TEXT

Plataforma Escopo Bugbouty Cyber Hunter Lab

Contributed by ticarollamas-arch

Improved by Laravel Company · 2026-09-07

You are a Senior Software Architect specializing in Site Reliability Engineering (SRE) and Dynamic Application Security Testing (DAST). Your task is to design and implement a complete, production-ready Python framework that acts as an intelligent testing engine for robustness analysis and business rule validation against REST APIs.

Core Objective:
Build an intelligent system that systematically identifies structural logic failures (equivalent to High and Critical severity business rule violations) across three critical vulnerability categories:

  1. Access Control & Context Bypass Failures: Identifying flaws like Broken Object Level Authorization (BOLA), Insecure Direct Object Reference (IDOR), and privilege escalation checks.
  2. Business Logic Inversions & Anomalies: Detecting exploitable mathematical, sequence, or format manipulations (e.g., parameter reversal, billing flow exploitation, Content-Type format switching like YAML/JSON injection).
  3. Infrastructure Resilience Failures: Detecting failures related to service stability, such as unhandled runtime exceptions causing service interruption or denial-of-service conditions under specific load/input conditions.

Architecture Requirements (Modular Design):
The framework must be strictly modular, with clear separation of concerns: Analysis Engine $\rightarrow$ Execution Engine $\rightarrow$ Reporting Engine.

1. INTELLIGENCE COMPONENT (Scenario Analysis Engine):
This component must dynamically generate sophisticated test scenarios:

  • Input: Application route mappings (endpoints) and required authentication context.
  • Logic: Dynamically generate an edge case test matrix by applying semantic mutation logic to input parameters. This must focus on identifying semantic anomalies, including:
    • Type inversions (e.g., sending string where integer is expected).
    • Numerical value reversals or boundary violations.
    • Data format coercion attempts (e.g., attempting to switch between JSON and YAML, or injecting non-standard data types).
    • Parameter boundary testing (e.g., testing max/min values, zero, negative numbers).
  • Output: A structured list of actionable test cases containing: the mutated request payload/parameters, the expected versus anomalous behavior, the specific vulnerability category targeted, and a preliminary impact classification (High/Critical).

2. EXECUTION COMPONENT (Real Python Interactive Console):
This component must execute the generated scenarios against a live target with production-grade stability:

  • Interface: Implement a real-time, interactive console using the requests and urllib3 libraries.
  • Execution Flow: Accept target URL and legitimate authentication headers from the user. Execute all test cases generated by the Intelligence Component iteratively.
  • Robustness: Implement comprehensive exception handling, strict timeout protection, and connection error handling to ensure console stability during execution.
  • Data Capture: For every request, capture and log the following data:
    • Actual HTTP Status Codes (e.g., 200, 401, 403, 500).
    • Exact Response Payload size.
    • Full Response Headers.
    • Raw server response body.
    • Capture any relevant error messages or simulated server logs (if accessible).
  • Interaction: Must support real-time parameter mutation injection during execution (query params, body payloads, headers).

3. REPORTING COMPONENT:
Generate a comprehensive, human-readable Markdown report summarizing the findings:

  • Proof-of-Concept (PoC) Reproduction: Provide step-by-step instructions, including the exact mutated request and the resulting server response, for each identified vulnerability.
  • Severity Assessment: Clearly classify each finding as High or Critical, accompanied by a detailed business impact assessment explaining why the violation is severe (linking the technical failure to the business rule).
  • Traffic Capture: Include raw, side-by-side request/response pairs for verification.
  • Remediation Guidance: Provide specific, actionable, and production-focused security and architectural remediation advice for each failure type.

Delivery Mandate:
Provide the complete, fully integrated, executable Python framework. The system must operate end-to-end when provided with a live target URL and authentication headers, requiring zero external configuration beyond the initial input. The final output must function as a functional PoC demonstrating real vulnerabilities with real HTTP traffic capture and high-impact business logic violations. Prioritize production-quality error handling, logging, and modular design above all else.

Original prompt (before our improvements)

You are a Senior Software Architect specializing in Site Reliability Engineering (SRE) and Dynamic Application Security Testing (DAST). Your task is to design and implement a production-ready Python framework that performs robustness analysis and business rule validation against REST APIs and web endpoints. **Core Objective:** Build an intelligent testing engine that identifies structural logic failures across three high-impact vulnerability categories (equivalent to High and Critical severity business rule violations): 1. **Access Control & Context Bypass Failures** (e.g., Broken Object Level Authorization - BOLA) 2. **Business Logic Inversions & Anomalies** (e.g., mathematical parameter manipulation, billing flow exploitation, Content-Type format switching like YAML/JSON injection) 3. **Infrastructure Resilience Failures** (e.g., unhandled runtime exceptions causing service interruption) **Architecture Requirements:** **1. INTELLIGENCE COMPONENT (Scenario Analysis Engine):** Create a structured function that: - Accepts application route mappings as input - Dynamically generates an edge case test matrix using parameter mutation logic - Focuses on semantic anomalies: type inversions, numerical value reversals, data format coercion, and parameter boundary violations (not just path traversal) - Returns actionable test cases with specific payloads, expected vs. anomalous behaviors, and impact classifications **2. EXECUTION COMPONENT (Real Python Interactive Console):** Implement a real-time console using `requests` and `urllib3` with robust exception handling that: - Accepts user input: target URL and legitimate authentication headers - Executes actual HTTP requests based on test cases generated by the intelligence component - Captures and displays: actual HTTP status codes (200, 401, 403, 500, etc.), exact response payload size, raw server logs, and response headers - Includes timeout protection and connection error handling to maintain console stability - Supports parameter mutation injection in real-time (query params, body payloads, headers) **3. REPORTING COMPONENT:** Generate a markdown report that includes: - Proof-of-Concept (PoC) reproduction steps with actual requests and responses - Severity classification (High/Critical) with business impact assessment - Raw HTTP traffic capture (request/response pairs) - Actionable remediation guidance **Code Structure Requirements:** - Modular design with clear separation: analysis engine → execution engine → reporting engine - Production-quality error handling, logging, and state management - Console must be reproducible in real-time with actual network calls (not mocked) - Output format compatible with manual Burp Suite replay for verification - All actual HTTP responses and status codes must be real, not simulated **Delivery:** Provide the complete, executable Python framework with all three components integrated. The system must work immediately when given a live target URL—no configuration needed beyond authentication headers. The console terminal should be a functional PoC that demonstrates real vulnerabilities with real HTTP traffic capture and high-impact business logic violations.