payload-mutator·execution·active

Payload Mutator

Generates targeted attack payloads for injection, deserialization, SSRF, prototype pollution. Backs off on first signal of damage to stay non-destructive.

SARAtrigger · agent

Payload Mutator

Generates targeted attack payloads for injection, deserialization, SSRF, and prototype pollution. Backs off on first signal of damage to stay non-destructive.

When this skill fires

·OWASP Probe Library identifies a candidate injection point and SARA wants to confirm

·An engineer points SARA at a specific endpoint with --probe injection

·A target environment is tagged destructive-testing-allowed and the payload mutator can run end-to-end exploitation

Payload classes

SQL injection

·Boolean-based blind (' AND 1=1-- vs ' AND 1=2--)

·Time-based blind ('; WAITFOR DELAY '0:0:5'--)

·Union-based (after column-count enumeration)

·Out-of-band (when DNS exfil is permitted)

NoSQL injection

·MongoDB operators ({$ne: null}, {$regex: ".*"})

·Object literal injection in stringified queries

Command injection

·Bash, PowerShell, cmd.exe variants

·Encoding bypasses (URL, base64, hex)

Deserialization

·Java (ysoserial gadgets)

·.NET (TypeConfuseDelegate, ObjectDataProvider)

·Python (pickle RCE chains)

·PHP (POP chains)

SSRF

·Internal IP ranges (10.x, 172.16-31.x, 192.168.x, link-local)

·Cloud metadata endpoints (169.254.169.254, etc.)

·DNS rebinding

·Schema confusion (gopher://, file://, dict://)

Prototype pollution

·__proto__, constructor.prototype payloads

·JSON pollution via merge libraries

Damage-detection backoff

→The mutator monitors response patterns and backs off the moment it sees damage signals: 500 errors, response time degradation > 10×, or any indicator that the probe affected real state.

The default mode is detect, don't exploit. Confirming a SQL injection by extracting one row is enough; extracting the whole users table is over-the-line and against the contract.

Authorization gates

Three escalating modes:

·Detect — default. Sends boundary payloads designed to confirm presence without exploitation.

·Confirm — slightly more aggressive. May read 1–2 records to prove access. Requires --allow-confirm.

·Exploit — full exploitation. Only on environments explicitly tagged destructive-testing-allowed AND an explicit --allow-exploit flag AND a documented authorization in the run config.

What it produces

For each candidate injection point:

·A list of attempted payloads with their responses

·A confidence score (Confirmed / High / Medium / Low)

·Evidence captured byEvidence Capture — exact request, response, timing

·A draft remediation handed toRemediation Generator

→The mutator is the most carefully-bounded skill in the squad. Misuse is the difference between a useful security tool and an incident.

Related · execution

Locator Healer

locator-healer

When a locator fails in CI, proposes a replacement based on accessibility tree diff and test history. Cuts maintenance churn by ~35%.

Scenario Synthesizer

scenario-synthesizer

Builds ramp-up, soak, spike, and chaos scenarios from a single SLO definition. Wires them to ARIA's reporting pipeline by default.

Observability Hookup

observability-hookup

Auto-correlates load test runs with APM metrics (Datadog, New Relic, Grafana) so saturation signals — pool exhaustion, GC pauses — show up in the report.

OWASP Probe Library

owasp-probe-library

Curated probes for the OWASP API + Web Top 10. Read-only and non-destructive — safe to run in shared environments and lower production tiers.

Evidence Capture

evidence-capture

For every confirmed finding, records the exact request, response, and timing. Output is replayable in seconds for engineering verification.

Adversarial Probes

nora-adversarial-probes

Red-team test suite covering the OWASP LLM Top 10 — prompt injection (direct + indirect), jailbreaks, system-prompt extraction, guardrail bypass, tool-scope escalation, insecure output handling, model DoS. Generates attack variants automatically and scores severity.