
- Inconsistent state enforcement across workflows
15+
- Race conditions in multi-step processes
16+
- Replay attack opportunities
17+
- Business rule bypass through parameter manipulation
18+
- Insufficient verification of transaction integrity
19+
- Coupon/discount code abuse potential
20+
- Referral/reward system exploitation
21+
22+
Use reasoning and context to identify business logic flaws by analyzing the sequence of operations, parameter relationships, and workflow dependencies. Consider how an attacker might abuse intended functionality.
23+
24+
If you identify any vulnerabilities, include the severity of the finding as prepend (case-sensitive) in your response with any of the levels:
25+
- "CRITICAL"
26+
- "HIGH"
27+
- "MEDIUM"
28+
- "LOW"
29+
- "INFORMATIONAL"
30+
31+
Not every request and response may have indicators. Be concise yet deterministic in your analysis.
32+
33+
The HTTP request and response pair are provided below this line:

‎prompts/client_side.txt‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
You are a web application security specialist conducting comprehensive client-side security analysis.
2+
Your objective is to examine HTTP requests and responses for client-side vulnerabilities, unsafe content handling, and browser-based attack vectors.
3+
4+
This analysis will focus on:
5+
6+
- Cross-Site Scripting (XSS): Identify reflected, stored, and DOM-based XSS opportunities
7+
- Client-Side Injection: Analyze JavaScript execution contexts, eval usage, and dynamic code generation
8+
- Content Security: Examine CSP headers, resource integrity, and unsafe inline scripts
9+
- DOM Manipulation: Identify DOM clobbering, prototype pollution, and client-side template injection
10+
- WebSocket Security: Analyze WebSocket connections for origin validation and message handling
11+
- PostMessage Security: Examine cross-origin messaging for validation gaps
12+
13+
Look specifically for:
14+
- Unescaped user input in HTML contexts
15+
- Unsafe JavaScript patterns (eval, innerHTML, document.write)
16+
- Missing or weak Content Security Policy
17+
- Client-side URL manipulation and open redirects
18+
- Sensitive data exposure in client-side code
19+
- Insecure cross-origin communication
20+
- Client-side validation bypass opportunities
21+
- JavaScript framework-specific vulnerabilities (Angular, React, Vue)
22+
- Browser API misuse (localStorage, sessionStorage, IndexedDB)
23+
24+
Analyze response bodies for:
25+
- Inline JavaScript with user-controlled data
26+
- Dangerous sinks receiving untrusted input
27+
- Missing security attributes (HttpOnly, Secure, SameSite)
28+
- JSONP endpoints and callback parameter handling
29+
- Client-side routing vulnerabilities
30+
31+
Use contextual reasoning to identify client-side attack vectors by providing example payloads and exploitation scenarios.
32+
33+
If you identify any vulnerabilities, include the severity of the finding as prepend (case-sensitive) in your response with any of the levels:
34+
- "CRITICAL"
35+
- "HIGH"
36+
- "MEDIUM"
37+
- "LOW"
38+
- "INFORMATIONAL"
39+
40+
Not every request and response may have indicators. Be concise yet deterministic in your analysis.
41+
42+
The HTTP request and response pair are provided below this line:

0 commit comments

Comments
 (0)