File Operations

Cyberstrike provides specialized tools for file operations, optimized for security testing workflows.

📸 SCREENSHOT: file-operations.png

File operations tool output

Read Tool

Read file contents with line numbers.

Basic Usage

> Read the contents of src/auth/login.ts

Partial File Reading

> Read lines 50-100 of src/auth/login.ts

Multiple Files

> Read both config.json and package.json

Image Analysis

The Read tool can analyze images:

> Read the screenshot at ./evidence/vuln-poc.png

PDF Analysis

> Read the security report at ./reports/pentest.pdf

Write Tool

Create or overwrite files.

Create New File

> Write a Python script to exploit the SQL injection to exploit.py

Overwrite File

> Replace the contents of config.json with the secure configuration

Caution

Write tool overwrites existing files without warning. Use Edit for partial modifications.

Edit Tool

Make precise edits to existing files.

String Replacement

> Edit src/auth/login.ts to replace "SELECT * FROM users WHERE id = " + userId with parameterized query

Multi-line Edit

> Edit the vulnerable function in auth.ts to add input validation

Replace All

> Replace all instances of "http://" with "https://" in config files

Best Practices

Read the file first to understand context
Be specific about what to change
Include enough surrounding context for unique matches
Verify changes after editing

Glob Tool

Find files by pattern matching.

Basic Patterns

> Find all TypeScript files in the project

Pattern: **/*.ts

Multiple Extensions

> Find all JavaScript and TypeScript files

Pattern: **/*.{js,ts}

Specific Directories

> Find all config files in the src directory

Pattern: src/**/config.*

Common Patterns

Pattern	Matches
`*/.ts`	All TypeScript files
`src/*/.test.ts`	Test files in src
`**/package.json`	All package.json files
`*/.env`	Environment files
`*/secret`	Files with “secret” in name

Security Scanning Patterns

> Find files that might contain credentials

Patterns:
- **/*.env*
- **/secrets.*
- **/*credentials*
- **/*password*
- **/config.json

Grep Tool

Search file contents with regex.

Basic Search

> Search for "password" in all files

Regex Search

> Search for API key patterns in the codebase

Pattern: (api[_-]?key|apikey)\s*[:=]\s*['"][^'"]+['"]

Case Insensitive

> Search for "SELECT" case insensitively

File Type Filter

> Search for "eval(" only in JavaScript files

Context Lines

> Search for "TODO" with 2 lines of context before and after

Security-Focused Searches

Purpose	Pattern
SQL Injection	`(SELECT
Command Injection	`(exec
Hardcoded Secrets	`(password\|secret\|key)\s=\s['"][^'"]{8,}`
Unsafe Deserialization	`(pickle
XSS Sinks	`(innerHTML

File Analysis Workflow

1. Discover Files

> Find all files that might handle user input

2. Search for Patterns

> Search these files for SQL query construction

3. Read Suspicious Files

> Read the files that matched the SQL pattern

4. Document Findings

> Write a summary of the SQL injection findings to findings.md

Permission Considerations

File operations may require permission:

Operation	Default Behavior
Read	Allowed (read-only)
Glob	Allowed (read-only)
Grep	Allowed (read-only)
Write	Requires permission
Edit	Requires permission

Auto-approve Writes

For automation:

{
  "permissions": {
    "allow": [
      "Write(reports/**)",
      "Edit(findings/**)"
    ]
  }
}

Large File Handling

Pagination

For large files:

> Read the first 100 lines of large-log.txt
> Read lines 100-200 of large-log.txt

Binary Files

The Read tool handles binary files:

> Read the binary at ./malware.exe and analyze its strings

Integration with Security Testing

Code Review

> Analyze all authentication-related files for security issues

1. Find auth files: Glob **/*auth*.{ts,js}
2. Search for vulnerabilities: Grep patterns
3. Read and analyze matches
4. Document findings

Configuration Audit

> Review all configuration files for security misconfigurations

1. Find configs: Glob **/{config,settings}*.{json,yaml,yml}
2. Read each file
3. Check for sensitive data exposure
4. Verify secure defaults

Secret Detection

> Scan the codebase for hardcoded secrets

1. Glob all source files
2. Grep for secret patterns
3. Read matches for verification
4. Report findings

Tip

Combine Glob and Grep for efficient codebase scanning. Start broad, then narrow down.

Bash Tool - Command execution
Memory Tool - Storing findings
Permissions - File operation permissions