diff --git a/src/cai/agents/patterns/bb_triage.py b/src/cai/agents/patterns/bb_triage.py new file mode 100644 index 00000000..96e075e8 --- /dev/null +++ b/src/cai/agents/patterns/bb_triage.py @@ -0,0 +1,61 @@ +""" +Implementation of a Cyclic Swarm Pattern for Bug Bounty Triage Operations + +This module establishes a coordinated multi-agent system where specialized agents +collaborate on vulnerability discovery and verification tasks. The pattern +implements a directed graph of agent relationships, where each agent can transfer +context (message history) to another agent through handoff functions, creating a +complete communication network for comprehensive bug bounty and triage analysis. +""" +from cai.agents.retester import retester_agent +from cai.agents.bug_bounter import bug_bounter_agent +from cai.sdk.agents import handoff + + +# Clone agents to avoid modifying the original instances +_retester_agent_copy = retester_agent.clone() +_bug_bounter_agent_copy = bug_bounter_agent.clone() + +# Clear any existing handoffs to ensure independence +_retester_agent_copy.handoffs = [] +_bug_bounter_agent_copy.handoffs = [] + +# Create handoffs using the SDK handoff function +_retester_handoff = handoff( + agent=_retester_agent_copy, + tool_description_override="Transfer to Retester Agent for vulnerablity confirmation and triage" +) + +_bug_bounter_handoff = handoff( + agent=_bug_bounter_agent_copy, + tool_description_override="Transfer to Bug Bounter Agent for vulnerability discovery and bug bounty hunting" +) + +# Register handoff to enable inter-agent communication pathways +_bug_bounter_agent_copy.handoffs.append(_retester_handoff) +_retester_agent_copy.handoffs.append(_bug_bounter_handoff) + +# Customize agent properties and add handoff instructions +_bug_bounter_agent_copy.name = "Bug bounty Triage Agent" +_bug_bounter_agent_copy.description = ( + "Agent that specializes in vulnerability discovery and bug bounty " + "hunting without false positives" +) + +# Add handoff instructions to Bug Bounter agent +if _bug_bounter_agent_copy.instructions: + _bug_bounter_agent_copy.instructions += ( + "\n\nWhen you discover potential vulnerabilities, transfer to " + "the Retester Agent for verification and triage." + ) + +# Add handoff instructions to Retester agent +if _retester_agent_copy.instructions: + _retester_agent_copy.instructions += ( + "\n\nAfter completing verification and triage, transfer back " + "to the Bug Bounter Agent to continue vulnerability discovery." + ) + +# Initialize the swarm pattern with the bug bounter agent as the entry point +bb_triage_swarm_pattern = _bug_bounter_agent_copy +bb_triage_swarm_pattern.pattern = "swarm" diff --git a/src/cai/agents/patterns/red_team.py b/src/cai/agents/patterns/red_team.py index bf950f67..86dd1e6f 100644 --- a/src/cai/agents/patterns/red_team.py +++ b/src/cai/agents/patterns/red_team.py @@ -13,27 +13,38 @@ from cai.agents.mail import dns_smtp_agent from cai.sdk.agents import handoff +# Clone agents to avoid modifying the original instances +_redteam_agent_copy = redteam_agent.clone() +_thought_agent_copy = thought_agent.clone() +_dns_smtp_agent_copy = dns_smtp_agent.clone() + +# Clear any existing handoffs to ensure independence +_redteam_agent_copy.handoffs = [] +_thought_agent_copy.handoffs = [] +_dns_smtp_agent_copy.handoffs = [] + # Create handoffs using the SDK handoff function -dns_smtp_handoff = handoff( - agent=dns_smtp_agent, +_dns_smtp_handoff = handoff( + agent=_dns_smtp_agent_copy, tool_description_override="Use for DNS scans and domain reconnaissance about DMARC and DKIM records" ) -redteam_handoff = handoff( - agent=redteam_agent, +_redteam_handoff = handoff( + agent=_redteam_agent_copy, tool_description_override="Transfer to Red Team Agent for security assessment and exploitation tasks" ) -thought_handoff = handoff( - agent=thought_agent, +_thought_handoff = handoff( + agent=_thought_agent_copy, tool_description_override="Transfer to Thought Agent for analysis and planning" ) +_thought_agent_copy.name = "Red team manager" # Register handoff to enable inter-agent communication pathways -redteam_agent.handoffs.append(dns_smtp_handoff) -dns_smtp_agent.handoffs.append(redteam_handoff) -thought_agent.handoffs.append(redteam_handoff) +_redteam_agent_copy.handoffs.append(_dns_smtp_handoff) +_dns_smtp_agent_copy.handoffs.append(_redteam_handoff) +_thought_agent_copy.handoffs.append(_redteam_handoff) # Initialize the swarm pattern with the thought agent as the entry point -redteam_swarm_pattern = thought_agent +redteam_swarm_pattern = _thought_agent_copy redteam_swarm_pattern.pattern = "swarm" \ No newline at end of file diff --git a/src/cai/agents/retester.py b/src/cai/agents/retester.py new file mode 100644 index 00000000..1fafd31b --- /dev/null +++ b/src/cai/agents/retester.py @@ -0,0 +1,46 @@ +"""Retester Agent for vulnerability verification and triage""" +import os +from dotenv import load_dotenv +from cai.sdk.agents import Agent, OpenAIChatCompletionsModel +from openai import AsyncOpenAI +from cai.util import load_prompt_template +from cai.tools.reconnaissance.generic_linux_command import ( # pylint: disable=import-error # noqa: E501 + generic_linux_command +) +from cai.tools.web.search_web import ( # pylint: disable=import-error # noqa: E501 + make_google_search +) +from cai.tools.reconnaissance.exec_code import ( # pylint: disable=import-error # noqa: E501 + execute_code +) + + +load_dotenv() + +# Load the triage agent system prompt +retester_system_prompt = load_prompt_template("prompts/system_triage_agent.md") + +tools = [ + generic_linux_command, + execute_code +] + +if os.getenv('GOOGLE_SEARCH_API_KEY') and os.getenv('GOOGLE_SEARCH_CX'): + tools.append(make_google_search) + +retester_agent = Agent( + name="Retester Agent", + instructions=retester_system_prompt, + description="""Agent that specializes in vulnerability verification and + triage. Expert in determining exploitability and + eliminating false positives.""", + tools=tools, + model=OpenAIChatCompletionsModel( + model=os.getenv('CAI_MODEL', "qwen2.5:14b"), + openai_client=AsyncOpenAI(), + ) +) + + + + diff --git a/src/cai/prompts/system_triage_agent.md b/src/cai/prompts/system_triage_agent.md new file mode 100644 index 00000000..936a7f78 --- /dev/null +++ b/src/cai/prompts/system_triage_agent.md @@ -0,0 +1,78 @@ +# Cybersecurity Triage Agent + +You are an autonomous cybersecurity agent specializing in vulnerability +verification and false positive elimination. Your primary objective is to +conduct thorough triage of identified security issues to determine their +actual exploitability and impact. + +## Core Objectives + +1. **Vulnerability Verification**: Determine if identified vulnerabilities + genuinely affect the target system +2. **Exploitability Assessment**: Evaluate whether vulnerabilities are + practically exploitable given current system constraints, privileges, + and environmental factors +3. **False Positive Elimination**: Filter out non-exploitable findings to + focus on genuine security risks + +## Triage Methodology + +When vulnerabilities are present in your context, process each one +systematically using this structured approach: + +### Phase 1: Initial Assessment +- Review the vulnerability detection data and scan results +- Analyze the specific system context and configuration +- Identify the vulnerability type, severity, and potential impact +- Document current privilege level and system access constraints + +### Phase 2: Intelligence Gathering +If vulnerability information is insufficient, conduct comprehensive research: +- Search public vulnerability databases and resources +- Query NIST database via curl commands for CVE details +- Use searchsploit for exploit availability and techniques +- Leverage Google searches for additional context and proof-of-concepts +- Access any available structured databases through curl or Linux commands +- Gather vendor advisories and security bulletins + +### Phase 3: Exploitation Validation +- Develop and execute targeted proof-of-concept exploits +- Test vulnerability under current system conditions +- Verify that exploitation succeeds with available privileges +- Document all exploitation attempts and results +- Assess real-world exploitability factors + +### Phase 4: Impact Analysis +- Determine the actual security impact if exploitation succeeds +- Evaluate potential for privilege escalation or lateral movement +- Assess data exposure or system compromise risks +- Consider business impact and operational consequences + +## Success Criteria + +A vulnerability is confirmed as genuine and exploitable when: +- Proof-of-concept exploitation demonstrates actual system compromise +- The exploit works within current privilege and access constraints +- The vulnerability poses measurable security risk to the organization +- Exploitation can be reliably reproduced + +## Output Standards + +For each vulnerability assessed: +- **Status**: Confirmed Vulnerable / Not Exploitable / False Positive +- **Evidence**: Detailed exploitation steps and proof-of-concept +- **Impact**: Realistic assessment of potential damage +- **Constraints**: Factors limiting or enabling exploitation +- **Recommendations**: Specific remediation guidance +- **Artifacts**: Complete file directory path to exploit code, all + supporting files, scripts, and documentation required to reproduce + the vulnerability exploitation +## Guidelines + +- Prioritize thorough verification over speed +- Always attempt practical exploitation before confirming vulnerabilities +- Consider environmental factors that may affect exploitability + +Remember: The goal is to provide definitive answers about vulnerability +exploitability, eliminating uncertainty and enabling informed security +decision-making.