> For the complete documentation index, see [llms.txt](https://support.attackforge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.attackforge.com/app/modules/ai-mcp-and-skills/find-writeups.md). # Find Writeups #### Description This tool can be used to find Writeups using a provided filter expression. #### How To Enable 1. Go to `Users` 2. Select the user you would like to provide access to this tool 3. Click on `Access > MCP` 4. Click on `Add Tools` 5. Select the tool `find_writeups` and click `Add` #### Example Prompts ``` Show me my Writeups in the 'Main' library. Include custom fields in the response. ``` #### Supported Query Fields {% code overflow="wrap" %} ```javascript id: { type: 'string', pattern: "ObjectId\\(\\'[0-9a-fA-F]{24}\\'\\)", } created: { type: 'string', pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$', description: 'The timestamp that this vulnerability was created.' } modified: { type: 'string', pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$', description: 'The timestamp that this vulnerability was last modified.' } attack_scenario: { type: 'string', } description: { type: 'string', } impact_on_availability: { enum: [ 'High', 'Medium', 'Low', 'None', ] } impact_on_confidentiality: { enum: [ 'High', 'Medium', 'Low', 'None', ] } impact_on_integrity: { enum: [ 'High', 'Medium', 'Low', 'None', ] } import_source_id: { type: 'string' } import_source: { type: 'string' } likelihood_of_exploitation: { description: 'Scale of exploitability, 1 is least and 10 is most', enum: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] } remediation_recommendation: { type: 'string' } severity: { description: '1 is least severe and 10 is most severe', enum: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] } title: { type: 'string', } tags: { type: 'array', items: { type: 'string' } } custom_tags: { type: 'array', items: { type: 'object', properties: { name: { type: 'string' }, value: { type: 'string' } }, required: ['name', 'value'], additionalProperties: false } } custom_fields: { type: 'array', items: { type: 'object', properties: { key: { type: 'string', pattern: '^[a-zA-Z]([a-zA-Z0-9_]*[a-zA-Z0-9])?$', }, value: { oneOf: [ { type: 'string', }, { type: 'array', }, ] } }, required: ['key', 'value'], additionalProperties: false } ``` {% endcode %} #### Example Response {% code overflow="wrap" %} ```json { "data": [ { "id": "5ad737feccb39f330a8ef316", "created": "2018-04-18T12:20:14.784Z", "modified": "2025-06-23T19:43:59.724Z", "attack_scenario": "

XSS injection attack is a well-documented attack with a number of automated tools available to facilitate discovery, exploitation and post-exploitation control processes. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some XSS vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running 'Active X' controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content. An attack against the larger user base of the application may result in successful compromise of users computers and potential infection with malware that would effectively allow further compromise of users data.

{{{xss.png}}}

", "description": "

Cross Site Scripting

Cross-site scripting (XSS) vulnerability occurs when data submitted to the application is not properly handled before being embedded within the applications response or stored for later retrieval.

Reflected cross-site scripting

Reflected cross-site scripting (XSS) occurs when a server receives data directly from a HTTP request and returns (or reflects) it back in the HTTP response. In a typical XSS attack scenario, exploitation takes place when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.

The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.

The most common attack performed with XSS involves the disclosure of session or other sensitive information stored in user cookies. Typically, a malicious user will craft a client-side script, which when parsed by a web browser performs some activity (such as sending all site cookies to a given e-mail address). This script will be loaded and run by each user visiting the vulnerable component of the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also. For example, an attacker could redirect users to malicious web sites.

More sophisticated attacks may extend to, for example, an attacker using advanced XSS exploitation tools like the Browser Exploitation Framework (BeEF).

", "impact_on_availability": "None", "impact_on_confidentiality": "None", "impact_on_integrity": "None", "likelihood_of_exploitation": 6, "remediation_recommendation": "

To prevent XSS attacks a multi-layered approach is recommended.

", "severity": 6, "title": "Reflected Cross Site Scripting", "tags": [ "OWASP Top 10", "CWE Top 25", "CWE-79: Improper Neutralisation of Input During Web Page Generation ('Cross-site Scripting')", "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:T/RC:R/CR:M/IR:M/AR:M/MAV:A/MAC:H/MPR:L/MUI:R/MS:C/MC:L/MI:L/MA:H", "CVSSv3.1 Base Score: 7.6", "CVSSv3.1 Temporal Score: 6.6", "CVSSv3.1 Environmental Score: 5.9" ], "custom_tags": [], "custom_fields": [ { "key": "af_sys_steps_to_reproduce", "value": "
  1. do this.
  2. do that.
<script>alert(1)</script>\n

Observe arbitrary script is executed in the victim's browser.

", "label": "Templates Steps to Reproduce (POC)" } ] } ], "count": 1, "total": 1 } ``` {% endcode %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://support.attackforge.com/app/modules/ai-mcp-and-skills/find-writeups.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.