pentest-engagement

name	pentest-engagement
description	Penetration testing engagement planning — scoping, ROE drafting, phased timeline, MITRE ATT&CK mapping, kickoff/closeout dokumantasyonu. Triggers on engagement plan, ROE, rules of engagement, scoping, pentest plan, phased plan, MITRE mapping, attack matrix, kickoff, closeout.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents engagement-planner"}

pentest-engagement

Yetkili penetration testing engagement'i icin planning + scoping + ROE dokumantasyonu uretir.

Triggers

• "pentest plan hazirla"
• "ROE taslagi cikar"
• "scoping document"
• "engagement timeline"
• "MITRE ATT&CK matrix"
• "kickoff meeting agenda"
• "closeout rapor sablonu"

Deliverable'lar

1. Scope Document (in-scope, out-of-scope, kisitlar)
2. Rules of Engagement (ROE) (yasak teknikler, calisma saatleri, escalation path)
3. Phased Timeline (kickoff -> recon -> exploit -> post-ex -> reporting -> closeout)
4. MITRE ATT&CK Mapping (her faza karsilik gelen Tactic + Technique listesi)
5. Communication Plan (musteri contact, escalation contact, incident response)
6. Acceptance Criteria (kapsanan testler, raporlama, deliverable listesi)

Scope Document Sablonu

# Engagement Scope — <Musteri>

## In-Scope
- IP Ranges: 10.0.0.0/16, 192.168.50.0/24
- Domains: *.example.com, app.example.com
- Cloud Accounts: AWS 123456789012 (production us-east-1)
- Test Tipi: External / Internal / Web App / Cloud / Red Team

## Out-of-Scope
- Production DB direct query
- Email/Phishing musteri calisani
- DoS / stress testing
- 3. taraf SaaS (Stripe, SendGrid, vb.)

## Restrictions
- Calisma saatleri: Hafta ici 09:00-17:00 (TR)
- Aggressive scan: Sadece kullanici onayli pencerede
- Data exfil: Yok — sadece kanit dosyasi (max 1MB)

## Authorization
- Letter of authorization: <link>
- Musteri imza: <isim, tarih>
- Pentest firma imza: <isim, tarih>

Phased Plan Sablonu (5 Phase)

Faz	Sure	Aktivite	MITRE Tactic
1. Recon	1-2 gun	OSINT, subdomain enum, port scan	TA0043 Reconnaissance
2. Initial Access	2-3 gun	Web app exploit, phishing sim, AD attack	TA0001 Initial Access
3. Post-Exploit	3-4 gun	Privesc, lateral, persistence, exfil sim	TA0004/TA0008/TA0003/TA0010
4. Detection	1-2 gun	SIEM/EDR coverage gap	TA0042 Resource Development (defansif)
5. Report	2-3 gun	Bulgu yazimi, CVSS, remediation, debrief	—

MITRE ATT&CK Mapping

Her bulgu icin minimum 1 ATT&CK Technique ID belirt (T1059, T1078, vb.). Mapping:

finding: SQL Injection in /api/users
mitre:
  tactic: TA0001 (Initial Access)
  techniques:
    - T1190 (Exploit Public-Facing Application)
detection:
  - Sigma rule: web/sql_injection.yml
remediation:
  priority: P0
  effort: 8h

Kickoff Meeting Agenda (1 saat)

1. Scope review + signoff (10 dk)
2. ROE walkthrough + restrictions (15 dk)
3. Communication channel + escalation (10 dk)
4. Asset inventory hand-off (15 dk)
5. Q&A + ilk gun planning (10 dk)

Closeout Meeting Agenda (1.5 saat)

1. Executive summary (10 dk)
2. Top 3 critical finding walkthrough (30 dk)
3. Remediation roadmap (20 dk)
4. Detection rule hand-off (15 dk)
5. Lessons learned (15 dk)

Cikti Konumu

Engagement basinda olustur:

engagements/<musteri>-<yyyymmdd>/
  scope.md
  roe.md
  timeline.md
  mitre-mapping.yml
  contacts.md

Out-of-Scope (Bu Skill Yapmaz)

• Live komut composer'lama (pentest-recon, pentest-web vb. yapar)
• Exploit guide uretmek (pentest-exploit-chain yapar)
• Rapor yazma (pentest-report yapar)

Bu skill sadece planning + scoping doc uretir.