VIBE//INFIL
│
TARGET
vibe.corp
SCORE
0
RANK
🥚
BREACH
0/2345
🔬
🏆
💾
📂
🔊
EN
help
playground
bgp
oauth
dbshield
crypto
serverless
cloudir
extsec
pqc
kernel
ls
tracks
map
badges
status
stats
search
export
hint
clear
root@vibe:~$
🏆 ACHIEVEMENTS // OPERATOR BADGES
✕
🔬 VULNERABILITY PLAYGROUND & SIMULATORS
✕
🚗 CAN Bus Injector
💉 SQLi AST Visualizer
🪪 AD CS ASN.1 Inspector
🔑 JWT None Tester
🛣️ BGP Hijack & RPKI
🔑 OAuth PKCE & Key Confusion
🗄️ DB RBAC & UDF Shield
🛡️ EDR Evasion & Memory Inspector
🔐 AES-CBC Oracle & Bit-Flip
🚨 DFIR Live Triage & Timeline
🧬 SBOM & Supply Chain Inspector
⚡ Serverless & Warm Container
☁️ Cloud IR & VPC Flow
🧩 Browser Extension Security
⚛️ Lattice KEM & PQC Inspector
🐧 Kernel Hardening & Sandboxing Inspector
🤖 AI Agent & MCP Inspector
🔍 SANS DFIR & Supertimeline
🐝 eBPF & Tetragon Inspector
📡 C2 Malleable & Tunneling Inspector
🩸 AD Graph & Cypher
🤖 Agent Sandbox & Landlock
⚛️ PQC Migration & FIPS 203
Vehicle Speed
0 km/h
Engine RPM
0 RPM
Bus Telemetry Status
BROADCAST: NORMAL
Presets:
Cruise 60
Spoof 220
UDS Unlock (0x7DF)
Arbitration DoS (0x000)
Inject Frame
Clear
Presets:
Auth Bypass (OR 1=1)
UNION Select
Time Blind (SLEEP)
Safe Input (john_doe)
⚠️ Vulnerable Concatenation (Raw SQL)
VULNERABLE
🛡️ Secure PreparedStatement (Parameterized)
PROTECTED
Presets:
ESC1: SAN Enrollee Impersonation
ESC2: Any Purpose EKU
Secure User Template
SubjectAltName (SAN) UPN:
X.509 ASN.1 Certificate Preview
Kerberos PKINIT & PAC Token Evaluation
Presets:
Set "alg": "none" Bypass
Escalate role -> "admin"
Reset RS256 Standard Token
Header (JSON)
Payload (JSON)
Signature (Base64/Hex)
Encoded Token:
Scenarios:
1. Normal Route (AS200)
2. Exact Prefix Hijack (/24)
3. Sub-Prefix Hijack (/25 LPM)
4. Toggle RPKI ROV Filter
Prefix:
Origin AS:
AS-Path:
RPKI Route Origin Validation (ROV)
Simulate Route
🗺️ Global BGP AS Topology & Traffic Flow
TRAFFIC: NORMAL
📋 Border Gateway RIB Table & RPKI ROV Decision
ROV: VALID
Modes:
1. PKCE S256 Code Challenge
2. Downgrade to Plain
3. RS256 -> HS256 Key Confusion
4. Secure FAPI Hardening
🔐 PKCE S256 Challenge Generator
RFC 7636 S256
code_verifier (High-Entropy Client Secret):
code_challenge_method:
S256 (Base64URL-SHA256)
plain (Insecure / Deprecated)
💥 RS256 to HS256 Public Key Confusion Exploit
VERIFY: ASYMMETRIC
Server Public Key (PEM format, freely accessible via JWKS):
-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Y8v... -----END PUBLIC KEY-----
Attack & Defense Scenarios:
1. MySQL UDF Binary Injection & RCE
2. MSSQL xp_cmdshell Escalation
3. Oracle AUTHID DEFINER Trap
4. 🛡️ DBShield FGA & secure_file_priv
Target DBMS:
MySQL 8.0
Microsoft SQL Server 2022
Oracle Database 21c
Active Session Role:
Read-Only Plugin & secure_file_priv
Fine-Grained Audit (FGA) Firewall
Simulate Query & RBAC
Injected SQL Statement / DDL Payload:
SELECT 0x7f454c46... INTO DUMPFILE '/usr/lib/mysql/plugin/udf_sys_eval.so'; CREATE FUNCTION sys_eval RETURNS string SONAME 'udf_sys_eval.so'; SELECT sys_eval('id');
⚙️ AST & Kernel RBAC Execution Trace
RCE EXPLOITED
🛡️ DBShield Policy Engine & Audit Trail
AUDIT: BLIND
Evasion Presets:
AMSI 3-Byte Patch
ntdll .text Unhooking
Halo's Gate Indirect Syscall
Ekko ROP Sleep Obfuscation
Naive RWX Injection (No Evasion)
Target Module / API:
Technique Mode:
AMSI Memory Patching
ntdll KnownDlls Unhooking
Indirect Syscalls (Halo's Gate)
TimerQueue ROP Sleep Mask
Naive Plain Execution
EDR Userland Hooks Active
ETW-TI Kernel Telemetry
Moneta / PE-sieve Scanner
Simulate Evasion & Inspect
Payload / Execution Context:
[Memory Patch] amsi!AmsiScanBuffer -> b8 57 00 07 80 c3 (mov eax, 0x80070057; ret)
🔬 Memory Bytes, Disassembly & Call Stack
STATE: HOOKED
🛡️ EDR Agent, ETW-TI & Kernel Sensor Telemetry
ALERT: CRITICAL
Cryptanalysis Presets:
1. Padding Oracle Decryption (Vaudenay)
2. CBC IV Bit-Flipping (admin=1 Escalation)
3. RSA Bleichenbacher '06 e=3 Forgery
4. ECDSA Nonce Reuse Key Carving
5. 🛡️ ML-KEM-768 PQC Hybrid Defense
Crypto Primitive / Oracle:
AES-128-CBC Padding Oracle
AES-128-CBC Bit-Flipping
RSA PKCS#1 v1.5 e=3 Signature Forgery
ECDSA secp256k1 Nonce Reuse
ML-KEM-768 + X25519 Hybrid KEM
Attack Target / Block Index:
Leak Padding Exception (Oracle Active)
AEAD (AES-GCM Authenticated Tag)
Execute Cryptanalysis & Probe
Initialization Vector (IV - 16 Bytes Hex):
Ciphertext Payload / Blocks (Hex):
🔬 Byte Matrix, Intermediate Vector I[k] & XOR Transform
STATE: EXPLOITABLE
🛡️ Decryption Server Oracle & Security Validation Response
HTTP 200: VALID PADDING
Triage Presets:
1. Ransomware LockBit (Process + Canary + VSS)
2. In-Memory Reflective DLL (Fileless Beacon)
3. NTFS MFT Timestomp ($STD vs $FN Anomaly)
4. Host Containment & SOAR Isolation
5. 🛡️ Clean Baseline Workstation
Endpoint Host / IP:
Artifact Stream:
Ransomware Behavioral Telemetry
In-Memory Injection & VAD Scanner
NTFS $MFT & USN Journal Timeline
EDR & SOAR Host Containment API
Baseline Legitimate Enterprise Workstation
EDR Network Host Containment
VAD & Memory Dump Scanner
SOAR Auto-Remediation Playbook
Execute Triage & Parse Forensics
Forensic Query / Artifact Context Stream:
volatility3 -f memory.dmp windows.malfind --pid 4812 | parse-timeline --mft C:\$MFT --vss-diff
🔬 Process Tree, VAD Region & In-Memory Carving
TRIAGE: MALICIOUS
🛡️ NTFS MFT Timeline, C2 NetFlow & SOAR Containment
STATUS: ACTIVE INFECTION
Supply Chain Presets:
1. Dependency Confusion (corp-auth-core v99.0.0)
2. Typosquatting (requsts vs requests)
3. xz-utils CVE-2024-3094 (M4 Build Hook)
4. Actions Pwn Request (Secret Exfil)
5. 🛡️ SLSA L3 & Cosign Verified Image
Target Package / Component:
Admission Policy:
Default Registry (Unpinned / Public Fallback)
Scoped Registry + Strict SHA-256 Hash Pinning
Enforce SLSA L3 Hermetic & Rekor Attestation
🔬 Scan SBOM & Pipeline
🛡️ Apply Hardening
📦 Dependency Graph, PURL & CycloneDX SBOM Manifest
STATUS: AUDIT REQUIRED
🛡️ Sigstore Cosign Attestation & SLSA Level 3 Verdict
GOVERNANCE: UNVERIFIED
Serverless Attack & Defense Presets:
1. S3 Event Injection (Command Injection via Key)
2. Warm Container /tmp Data Leak & Session Residue
3. Overprivileged IAM sts:AssumeRole Escalation
4. 🛡️ Immutable Runtime & MicroVM Hardened Defense
Event Object Key / Input:
Runtime Profile:
AWS Lambda (Writable /tmp, Default IAM)
Firecracker Hardened (Schema + Least Privilege)
OCI Container (ReadOnlyRootFS + Ephemeral Scrub)
⚡ Invoke Function
🛡️ Apply Hardening
⚡ Event Payload, MicroVM Sandboxing & Execution Trace
STATUS: UNVALIDATED
🛡️ IAM STS Permission Gate & Runtime Hardening Verdict
VERDICT: VULNERABLE
Cloud IR & Threat Hunting Presets:
1. CloudTrail Anomaly (AttachUserPolicy Admin Escalation)
2. Stolen STS Session (S3 PII Vault Exfiltration)
3. VPC Flow Logs (Periodic 60s Jitter C2 Beacon)
4. 🛡️ GuardDuty & Automated SOAR Multi-Layer Containment
Telemetry Query / Filter:
Telemetry Source:
AWS CloudTrail (Management Plane Events)
Amazon S3 Access Logs (PII Data Vault)
VPC Flow Logs (Private Subnet ENI)
GuardDuty & ASFF Threat Findings
☁️ Triage Telemetry
🛡️ Execute SOAR Containment
☁️ CloudTrail, S3 Data Access & VPC NetFlow Telemetry
STATUS: UNTRIAGED
🛡️ GuardDuty Correlation & SOAR Automated Containment
VERDICT: UNCONTAINED
Extension Security Presets:
1. Manifest V3 Audit (<all_urls> & Service Worker)
2. WAR Token Leak (auth_config.json Master Secret)
3. Content Script DOM XSS & Password Sniffer
4. 🛡️ Declarative Net Request & Strict CSP Hardening
Target URI / Component:
Audit Scope:
Manifest V3 Permissions & Service Worker
Web Accessible Resources (WAR) Cross-Context Probe
Content Script DOM Injections & Credential Sniffer
Declarative Net Request (DNR) Ruleset & Extension CSP
🧩 Audit Extension
🛡️ Apply Extension Hardening
🧩 Extension Manifest, WAR & Content Script Telemetry
STATUS: UNTRIAGED
🛡️ Exploitation Verdict & ExtensionGuard Posture
VERDICT: UNPROTECTED
PQC & Lattice Presets:
1. Shor Quantum Threat (RSA-2048 / ECDSA-P256 Factoring)
2. Hybrid KEM Downgrade (X25519 Fallback Forcing)
3. Lattice Fault Injection (Re-encryption Verification Bypass)
4. 🛡️ FIPS 203 ML-KEM & 204 ML-DSA Agility Hardening
Cryptographic Suite / Target:
KEM / Signature Primitive:
Classical RSA-2048 / ECDSA-P256 (Harvest Now, Decrypt Later)
Hybrid X25519 + ML-KEM-768 (Draft TLS 1.3)
FIPS 203 ML-KEM-768 (Kyber Module-LWE)
FIPS 204 ML-DSA-65 (Dilithium Module-LWE)
Simulate Quantum Resistance
⚛️ Polynomial Ring Arithmetic, KEM & Quantum Surface Telemetry
STATUS: UNTRIAGED
🛡️ Post-Quantum Migration Verdict & PQCShield Posture
VERDICT: UNPROTECTED
Kernel Hardening Presets:
1. Seccomp-BPF Filter (Deny execve/ptrace)
2. Landlock LSM Sandbox (Unprivileged FS Scoping)
3. IMA/EVM Integrity Appraisal (Tamper Blocking)
4. 🛡️ KSPP Full Defense (KASLR + SMEP + CFI + SLUB)
Target Process / Binary:
Enforcement Policy:
Unhardened (Vanilla Kernel, All Syscalls Allowed)
Seccomp-BPF Allowlist (EPERM on Dangerous Syscalls)
Landlock LSM V5 Sandbox (Monotonic FS & Net Scoping)
IMA/EVM Signed Execution (Digsig Enforced, EACCES on Tamper)
Full KSPP + Seccomp + Landlock + IMA/EVM Defense
Simulate Kernel Security Enforcement
🐧 Kernel Telemetry, Syscall Interception & LSM Hooks
STATUS: UNTRIAGED
🛡️ Defense Verdict & Kernel Self-Protection Posture
VERDICT: UNPROTECTED
Agent Attack Scenarios:
1. Indirect Prompt Injection (Untrusted Web/RAG)
2. Tool Description / Schema Poisoning
3. Confused Deputy & Tool Shadowing
4. 🛡️ Dual-LLM Guardrail + Landlock Sandbox
Agent Workload / MCP Client:
MCP Security Policy:
Unprotected (Direct Execution, No Guardrail)
Dual LLM Input/Output Guardrail (Filter IPI)
Human-In-The-Loop Approval Gate (Block High-Risk Calls)
Landlock LSM & Seccomp Sandbox (FS/Net Isolation)
Full Zero Trust Agent Shield (Dual LLM + HITL + Landlock)
Simulate MCP Security Inspection
🤖 MCP JSON-RPC Packet Trace & Tool Invocation
STATUS: UNTRIAGED
🛡️ Defense Verdict & Agent Policy Enforcement
VERDICT: UNPROTECTED
SANS FOR508/572 Triage Scenarios:
1. Evidence of Execution (PECmd / ShimCache)
2. $MFT Data Run & USN Journal Timestomp
3. Volatility 3 DKOM & RWX VAD Injection
4. 🔒 Supertimeline Plaso + SOAR Host Containment
Forensic Target / Host:
Triage Filter / Tool:
PECmd.exe (Prefetch Last Run & DLL Carving)
MFTECmd.exe ($MFT Non-Resident Data Runs)
Volatility 3 (psscan + malfind RWX VAD)
tshark FOR572 (DNS C2 Tunneling Exfil)
Plaso log2timeline (Unified Supertimeline & SOAR)
Simulate Forensic Investigation
🔍 Artifact Carving & Telemetry Stream
STATUS: UNTRIAGED
🛡️ Root Cause Analysis (RCA) & Containment
STATUS: COMPROMISED
eBPF Runtime Scenarios:
1. Kprobe & Tracepoint Syscall Tap (sys_execve)
2. eBPF LSM Namespace Escape Block (bpf_lsm_file_open)
3. Tetragon TracingPolicy In-Kernel Sigkill (commit_creds)
4. 🔒 Shadow Rootkit Hunter & Map Carve (getdents64)
Target Hook / Syscall:
Sensor Engine:
Kprobe & Tracepoint (sys_execve ringbuf stream)
eBPF LSM (bpf_lsm_file_open -EPERM container sandbox)
Cilium Tetragon (TracingPolicy in-kernel Sigkill)
Rootkit Hunter (getdents64 sys_enter map unpin)
Simulate Kernel Sensor Execution
🐝 Kernel BPF Bytecode & Tracepoint Events
STATUS: STANDBY
🛡️ Tetragon In-Kernel Enforcement & LSM Verdict
STATUS: MONITORING
C2 Tunneling Scenarios:
1. DNS Shannon Entropy Exfiltration (dnscat2 / TXT chunks)
2. Multi-hop Chisel SOCKS5 Reverse Pivot (Port 8052)
3. Malleable C2 Beaconing (Jitter Variance & Sleep Mask)
4. 🔒 Inline Zeek/Suricata DPI & TCP RST Drop
Egress Channel / Payload:
Inspection Engine:
DNS Entropy Analyzer (Shannon Entropy > 4.2 H(X))
Chisel SOCKS5 Pivoting Tap (Reverse Stream Multiplex)
Malleable C2 Jitter Detector (Delta Inter-arrival Variance)
Suricata/Zeek DPI (Flowbits & TCP Reset Drop)
Simulate C2 Traffic Analysis
📡 Egress Packet Stream & Covert Beacon Payload
STATUS: STANDBY
🛡️ Zeek / Suricata Inline DPI Verdict & Mitigation
STATUS: MONITORING
Scenarios:
1. Japneet -> Domain Admins (Shortest Path)
2. IT_Supports GenericAll Exploit
3. WriteDacl Direct Elevation
4. Toxic ACE Cut & Protected Users
Cypher Query:
Execute Cypher
Reset Graph
🩸 Active Directory Directed Attack Graph G=(V, E)
PATH ACTIVE: 4 HOPS
📊 Neo4j Graph Traversal & ACL Policy Telemetry
TIER 0 AT RISK
Scenarios:
1. MCP Tool Poisoning (IPI)
2. Confused Deputy Subprocess Escape
3. Landlock LSM Unprivileged Confinement
4. Dual-LLM & Tetragon eBPF Wire-Speed Intercept
MCP Tool Call Payload:
Enforcement Mode:
0: Unconfined Host (Default / High Risk)
1: Landlock LSM (No-New-Privs + FS Rules)
2: Dual-LLM Arbitrator + Tetragon SIGKILL
Dispatch Action
Reset Sandbox
🤖 AI Agent Execution Trace & Tool Telemetry
AGENT: UNCONFINED
🛡️ Landlock LSM & eBPF Kernel Confinement
LSM: ACTIVE
Scenarios:
1. Classical RSA-2048 (SNDL Harvest Risk)
2. NIST FIPS 203 Pure ML-KEM-768
3. Hybrid X25519 + ML-KEM-768 Handshake
4. Active MitM Downgrade Tamper Attack
Negotiated Cipher/KEM:
RSA-2048-PKCS1v15 (Classical / Broken by Shor)
TLS_AES_128_GCM_SHA256 (ECDH X25519 Only)
FIPS203_ML_KEM_768 (Lattice KEM Standalone)
X25519Kyber768Draft00 (Hybrid PQC Defense)
MitM Tamper Injection:
None (Clean Wire Transmission)
Strip PQC Supported Groups (Force Classical Fallback)
Tamper Lattice Ciphertext Vector (IND-CCA2 Test)
Simulate Handshake
Reset Simulation
⚛️ TLS 1.3 Key Share & Wire Telemetry
WIRE: HYBRID
🛡️ Shor Attack Complexity & Anti-Downgrade Audit
VERDICT: QUANTUM SAFE
FLAG{css_display_none_lies}