fix(security): prevent SSRF via unvalidated GitHub Enterprise URL in Copilot plugin

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(*)",
+      "Read(*)",
+      "Write(*)",
+      "Edit(*)",
+      "Glob(*)",
+      "Grep(*)",
+      "WebFetch(*)",
+      "WebSearch(*)",
+      "NotebookEdit(*)",
+      "Task(*)"
+    ]
+  }
+}

.cyberstrike/.gitignore

@@ -0,0 +1,3 @@
+plans/
+bun.lock
+package.json

.cyberstrike/cyberstrike.jsonc

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://cyberstrike.io/config.json",
+  "provider": {
+    "cyberstrike": {
+      "options": {}
+    }
+  },
+  "mcp": {
+  }
+}

.cyberstrike/env.d.ts

@@ -0,0 +1,4 @@
+declare module "*.txt" {
+  const content: string
+  export default content
+}

.cyberstrike/skill/ad-security/SKILL.md

@@ -0,0 +1,180 @@
+---
+name: ad-security
+description: Active Directory security testing and attack techniques
+tags: [ad, windows, kerberos, ldap, internal-network]
+version: "1.0"
+---
+
+# Active Directory Security Testing
+
+## Credential Access Techniques
+
+| ID | Technique | Tool | Description |
+|----|-----------|------|-------------|
+| CA-01 | Kerberoasting | GetUserSPNs.py, Rubeus | Request TGS for service accounts |
+| CA-02 | AS-REP Roasting | GetNPUsers.py, Rubeus | Attack accounts without preauth |
+| CA-03 | DCSync | secretsdump.py, Mimikatz | Replicate DC credentials |
+| CA-04 | LSASS Dump | Mimikatz, ProcDump | Extract credentials from memory |
+| CA-05 | SAM/SYSTEM Dump | secretsdump.py | Extract local credentials |
+| CA-06 | NTDS.dit Extraction | secretsdump.py | Offline DC credential dump |
+| CA-07 | Cached Credentials | Mimikatz | Extract cached domain creds |
+| CA-08 | DPAPI Secrets | Mimikatz, SharpDPAPI | Decrypt protected data |
+| CA-09 | Credential Vault | Mimikatz | Windows credential manager |
+| CA-10 | Browser Credentials | SharpChromium | Chrome/Edge saved passwords |
+| CA-11 | LLMNR/NBT-NS Poisoning | Responder | Capture NTLMv2 hashes |
+| CA-12 | NTLM Relay | ntlmrelayx.py | Relay captured authentication |
+| CA-13 | Password Spraying | Spray, Kerbrute | Test common passwords |
+| CA-14 | GPP Passwords | Get-GPPPassword | Decrypt Group Policy preferences |
+
+## Privilege Escalation Techniques
+
+| ID | Technique | Tool | Description |
+|----|-----------|------|-------------|
+| PE-01 | ACL Abuse | BloodHound, PowerView | WriteDACL, GenericAll abuse |
+| PE-02 | GPO Abuse | SharpGPOAbuse | Modify group policy |
+| PE-03 | AD CS ESC1 | Certipy | Template allows user SAN |
+| PE-04 | AD CS ESC2 | Certipy | Any purpose EKU |
+| PE-05 | AD CS ESC3 | Certipy | Enrollment agent abuse |
+| PE-06 | AD CS ESC4 | Certipy | Template ACL abuse |
+| PE-07 | AD CS ESC5 | Certipy | PKI object access control |
+| PE-08 | AD CS ESC6 | Certipy | EDITF_ATTRIBUTESUBJECTALTNAME2 |
+| PE-09 | AD CS ESC7 | Certipy | CA ACL abuse |
+| PE-10 | AD CS ESC8 | Certipy | NTLM relay to HTTP enrollment |
+| PE-11 | Constrained Delegation | Rubeus, getST.py | S4U2Self/S4U2Proxy abuse |
+| PE-12 | Resource-Based Constrained Delegation | Rubeus | msDS-AllowedToActOnBehalfOfOtherIdentity |
+
+## Lateral Movement Techniques
+
+| ID | Technique | Tool | Description |
+|----|-----------|------|-------------|
+| LM-01 | Pass-the-Hash | Mimikatz, pth-winexe | Authenticate with NTLM hash |
+| LM-02 | Pass-the-Ticket | Rubeus, Mimikatz | Inject Kerberos tickets |
+| LM-03 | Overpass-the-Hash | Rubeus | Request TGT with NTLM hash |
+| LM-04 | PSExec | Impacket, Sysinternals | Remote execution via SMB |
+| LM-05 | WMI Execution | wmiexec.py | Execute commands via WMI |
+| LM-06 | DCOM Execution | dcomexec.py | Distributed COM abuse |
+| LM-07 | WinRM | evil-winrm | PowerShell remoting |
+| LM-08 | RDP Hijacking | tscon.exe | Take over disconnected sessions |
+| LM-09 | SMB Relay | ntlmrelayx.py | Relay auth to other hosts |
+| LM-10 | SSH (Linux) | ssh | Lateral to Linux systems |
+
+## Persistence Techniques
+
+| ID | Technique | Tool | Description |
+|----|-----------|------|-------------|
+| PS-01 | Golden Ticket | Mimikatz, ticketer.py | Forge TGT with KRBTGT hash |
+| PS-02 | Silver Ticket | Mimikatz, ticketer.py | Forge TGS for specific service |
+| PS-03 | Diamond Ticket | Rubeus | Modify legitimate TGT |
+| PS-04 | Skeleton Key | Mimikatz | Master password on DC |
+| PS-05 | AdminSDHolder | PowerView | Persistent admin rights |
+| PS-06 | DCShadow | Mimikatz | Rogue domain controller |
+| PS-07 | SID History | Mimikatz | Add privileged SID to history |
+| PS-08 | Machine Account | Powermad | Add computer to domain |
+
+## Enumeration Commands
+
+### BloodHound Collection
+```bash
+# SharpHound (Windows)
+SharpHound.exe -c All --zipfilename bloodhound.zip
+
+# BloodHound.py (Linux)
+bloodhound-python -d domain.local -u user -p pass -ns 10.0.0.1 -c all
+
+# NetExec BloodHound
+nxc ldap 10.0.0.1 -u user -p pass --bloodhound --collection All
+```
+
+### LDAP Enumeration
+```bash
+# Get domain info
+ldapsearch -x -H ldap://10.0.0.1 -D "user@domain.local" -w 'pass' -b "DC=domain,DC=local"
+
+# Find users with SPN (Kerberoastable)
+ldapsearch -x -H ldap://10.0.0.1 -D "user@domain.local" -w 'pass' \
+  -b "DC=domain,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName
+
+# Find users without preauth (AS-REP Roastable)
+ldapsearch -x -H ldap://10.0.0.1 -D "user@domain.local" -w 'pass' \
+  -b "DC=domain,DC=local" "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))"
+```
+
+### NetExec Commands
+```bash
+# Enumerate users
+nxc smb 10.0.0.1 -u user -p pass --users
+
+# Enumerate groups
+nxc smb 10.0.0.1 -u user -p pass --groups
+
+# Find shares
+nxc smb 10.0.0.1 -u user -p pass --shares
+
+# Check for admin access
+nxc smb 10.0.0.0/24 -u user -p pass
+
+# Password spray
+nxc smb 10.0.0.1 -u users.txt -p 'Spring2024!' --no-bruteforce
+```
+
+## Attack Paths
+
+### Path 1: Domain User to Domain Admin
+```
+User Credential
+    │
+    ├─► Kerberoast SPN accounts
+    │   └─► Crack service account password
+    │       └─► Service account is Domain Admin
+    │
+    ├─► BloodHound Path Finding
+    │   └─► ACL chain to DA group
+    │       └─► WriteDACL → GenericAll → Add to DA
+    │
+    └─► AD CS Misconfiguration
+        └─► ESC1: Request cert as DA
+            └─► Authenticate as DA
+```
+
+### Path 2: Compromised Workstation to DC
+```
+Local Admin on Workstation
+    │
+    ├─► LSASS dump → cached domain creds
+    │   └─► Domain user credential
+    │       └─► Continue as Path 1
+    │
+    ├─► Find admin sessions
+    │   └─► Lateral move to server
+    │       └─► Dump DA credentials
+    │
+    └─► Unconstrained Delegation
+        └─► Coerce DC authentication
+            └─► Capture TGT → DCSync
+```
+
+## Important Impacket Tools
+
+| Tool | Purpose |
+|------|---------|
+| GetUserSPNs.py | Kerberoasting |
+| GetNPUsers.py | AS-REP Roasting |
+| secretsdump.py | Dump secrets (DCSync, SAM, LSA) |
+| smbexec.py | SMB-based execution |
+| wmiexec.py | WMI-based execution |
+| psexec.py | PSExec-style execution |
+| ntlmrelayx.py | NTLM relay attacks |
+| getST.py | Request service tickets |
+| ticketer.py | Create Golden/Silver tickets |
+| lookupsid.py | SID enumeration |
+| samrdump.py | SAM Remote interface dump |
+
+## Detection Evasion Considerations
+
+| Action | Detection | Evasion |
+|--------|-----------|---------|
+| Kerberoasting | 4769 events (RC4) | Use AES encryption |
+| DCSync | 4662 events | Time-based, limit frequency |
+| Pass-the-Hash | 4624 Type 3 with NTLM | Overpass-the-Hash (Kerberos) |
+| BloodHound | LDAP queries | Reduce collection scope |
+| Mimikatz | AV signatures | BOF, custom tools |

.cyberstrike/skill/bun-file-io/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: bun-file-io
+description: Use this when you are working on file operations like reading, writing, scanning, or deleting files. It summarizes the preferred file APIs and patterns used in this repo. It also notes when to use filesystem helpers for directories.
+---
+
+## Use this when
+
+- Editing file I/O or scans in `packages/cyberstrike`
+- Handling directory operations or external tools
+
+## Bun file APIs (from Bun docs)
+
+- `Bun.file(path)` is lazy; call `text`, `json`, `stream`, `arrayBuffer`, `bytes`, `exists` to read.
+- Metadata: `file.size`, `file.type`, `file.name`.
+- `Bun.write(dest, input)` writes strings, buffers, Blobs, Responses, or files.
+- `Bun.file(...).delete()` deletes a file.
+- `file.writer()` returns a FileSink for incremental writes.
+- `Bun.Glob` + `Array.fromAsync(glob.scan({ cwd, absolute, onlyFiles, dot }))` for scans.
+- Use `Bun.which` to find a binary, then `Bun.spawn` to run it.
+- `Bun.readableStreamToText/Bytes/JSON` for stream output.
+
+## When to use node:fs
+
+- Use `node:fs/promises` for directories (`mkdir`, `readdir`, recursive operations).
+
+## Repo patterns
+
+- Prefer Bun APIs over Node `fs` for file access.
+- Check `Bun.file(...).exists()` before reading.
+- For binary/large files use `arrayBuffer()` and MIME checks via `file.type`.
+- Use `Bun.Glob` + `Array.fromAsync` for scans.
+- Decode tool stderr with `Bun.readableStreamToText`.
+- For large writes, use `Bun.write(Bun.file(path), text)`.
+
+NOTE: Bun.file(...).exists() will return `false` if the value is a directory.
+Use Filesystem.exists(...) instead if path can be file or directory
+
+## Quick checklist
+
+- Use Bun APIs first.
+- Use `path.join`/`path.resolve` for paths.
+- Prefer promise `.catch(...)` over `try/catch` when possible.