pentest-opsec-evidence

name	pentest-opsec-evidence
description	Operator OPSEC + evidence handling — operator identity hygiene, source IP design, burner infrastructure, evidence chain of custody, log retention advisory. Triggers on OPSEC, operator anonymity, source IP hygiene, burner infrastructure, evidence chain, chain of custody, log retention, attribution, fingerprint hygiene.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-opsec-evidence","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents opsec-anonymizer"}

pentest-opsec-evidence

Operator OPSEC + engagement evidence handling. Minimizing the operator's footprint on the target during a pentest + storing evidence at legal grade.

Triggers

• "assess OPSEC"
• "hide source IP"
• "burner infrastructure"
• "fingerprint hygiene"
• "evidence chain of custody"
• "log retention policy"

Operator Identity Hygiene

Source IP Design

1. Burner cloud VM (AWS / DO / Linode)
   - Account: pentest-firm name, real name (do not hide the legal account)
   - VM: single engagement, shut down at the end
   - Region: pick a region the client can observe

2. Residential proxy (selective use)
   - Use without legal authorization is wrong (even Tor carries attribution potential)
   - For testing within a bug bounty / authorized engagement

3. Bastion + jump host
   - Operator <-> Bastion (own) <-> Cloud VM <-> target
   - Bastion log: timestamp + command + operator

Browser/HTTP Fingerprint Hygiene

# Burp / proxy config
- User-Agent: realistic, version-current
- Accept-Language: target locale
- JA3 fingerprint: common browser (Chrome 119 default)

# Tool customization
nmap --max-rate 100 --randomize-hosts
curl -A "Mozilla/5.0 (compatible)" --resolve ...

DNS / SNI Hygiene

# DNS over HTTPS (DoH)
# When making DNS queries toward the target, use 1.1.1.1 DoH instead of your own ISP DNS

# SNI: cloudfront / cloudflare cover behind
# (for authorized use only — within a legal framework)

Tooling Footprint

Tool	Default Footprint	Stealthy Alternative
nmap (default)	-sC -sV LOUD	-sT -sV --top-ports 100 --max-rate 100
sqlmap (default)	Many requests, banner	--random-agent --delay 2 --threads 1
BloodHound (default)	Mass LDAP	--throttle 30 --jitter 20
ffuf	1000 req/s	-t 5 -p 1
nuclei	All templates	-tags sqli,xss only

Burner Infrastructure

Per engagement:
1. Set up a VM (cloud / your own VPS)
2. Separate SSH key pair (engagement-specific)
3. Tooling stack install (Kali Light / Parrot)
4. Engagement end: snapshot + destroy
5. Snapshot: encrypted (BitLocker / VeraCrypt) cold storage

Persistent:
- Bug bounty researcher: dedicated workstation (1)
- Pentest firm: per-customer VM template
- Red team operator: 3 tiers (recon/exploit/post-ex isolated)

Evidence Chain of Custody

To store forensic-grade evidence:

# Evidence Log Entry

## EVIDENCE ID: EVD-2026-05-15-001
**Engagement**: ACME Corp Pentest 2026 Q2
**Acquired**: 2026-05-15 14:23:01 UTC
**Acquired by**: <analyst name>, <analyst signature/badge>
**From**: ACME-WEB-PROD-01 (192.168.50.10) — authorized via Letter of Auth
**Tool**: nmap 7.93 — `nmap -sV --top-ports 1000 ...`
**File**: evidence/nmap_acme-web-prod-01_20260515_142301.xml
**Size**: 12,432 bytes
**SHA-256**: abc123def456...

## Chain
- 2026-05-15 14:23 — Acquired by <analyst>
- 2026-05-15 14:25 — Hashed + signed (SHA-256 + GPG)
- 2026-05-15 18:00 — Transferred to encrypted vault (LUKS)
- 2026-05-15 18:01 — Hash re-verified (matches)
- 2026-05-22 09:00 — Used in report writing (read-only)
- 2026-06-15 12:00 — Engagement closeout, vault sealed
- 2027-05-15 — Scheduled destruction (retention 1 year)

Log Retention Policy

| Type | Retention | Encryption | Format |
|-----|-----------|------------|--------|
| Raw tool output | Engagement + 1 year | At rest + GPG | Original (xml, json, txt) |
| Screen recording | Engagement + 1 year | At rest | mp4 |
| HAR file (browser) | Engagement + 1 year | At rest | har.gz |
| Command history | Engagement + 1 year | At rest | shell history |
| Sensitive data (PII evidence) | Engagement + 30 days | Strong + 2FA | Encrypted, restricted |
| Cred-related | Engagement + 7 days | Strong | hashed, never plain |

Engagement Closeout Checklist

- [ ] Hash check of all evidence files
- [ ] Transfer to the encrypted vault
- [ ] Burner VM snapshot + destroy
- [ ] Source IP whitelist removed by the client
- [ ] VPN config destroyed
- [ ] Engagement-specific SSH key destroyed
- [ ] Tools cache cleared (~/.cache/, ~/.local/share/sqlmap, ...)
- [ ] Browser history / Burp project cleared
- [ ] Client communications archived
- [ ] Retention timer started

Anti-Attribution (Authorized Engagement)

- Tool default banner suppression (nmap --send-eth)
- HTTP User-Agent normalization
- Time-zone alignment (operator TZ != server log TZ pattern)
- Username convention (no "admin", "root" account)
- File timestamp normalization (touch -t after copy)
- No persistent-identity guarantee (single engagement)

Out-of-Scope

• Unauthorized false-flag operation
• Identity creation for non-pentest purpose
• Privacy-coin / cryptocurrency mixing (not in scope)
• Deliberately misattributing to a third party (hard refusal)