Modifying Prompts

prompts/
├── pre-recon-code.txt         # Pre-reconnaissance agent
├── recon.txt                   # Reconnaissance agent
├── vuln-injection.txt          # Injection vulnerability agent
├── vuln-xss.txt               # XSS vulnerability agent
├── vuln-auth.txt              # Auth vulnerability agent
├── vuln-authz.txt             # Authz vulnerability agent
├── vuln-ssrf.txt              # SSRF vulnerability agent
├── exploit-injection.txt       # Injection exploitation agent
├── exploit-xss.txt            # XSS exploitation agent
├── exploit-auth.txt           # Auth exploitation agent
├── exploit-authz.txt          # Authz exploitation agent
├── exploit-ssrf.txt           # SSRF exploitation agent
├── report-executive.txt        # Report generation agent
└── shared/
    ├── login-instructions.txt  # Reusable login flow instructions
    └── tool-guidelines.txt     # Shared tool usage guidance

You are analyzing https://app.example.com for injection vulnerabilities.

# Login Instructions
1. Navigate to https://app.example.com/login
2. Type $username into the email field
3. Type $password into the password field
4. Click the 'Sign In' button

authentication:
  login_type: form
  credentials:
    username: [email protected]
    password: TestPass123!

Your objective is to identify SQL injection, NoSQL injection, and command injection vulnerabilities in this application.

./shannon start URL=https://test-app.com REPO=test-repo PIPELINE_TESTING=true

# [Vulnerability Type] Analysis Agent

You are analyzing {{TARGET_URL}} for [specific vulnerability type].

## Prerequisites
Review these deliverables from previous agents:
- `recon_deliverable.md` - Attack surface map
- `code_analysis_deliverable.md` - Source code insights

## Objective
Identify [specific vulnerability patterns] that could lead to [impact].

## Analysis Methodology
1. Source code review for [dangerous patterns]
2. Data flow analysis from user input to [sink]
3. Live testing on running application
4. Document findings with confidence levels

## Deliverable
Save to `[vuln_type]_analysis_deliverable.md`:

### Format
# [Vulnerability Type] Analysis

## High Confidence Findings
[Findings with confirmed vulnerable code paths]

## Medium Confidence Findings  
[Findings requiring exploitation to confirm]

## Testing Queue
For each high/medium confidence finding, provide:
- Endpoint URL
- Parameter name
- Suggested exploit payload
- Expected impact

# [Vulnerability Type] Exploitation Agent

You are attempting to exploit the vulnerabilities identified in `[vuln_type]_analysis_deliverable.md`.

## Objective
Prove each finding is exploitable through successful attack execution.

## "No Exploit, No Report" Policy
Only findings you can successfully exploit should be documented.
If you cannot prove exploitation, discard the finding as a false positive.

## Exploitation Workflow
For each finding in the testing queue:
1. Craft exploit payload
2. Execute attack via browser or curl
3. Capture proof (screenshot, response, database output)
4. Document impact
5. Save reproducible proof-of-concept

## Deliverable
Save to `[vuln_type]_exploitation_evidence.md`:

### Format
# [Vulnerability Type] Exploitation Evidence

## Exploited Vulnerabilities

### Vulnerability 1: [Title]
**Severity**: Critical/High/Medium/Low
**Endpoint**: [URL]
**Parameter**: [param]

#### Proof of Concept
```bash
[exact curl command or browser steps]

## Advanced Techniques

### Multi-Turn Reasoning

For complex vulnerabilities requiring multiple steps:

```markdown
## Analysis Strategy
This vulnerability requires a multi-step approach:

1. **Reconnaissance**: Identify session management mechanism
2. **Analysis**: Determine if session tokens are predictable
3. **Hypothesis**: If tokens use weak randomness, we can predict valid tokens
4. **Testing**: Generate 100 tokens and analyze for patterns
5. **Exploitation**: Predict and hijack an active session

Take your time with each step. Don't rush to exploitation.

## Available Tools

**Browser Automation** (Playwright MCP):
- Use for: Testing UI flows, JavaScript-based vulnerabilities, session management
- Example: `playwright.goto({{TARGET_URL}})`, `playwright.click('#submit')`

**Command Line** (curl, netcat, etc.):
- Use for: API testing, raw HTTP requests, protocol-level attacks
- Example: `curl -X POST https://api.example.com/login -d '{"user":"admin"}'`

**Source Code Analysis**:
- Use for: Finding vulnerable code patterns, data flow analysis
- Example: Search for `eval(`, `exec(`, `query(` without parameterization

**save_deliverable**:
- Use for: Saving final analysis results
- Format: Markdown with clear sections and code blocks