{{ post.title }}
- - -
-
-
-
-
-
- {{ post.author.name }}
-
- {{ formatDate(post.published_at) }} · {{ post.reading_time }} min read
-
-
-
-
-
- event_busy
-
-
- No slots available for this date
-
-
- {{ slot.start_time }}
-
-
- Booking Confirmed!
-Confirmation #{{ bookingNumber }}
-- {{ selectedBooking?.customer_email }} -
Total Sales
- ${{ stats.totalSales }}
-
- +{{ stats.salesGrowth }}%
-
- Orders
- {{ stats.totalOrders }}
-
- {{ stats.pendingOrders }} pending
-
- Customers
- {{ stats.totalCustomers }}
-
- +{{ stats.newCustomers }} new
-
- Products
- {{ stats.totalProducts }}
-
- {{ stats.lowStock }} low stock
-
- ${highlighted}Your Booking is Confirmed!
-Booking #${booking.booking_number}
- -Details
--
-
- Service: ${service.name} -
- Staff: ${staff.name} -
- Date: ${formatDate(booking.booking_date)} -
- Time: ${booking.start_time} - ${booking.end_time} -
- Price: ${formatCurrency(booking.total)} -
Location: Your Business Name
- - Manage Booking - -Need to cancel? Please give us ${settings.cancellation_hours} hours notice.
- ` -}); - -const bookingReminder = (booking, service, staff) => ({ - subject: `Reminder: ${service.name} in 2 hours`, - html: ` -Upcoming Appointment Reminder
-Your appointment is in 2 hours!
- --
-
- Service: ${service.name} -
- Staff: ${staff.name} -
- Time: ${booking.start_time} -
Thank you for your order!
-Order #{{order_number}}
- -Order Details
-{{#each items}} -{{name}} x{{quantity}} - ${{total}}
-{{/each}} - -Total: ${{total}}
- -Shipping Address
-{{shipping_address}}
- -We'll send you another email when your order ships.
-``` - -### Shipping Notification - -```html -Your order has shipped!
-Order #{{order_number}}
- -Tracking: {{tracking_number}}
-Carrier: {{carrier}}
- -Estimated Delivery
-{{estimated_delivery}}
-``` - -## Security Considerations - -### Payment Security -- Never store credit card numbers -- Use PCI-compliant payment providers -- Implement CSRF protection -- Use HTTPS everywhere - -### Order Fraud Prevention -- Validate shipping address -- Check for suspicious patterns (high value, rush shipping) -- Implement rate limiting on checkout -- Log all order actions - -## Performance Optimizations - -### Product Listings -- Paginate results (20-50 per page) -- Use database indexes on category, price -- Cache category pages -- Lazy load product images - -### Cart Performance -- Store cart in Redis for quick access -- Use database for persistence -- Batch quantity updates - -### Inventory Checks -- Real-time stock validation at checkout -- Lock inventory during payment processing -- Handle concurrent purchases gracefully - -## Integration Points - -- Product Import: CSV, JSON, API -- Shipping Carriers: UPS, FedEx, DHL -- Tax Calculation: TaxJar, Avalara -- Email: SendGrid, Mailgun -- Analytics: Google Analytics, Mixpanel - -## Handoff Protocol - -After implementation: -1. Test checkout flow end-to-end -2. Verify payment processing -3. Check inventory deduction -4. Test email notifications -5. Verify order status transitions -6. Review `@CodeSkeptic` for security audit \ No newline at end of file diff --git a/.kilo/skills/incident-response/SKILL.md b/.kilo/skills/incident-response/SKILL.md new file mode 100644 index 0000000..507d53e --- /dev/null +++ b/.kilo/skills/incident-response/SKILL.md @@ -0,0 +1,32 @@ +# Incident Response Skill Set + +Server-side incident response, forensics, malware hunting, and hardening procedures. Used by the `incident-responder` agent. + +## Modules + +| Module | File | Purpose | +|--------|------|---------| +| Forensics Checklist | `forensics-checklist.md` | SSH recon, persistence hunt, timeline, integrity | +| Malware Signatures | `malware-signatures.md` | PHP shell patterns, ELF backdoor indicators, entropy scans | +| Hardening Procedures | `hardening-procedures.md` | Post-incident SSH/web/kernel hardening | +| Backup Verification | `backup-verification.md` | Pre-action backup, integrity check, remote transfer | +| Server Reconnaissance | `server-recon.md` | OS/panel/web/db detection logic | + +## Incident Response Workflow + +``` +[SSH Connect] → [Server Recon] → [Forensics Checklist] + ↓ +[Malware Hunt] → [Persistence Hunt] → [Evidence Capture] + ↓ +[Backup] → [Safe Removal] → [File Recovery] → [Hardening] + ↓ +[Report] +``` + +## Skill Rules +- All commands assume root/sudo access unless specified otherwise +- Every destructive action must be preceded by evidence capture and backup +- Replace system files from package managers, never just `rm` +- Verify malware removal with follow-up scans before declaring clean +- Report all IoCs with file hashes, paths, and timestamps diff --git a/.kilo/skills/incident-response/backup-verification.md b/.kilo/skills/incident-response/backup-verification.md new file mode 100644 index 0000000..1436e68 --- /dev/null +++ b/.kilo/skills/incident-response/backup-verification.md @@ -0,0 +1,83 @@ +# Incident Response: Backup Verification + +Procedures for creating and verifying integrity of backups during incident response. Part of the incident-responder agent skill set. + +## Pre-Destructive-Action Backup + +### Database Backup +```bash +# MySQL/MariaDB +mysqldump --all-databases --single-transaction --routines --events | gzip > /tmp/full-db-backup-$(date +%Y%m%d-%H%M).sql.gz + +# PostgreSQL +pg_dumpall | gzip > /tmp/full-db-backup-$(date +%Y%m%d-%H%M).sql.gz + +# Individual databases (if all is too large) +mysql -e "SHOW DATABASES;" | grep -v Database | while read db; do + mysqldump "$db" | gzip > /tmp/db-${db}-$(date +%Y%m%d-%H%M).sql.gz +done +``` + +### Website / Application Backup +```bash +# Web root backup +tar czf /tmp/www-backup-$(date +%Y%m%d-%H%M).tar.gz /var/www/ --exclude='*.log' --exclude='cache/*' + +# Home directories +tar czf /tmp/home-backup-$(date +%Y%m%d-%H%M).tar.gz /home/ --exclude='*/.cache/*' --exclude='*/tmp/*' + +# Configuration backup +tar czf /tmp/etc-backup-$(date +%Y%m%d-%H%M).tar.gz /etc/ssh /etc/nginx /etc/apache2 /etc/php /etc/mysql /etc/postgresql /etc/crontab /etc/cron.* /etc/systemd +``` + +### Backup Integrity Check +```bash +# SHA256 hash of all backup files +find /tmp -maxdepth 1 -name "*backup*$(date +%Y%m%d)*" -type f -exec sha256sum {} + > /tmp/backup-hashes.txt + +# Verify gzip integrity +find /tmp -maxdepth 1 -name "*.gz" -type f -exec gzip -t {} \; 2>&1 + +# Quick tar validation +find /tmp -maxdepth 1 -name "*.tar.gz" -type f -exec tar tzf {} > /dev/null \; 2>&1 +``` + +## Remote Backup Transfer +```bash +# If remote safe storage available +# scp /tmp/*backup*$(date +%Y%m%d)* user@safe-server:/incident-backups/ + +# Or create a single package +mkdir -p /tmp/incident-package +cp /tmp/*backup* /tmp/backup-hashes.txt /tmp/forensic-snapshot.txt /tmp/suspicious-hashes.txt /tmp/incident-package/ +tar czf /tmp/incident-package-$(date +%Y%m%d-%H%M).tar.gz /tmp/incident-package/ +``` + +## Post-Recovery Verification +```bash +# After restoration from backup, verify: +# 1. Web application loads correctly +curl -s -o /dev/null -w "%{http_code}" http://localhost/ + +# 2. Database connections work +mysql -e "SELECT 1;" > /dev/null 2>&1 && echo "DB OK" || echo "DB FAIL" + +# 3. Critical files present and hashes match +cat /tmp/backup-hashes.txt | while read hash file; do + current=$(sha256sum "$file" 2>/dev/null | awk '{print $1}') + if [ "$current" = "$hash" ]; then + echo "PASS: $file" + else + echo "FAIL: $file" + fi +done + +# 4. No malware in restored files +find /var/www -name "*.php" -exec grep -Hn "eval(base64_decode" {} + 2>/dev/null | head -5 +``` + +## Backup Retention Policy +- Keep incident backups for minimum 90 days +- Store at least one copy off-server +- Label with incident ID and timestamp +- Hash verification on creation and before deletion diff --git a/.kilo/skills/incident-response/forensics-checklist.md b/.kilo/skills/incident-response/forensics-checklist.md new file mode 100644 index 0000000..8f5a1d4 --- /dev/null +++ b/.kilo/skills/incident-response/forensics-checklist.md @@ -0,0 +1,178 @@ +# Incident Response: Forensics Checklist + +Structured forensics procedures for live server investigation during incident response. Part of the incident-responder agent skill set. + +## Phase 1: Initial Reconnaissance (DO NOT modify anything) + +### System Identification +```bash +uname -a +cat /etc/os-release +cat /etc/hostname +uptime +whoami +id +``` + +### Active Sessions +```bash +who +w +last -a | head -20 +lastb | head -20 # Failed logins +``` + +### Process & Network Snapshot +```bash +ps auxf > /tmp/ps-snapshot-$(date +%Y%m%d-%H%M).txt +netstat -tulpn > /tmp/netstat-snapshot-$(date +%Y%m%d-%H%M).txt 2>/dev/null || ss -tulpn > /tmp/netstat-snapshot-$(date +%Y%m%d-%H%M).txt +lsof -i > /tmp/lsof-snapshot-$(date +%Y%m%d-%H%M).txt 2>/dev/null || true +``` + +### Mounted Filesystems & Disks +```bash +df -h +mount | grep -v cgroup +lsblk +``` + +## Phase 2: Persistence Hunt + +### Cron Jobs +```bash +for user in $(cut -f1 -d: /etc/passwd); do + echo "=== Cron for $user ===" + crontab -u "$user" -l 2>/dev/null || true +done +cat /etc/crontab +cat /etc/cron.d/* 2>/dev/null +ls -la /etc/cron.hourly/ /etc/cron.daily/ /etc/cron.weekly/ /etc/cron.monthly/ +``` + +### Systemd Timers & Services +```bash +systemctl list-timers --all --no-pager +systemctl list-units --type=service --state=running --no-pager | grep -v "^ UNIT" +find /etc/systemd/system /lib/systemd/system /usr/lib/systemd/system -type f -newer /etc/hostname 2>/dev/null | head -20 +``` + +### Startup Scripts +```bash +cat /etc/rc.local 2>/dev/null +cat /etc/profile +cat /etc/profile.d/* +cat /etc/bash.bashrc +cat ~/.bashrc +cat ~/.bash_profile +cat ~/.bash_login +cat ~/.profile +``` + +### Chattr +i Detection +```bash +# If lsattr is available +find /bin /sbin /usr/bin /usr/sbin /lib /lib64 -exec lsattr {} + 2>/dev/null | grep "^\-.*i" | head -20 +find /var/www /home -exec lsattr {} + 2>/dev/null | grep "^\-.*i" | head -20 +``` + +### SSH Authorized Keys +```bash +for user in $(cut -f1 -d: /etc/passwd); do + home=$(getent passwd "$user" | cut -d: -f6) + if [ -f "$home/.ssh/authorized_keys" ]; then + echo "=== $user authorized_keys ===" + cat "$home/.ssh/authorized_keys" + fi +done +``` + +### Sudoers +```bash +cat /etc/sudoers +cat /etc/sudoers.d/* 2>/dev/null +``` + +## Phase 3: File System Scan + +### Modified Files (Last 7 Days) +```bash +find /bin /sbin /usr/bin /usr/sbin /lib /lib64 -type f -mtime -7 2>/dev/null | head -30 +find /var/www /home -type f -mtime -7 2>/dev/null | head -50 +find /tmp /var/tmp /dev/shm -type f 2>/dev/null +``` + +### SUID/SGID Files +```bash +find / -perm -4000 -o -perm -2000 2>/dev/null | grep -v "^/snap/" +``` + +### Hidden Files in Web Roots +```bash +find /var/www /home/*/public_html /srv -name ".*" -type f 2>/dev/null | head -30 +``` + +## Phase 4: Timeline Construction + +```bash +# Generate a forensic timeline +cat /var/log/auth.log 2>/dev/null | tail -200 > /tmp/auth-timeline.txt +cat /var/log/syslog 2>/dev/null | tail -200 > /tmp/syslog-timeline.txt +cat /var/log/messages 2>/dev/null | tail -200 > /tmp/messages-timeline.txt +cat /var/log/apache*/access.log 2>/dev/null | tail -500 > /tmp/apache-access-timeline.txt +cat /var/log/nginx/access.log 2>/dev/null | tail -500 > /tmp/nginx-access-timeline.txt +cat /var/log/secure 2>/dev/null | tail -200 > /tmp/secure-timeline.txt + +# Combine timestamps into single sorted timeline +awk '{print $1, $2}' /tmp/*-timeline.txt 2>/dev/null | sort | uniq -c | sort -rn | head -30 +``` + +## Phase 5: Integrity Verification + +### Package Verify +```bash +# RPM-based +rpm -Va --nofiles --nodigest 2>/dev/null | grep "^S.5.* /" | head -20 + +# DEB-based +debsums -sa 2>/dev/null | head -20 + +# Check specific binary integrity against package +rpm -Vf /usr/bin/bash 2>/dev/null || dpkg -V bash 2>/dev/null +``` + +## Forensic Report Output Format +After Phase 1-5, produce a structured report: + +```markdown +## Forensic Report + +### System +- OS: {distro} {version} +- Kernel: {kernel} +- Uptime: {uptime} +- Panel: {panel if detected} + +### Persistence Found +- [ ] Cron +description +- [ ] Systemd +description +- [ ] SSH Keys +description +- [ ] Startup Scripts +description +- [ ] Chattr +i +description + +### Suspicious Processes +- {PID}: {command} ({user}) + +### Suspicious Files +- {path}: {reason} ({sha256}) + +### Timeline Summary +- {date}: {event} + +### Integrity Drift +- {package}: {file} ({md5 mismatch}) +``` diff --git a/.kilo/skills/incident-response/hardening-procedures.md b/.kilo/skills/incident-response/hardening-procedures.md new file mode 100644 index 0000000..9c934bc --- /dev/null +++ b/.kilo/skills/incident-response/hardening-procedures.md @@ -0,0 +1,144 @@ +# Incident Response: Hardening Procedures + +Post-incident hardening checklist and specific commands. Part of the incident-responder agent skill set. + +## Immediate Post-Cleanup Hardening + +### 1. SSH Hardening +```bash +# Backup original +sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%Y%m%d) + +# Apply hardening +sudo sed -i 's/^#*\s*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config +sudo sed -i 's/^#*\s*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config +sudo sed -i 's/^#*\s*PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config +sudo sed -i 's/^#*\s*MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config +sudo sed -i 's/^#*\s*ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config +sudo sed -i 's/^#*\s*ClientAliveCountMax.*/ClientAliveCountMax 2/' /etc/ssh/sshd_config + +# Restart SSH +sudo systemctl restart sshd || sudo systemctl restart ssh +``` + +### 2. Firewall / CSF +```bash +# CSF Installation (if missing) +curl -s https://download.configserver.com/csf.tgz | tar -xzf - +cd csf && sudo sh install.sh + +# Basic CSF rules +sudo csf -x # Flush old rules +sudo csf -a $(whoami) # Whitelist current IP +sudo csf --tcp-in "22,80,443" # Limit incoming +sudo csf --tcp-out "80,443,53,123" # Limit outgoing +sudo csf -r # Restart +``` + +### 3. fail2ban +```bash +sudo apt-get install -y fail2ban 2>/dev/null || sudo yum install -y fail2ban 2>/dev/null || true +sudo tee /etc/fail2ban/jail.local <>'EOF' +[sshd] +enabled = true +port = ssh +filter = sshd +logpath = /var/log/auth.log +maxretry = 3 +bantime = 3600 +findtime = 600 + +[apache-auth] +enabled = true +port = http,https +filter = apache-auth +logpath = /var/log/apache*/*error.log +maxretry = 3 + +[nginx-http-auth] +enabled = true +port = http,https +filter = nginx-http-auth +logpath = /var/log/nginx/error.log +maxretry = 3 +EOF' +sudo systemctl restart fail2ban +``` + +### 4. File Integrity Monitoring (AIDE) +```bash +sudo apt-get install -y aide 2>/dev/null || sudo yum install -y aide 2>/dev/null || true +sudo aideinit 2>/dev/null || sudo aide --init +sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db 2>/dev/null || true +``` + +### 5. Web Server Upload Hardening + +#### Apache (.htaccess) +```apache +