pentesting-checklist-usage

# PentestingChecklist Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. PentestingChecklist is a comprehensive, client-side security assessment tool providing structured checklists across 23 platforms including Web, API, Mobile, Cloud, Active Directory, Kubernetes, LLM, and more. It runs entirely in-browser with no backend—all progress, notes, and findings are stored locally in `localStorage`. ## What It Does - **Hierarchical assessment framework**: Platform → Category → Technology → Check (4-level structure) - **1000+ security checks** across 23 assessment platforms - **Progress tracking**: Mark checks as Open/Closed/N/A, add notes per check - **Global search**: Search across all platforms, checks, descriptions, tags, and references - **Export capabilities**: Markdown, CSV, Excel (.xlsx), JSON formats - **Severity filtering**: Critical, High, Medium, Low, Info badges - **Private by design**: No login, no backend, no telemetry—everything stays local ## Installation & Setup ### Using the Hosted Version Access directly at: **https://checklist.m14r41.in/** No installation required—runs entirely in your browser. ### Self-Hosting ```bash # Clone the repository git clone https://github.com/m14r41/PentestingChecklist.git cd PentestingChecklist # Install dependencies npm install # or pnpm install # Start development server npm run dev # or pnpm dev # Build for production npm run build # or pnpm build # Preview production build npm run preview ``` The application will be available at `http://localhost:5173` (dev) or as static files in `dist/` (production). ## Project Structure PentestingChecklist is built with TypeScript, React, and Vite. Key directories: ``` PentestingChecklist/ ├── src/ │ ├── components/ # React components │ ├── data/ # Checklist data (JSON/TS) │ ├── hooks/ # Custom React hooks │ ├── utils/ # Utility functions │ └── types/ # TypeScript type definitions ├── public/ # Static assets └── dist/ # Production build output ``` ## Understanding the Data Model The checklist uses a 4-level hierarchy: ```typescript // Core data structure interface Platform { id: string; name: string; description: string; categories: Category[]; } interface Category { id: string; name: string; technologies: Technology[]; } interface Technology { id: string; name: string; checks: Check[]; } interface Check { id: string; title: string; description: string; severity: 'critical' | 'high' | 'medium' | 'low' | 'info'; tags: string[]; tools?: string[]; references?: string[]; status?: 'open' | 'closed' | 'na'; notes?: string; } ``` ## Key Features & Usage ### 1. Navigation ```typescript // Platform pages are accessed via: // /platform/web-application // /platform/api // /platform/mobile // /platform/active-directory // etc. // All platforms view: // /checklist ``` ### 2. Global Search (⌘K / Ctrl+K) Press the keyboard shortcut from any page to open search: - Searches across platforms, categories, technologies, checks - Searches descriptions, tags, tools, and references - Auto-expands and highlights selected results ### 3. Progress Tracking Each check can be marked with a status: - **Open**: Finding identified, needs remediation - **Closed**: Check completed/passed or finding resolved - **N/A**: Not applicable to current assessment Progress is calculated automatically per category, platform, and globally. ### 4. Adding Notes Click any check to expand it and add notes: - Record payloads, request IDs, screenshots references - Document evidence and reproduction steps - Notes persist in browser localStorage - Notes are included in exports ### 5. Exporting Assessment Data ```typescript // Export formats available: // - Markdown (.md): Human-readable report // - CSV (.csv): Spreadsheet import // - Excel (.xlsx): Formatted spreadsheet with multiple sheets // - JSON (.json): Complete state for re-import // Export includes: // - Platform/category/technology/check hierarchy // - Check statuses (open/closed/na) // - Notes for each check // - Severity levels // - Tags and references ``` ### 6. Importing Previous Assessments Upload a previously exported JSON file to restore: - All check statuses - All notes - Progress tracking state ## Common Workflows ### Starting a New Assessment ```typescript // 1. Navigate to the relevant platform // Example: /platform/web-application // 2. Use filters to focus on priority areas // - Filter by severity: critical, high // - Expand relevant categories // 3. Work through checks systematically // - Mark checks as you complete them // - Add notes for findings // - Reference tools and techniques // 4. Export findings periodically // - JSON export for backup // - Markdown/Excel for reporting ``` ### Bug Bounty Workflow ```typescript // 1. Start with OSINT platform checks // /platform/osint // - Domain enumeration // - Exposed credentials // - Code leakage // 2. Move to Web Application checks // /platform/web-application // - Authentication bypass // - Authorization flaws // - Injection vulnerabilities // 3. API testing (if applicable) // /platform/api // - OWASP API Security Top 10 // - Object-level authorization // - Mass assignment // 4. Track all findings with notes // - Reproduction steps // - Affected endpoints // - Impact assessment // 5. Export findings for submission // - Markdown for bug reports // - CSV for tracking multiple findings ``` ### Red Team Engagement ```typescript // Multi-platform assessment approach: // Phase 1: Reconnaissance // /platform/osint // /platform/network // Phase 2: Initial Access // /platform/phishing // /platform/web-application // Phase 3: Lateral Movement // /platform/active-directory // /platform/infrastructure // Phase 4: Privilege Escalation // /platform/active-directory // /platform/cloud // Phase 5: Persistence & Exfiltration // /platform/infrastructure // /platform/cloud // Track progress across all platforms // Use global search to find relevant checks // Export comprehensive report at end ``` ### Cloud Security Assessment ```typescript // Navigate to cloud platform: // /platform/cloud // Key categories to review: // 1. IAM (Identity & Access Management) // - Overly permissive roles // - Root account usage // - MFA enforcement // 2. Storage Security // - Public S3 buckets // - Unencrypted storage // - Access logging // 3. Compute Security // - Instance metadata SSRF // - Security group misconfigs // - Unpatched instances // 4. Network Security // - VPC misconfigurations // - Exposed services // - Network segmentation // Also check: // /platform/containers-kubernetes (for EKS/AKS/GKE) // /platform/devops (for CI/CD pipelines) ``` ### Active Directory Assessment ```typescript // Navigate to AD platform: // /platform/active-directory // Systematic enumeration approach: // 1. Domain Enumeration // - User/group enumeration // - Trust relationships // - GPO analysis // 2. Kerberos Attacks // - Kerberoasting // - AS-REP Roasting // - Unconstrained delegation // 3. ACL Analysis // - GenericAll/GenericWrite abuse // - DCSync rights // - Ownership chains // 4. Lateral Movement // - Pass-the-hash // - Pass-the-ticket // - WMI/DCOM abuse // 5. Privilege Escalation // - Path to domain admin // - Golden/Silver tickets // - Credential dumping // Document attack paths in notes // Mark findings with appropriate severity ``` ## LocalStorage Structure Understanding data persistence for troubleshooting: ```typescript // Key structure in localStorage: // Check statuses: localStorage.setItem('checkStatus_<checkId>', 'open|closed|na'); // Check notes: localStorage.setItem('checkNotes_<checkId>', 'your notes here'); // To manually inspect: // Open browser DevTools → Application/Storage → Local Storage // Look for keys matching the patterns above // To clear all data (reset): // localStorage.clear(); // In browser console // or use the "Reset" button in the UI ``` ## Extending the Checklist To add custom checks or modify existing ones: ```typescript // 1. Locate the data files in src/data/ // Example: src/data/platforms/web-application.ts // 2. Add a new check to a technology: export const webApplicationPlatform: Platform = { id: 'web-application', name: 'Web Application', categories: [{ id: 'authentication', name: 'Authentication', technologies: [{ id: 'session-management', name: 'Session Management', checks: [ { id: 'custom-check-001', title: 'Check for session fixation', description: 'Verify that session tokens are regenerated after login', severity: 'high', tags: ['session', 'authentication'], tools: ['Burp Suite', 'OWASP ZAP'], references: [ 'OWASP Session Management Cheat Sheet' ] } ] }] }] }; // 3. Rebuild the application: // npm run build ``` ## Integration Examples ### Exporting to CI/CD ```typescript // Use the JSON export as a security gate template: // 1. Export baseline checklist as JSON // 2. In CI/CD pipeline, load and compare: import fs from 'fs'; interface ChecklistState { platform: string; checks: { id: string; status: 'open' | 'closed' | 'na'; notes?: string; }[]; } function validateSecurityChecks(checklistPath: string): boolean { const state: ChecklistState = JSON.parse( fs.readFileSync(checklistPath, 'utf-8') ); const criticalOpen = state.checks.filter( c => c.status === 'open' && c.severity === 'critical' ); if (criticalOpen.length > 0) { console.error(`❌ ${criticalOpen.length} critical findings still open`); return false; } return true; } // Usage in CI: // if (!validateSecurityChecks('./security-checklist.json')) { // process.exit(1); // } ``` ### Generating Custom Reports ```typescript // Process exported JSON to create custom reports: import fs from 'fs'; interface ExportedData { exportDate: string; platforms: { name: string; categories: { name: string; technologies: { name: string; checks: { title: string; status: string; severity: string; notes?: string; }[]; }[]; }[]; }[]; } function generateExecutiveSummary(jsonPath: string): string { const data: ExportedData = JSON.parse( fs.readFileSync(jsonPath, 'utf-8') ); let summary = '# Security Assessment Executive Summary\n\n'; summary += `Assessment Date: ${data.exportDate}\n\n`; let totalChecks = 0; let openFindings = 0; let criticalFindings = 0; data.platforms.forEach(platform => { platform.categories.forEach(category => { category.technologies.forEach(tech => { tech.checks.forEach(check => { totalChecks++; if (check.status === 'open') { openFindings++; if (check.severity === 'critical') { criticalFindings++; } } }); }); }); }); summary += `## Key Metrics\n`; summary += `- Total Checks Performed: ${totalChecks}\n`; summary += `- Open Findings: ${openFindings}\n`; summary += `- Critical Findings: ${criticalFindings}\n\n`; return summary; } // Usage: // const report = generateExecutiveSummary('./assessment-export.json'); // fs.writeFileSync('./executive-summary.md', report); ``` ## Troubleshooting ### Progress Not Saving ```typescript // Check localStorage availability: if (typeof localStorage === 'undefined') { console.error('localStorage not available'); } // Check for quota errors: try { localStorage.setItem('test', 'test'); localStorage.removeItem('test'); } catch (e) { console.error('localStorage quota exceeded or disabled'); } // Clear old data if needed: // Object.keys(localStorage)