Find Writeups

Description

This tool can be used to find Writeups using a provided filter expression.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_writeups and click Add

Example Prompts

Show me my Writeups in the 'Main' library. Include custom fields in the response.

Supported Query Fields

id: {
  type: 'string',
  pattern: "ObjectId\\(\\'[0-9a-fA-F]{24}\\'\\)",
}
created: {
  type: 'string',
  pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
  description: 'The timestamp that this vulnerability was created.'
}
modified: {
  type: 'string',
  pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
  description: 'The timestamp that this vulnerability was last modified.'
}
attack_scenario: {
  type: 'string',
}
description: {
  type: 'string',
}
impact_on_availability: {
  enum: [
    'High',
    'Medium',
    'Low',
    'None',
  ]
}
impact_on_confidentiality: {
  enum: [
    'High',
    'Medium',
    'Low',
    'None',
  ]
}
impact_on_integrity: {
  enum: [
    'High',
    'Medium',
    'Low',
    'None',
  ]
}
import_source_id: {
  type: 'string'
}
import_source: {
  type: 'string'
}
likelihood_of_exploitation: {
  description: 'Scale of exploitability, 1 is least and 10 is most',
  enum: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
}
remediation_recommendation: {
  type: 'string'
}
severity: {
  description: '1 is least severe and 10 is most severe',
  enum: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
}
title: {
  type: 'string',
}
tags: {
  type: 'array',
  items: { type: 'string' }
}
custom_tags: {
  type: 'array',
  items: {
    type: 'object',
    properties: {
      name: { type: 'string' },
      value: { type: 'string' }
    },
    required: ['name', 'value'],
    additionalProperties: false
  }
}
custom_fields: {
  type: 'array',
  items: {
    type: 'object',
    properties: {
      key: {
        type: 'string',
        pattern: '^[a-zA-Z]([a-zA-Z0-9_]*[a-zA-Z0-9])?$',
      },
      value: {
        oneOf: [
          {
            type: 'string',
          },
          {
            type: 'array',
          },
        ]
      }
    },
    required: ['key', 'value'],
    additionalProperties: false
}

Example Response

{
    "data":
    [
        {
            "id": "5ad737feccb39f330a8ef316",
            "created": "2018-04-18T12:20:14.784Z",
            "modified": "2025-06-23T19:43:59.724Z",
            "attack_scenario": "<p>XSS injection attack is a well-documented attack with a number of automated tools available to facilitate discovery, exploitation and post-exploitation control processes. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some XSS vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running 'Active X' controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content. An attack against the larger user base of the application may result in successful compromise of users computers and potential infection with malware that would effectively allow further compromise of users data.</p><p>{{{xss.png}}}</p><p></p>",
            "description": "<h2>Cross Site Scripting</h2><p>Cross-site scripting (XSS) vulnerability occurs when data submitted to the application is not properly handled before being embedded within the applications response or stored for later retrieval.</p><h2>Reflected cross-site scripting</h2><p>Reflected cross-site scripting (XSS) occurs when a server receives data directly from a HTTP request and returns (or reflects) it back in the HTTP response. In a typical XSS attack scenario, exploitation takes place when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.</p><p><strong><u>The most common mechanism for delivering malicious content</u></strong> is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.</p><p><strong><u>The most common attack</u></strong> performed with XSS involves the disclosure of session or other sensitive information stored in user cookies. Typically, a malicious user will craft a client-side script, which when parsed by a web browser performs some activity (such as sending all site cookies to a given e-mail address). This script will be loaded and run by each user visiting the vulnerable component of the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also. For example, an attacker could redirect users to malicious web sites.</p><p>More sophisticated attacks may extend to, for example, an attacker using advanced XSS exploitation tools like the Browser Exploitation Framework (BeEF).</p>",
            "impact_on_availability": "None",
            "impact_on_confidentiality": "None",
            "impact_on_integrity": "None",
            "likelihood_of_exploitation": 6,
            "remediation_recommendation": "<p>To prevent XSS attacks a multi-layered approach is recommended. </p><ul><li>Input received from the client should be strictly validated on the server side before any further processing takes place. </li><li>The filter should use a White List approach by only accepting Known Good characters. </li><li>Validation should be performed on a per field basis and should endeavour to be as strict as possible. </li><li>Ensure that data is fully normalised and decoded before being compared to the filter. </li><li>All client supplied data should be HMTL encoded at the point where it is displayed to the user. This includes request data such as query string parameters and data retrieved from storage. </li><li>It is recommended that all alphanumeric characters be HTML encoded to avoid XSS. However the following characters must be encoded: double quotes, ampersand, less than sign, and greater than sign</li></ul>",
            "severity": 6,
            "title": "Reflected Cross Site Scripting",
            "tags":
            [
                "OWASP Top 10",
                "CWE Top 25",
                "CWE-79: Improper Neutralisation of Input During Web Page Generation ('Cross-site Scripting')",
                "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:T/RC:R/CR:M/IR:M/AR:M/MAV:A/MAC:H/MPR:L/MUI:R/MS:C/MC:L/MI:L/MA:H",
                "CVSSv3.1 Base Score: 7.6",
                "CVSSv3.1 Temporal Score: 6.6",
                "CVSSv3.1 Environmental Score: 5.9"
            ],
            "custom_tags":
            [],
            "custom_fields":
            [
                {
                    "key": "af_sys_steps_to_reproduce",
                    "value": "<ol><li>do this.</li><li>do that.</li></ol><pre class=\"ql-syntax\" spellcheck=\"false\">&lt;script&gt;alert(1)&lt;/script&gt;\n</pre><p>Observe arbitrary script is executed in the victim's browser.</p>",
                    "label": "Templates Steps to Reproduce (POC)"
                }
            ]
        }
    ],
    "count": 1,
    "total": 1
}