full-security-pentest

name	full-security-pentest
description	Comprehensive security penetration testing skill covering all attack surfaces - info gathering, web vulnerability scanning, SQL injection, XSS, directory bruteforce, Python code audit, git secret scanning, auth bypass, CSRF/SSRF, and configuration audit. Records all findings with severity ratings.
origin	custom

Full Security Penetration Testing Skill

Comprehensive, no-blind-spot security attack and assessment covering all attack vectors.

When to Activate

• Running a full security penetration test on a project
• Auditing an application for all known vulnerability classes
• Pre-release security assessment
• Authorized red team engagement

Attack Execution Order

Execute all phases sequentially. Each phase produces findings recorded in the report.

---

Phase 1: Information Gathering

Reconnaissance and service fingerprinting.

1A. Port Scanning (nmap)

# Quick scan - top 1000 ports
nmap -sV -sC -oN nmap-quick.txt <TARGET>

# Full port scan
nmap -p- -sV -oN nmap-full.txt <TARGET>

# Service version + OS detection
nmap -sV -O -A -oN nmap-detailed.txt <TARGET>

# Script scan for known vulns
nmap --script=vuln -oN nmap-vuln.txt <TARGET>

1B. Service Fingerprinting

# HTTP headers and tech stack
curl -I <TARGET_URL>

# Identify web technologies
httpx -u <TARGET_URL> -tech-detect -status-code -title -server 2>/dev/null || curl -sI <TARGET_URL>

1C. Subdomain & DNS Enumeration

# Subfinder (if installed)
subfinder -d <DOMAIN> -o subdomains.txt 2>/dev/null

# DNS records
nmap --script=dns-brute <DOMAIN>

---

Phase 2: Web Vulnerability Scanning

Automated scanning for known web vulnerabilities.

2A. Nuclei (Template-Based Scanner)

# Full scan with all templates
nuclei -u <TARGET_URL> -o nuclei-report.txt -severity critical,high,medium

# Specific template categories
nuclei -u <TARGET_URL> -tags cve,misconfig,exposure -o nuclei-cve.txt

# API-focused scan
nuclei -u <TARGET_URL> -tags api,token -o nuclei-api.txt

2B. Nikto (Web Server Scanner)

# Standard scan
nikto -h <TARGET_URL> -o nikto-report.txt -Format txt

# Scan with tuning for specific tests
nikto -h <TARGET_URL> -Tuning 1234567890 -o nikto-full.txt

---

Phase 3: SQL Injection Testing

3A. Automated Detection (sqlmap)

# Test a URL with GET parameter
sqlmap -u "<TARGET_URL>?param=value" --batch --banner --level=3 --risk=2

# Test POST form
sqlmap -u "<TARGET_URL>" --data="param1=value1&param2=value2" --batch --banner

# Test with specific cookie/header
sqlmap -u "<TARGET_URL>" --cookie="session=xxx" --batch --banner

# Dump database info (only if authorized)
sqlmap -u "<TARGET_URL>?param=value" --batch --dbs

3B. Manual SQL Injection Checks

Test these payloads manually on all input fields:

' OR '1'='1
" OR "1"="1
' OR '1'='1' --
' UNION SELECT NULL--
' AND 1=CONVERT(int,@@version)--
1; WAITFOR DELAY '0:0:5'--

Record which inputs are vulnerable and which are properly sanitized.

---

Phase 4: XSS Testing

4A. Reflected XSS

Test all URL parameters and form inputs:

<script>alert('XSS')</script>
"><script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
javascript:alert('XSS')
<svg/onload=alert('XSS')>

4B. Stored XSS

Test all user-input fields that persist data:

• Profile fields (name, bio, etc.)
• Comments / reviews
• Product descriptions (seller side)
• Messages / chat

4C. DOM-Based XSS

# Search for dangerous sinks in code
grep -rn "innerHTML\|outerHTML\|document\.write\|eval(" <REPO_PATH> --include="*.js" --include="*.ts" --include="*.html"

# Search for unsanitized template usage
grep -rn "dangerouslySetInnerHTML\|v-html\|\|safe\|mark_safe\|Markup(" <REPO_PATH> --include="*.py" --include="*.js" --include="*.html"

---

Phase 5: Directory Brute Force

5A. ffuf

# Directory discovery
ffuf -w /opt/homebrew/share/wordlists/dirb/common.txt -u <TARGET_URL>/FUZZ -mc 200,301,302,403 -o ffuf-dirs.json

# File discovery
ffuf -w /opt/homebrew/share/wordlists/dirb/common.txt -u <TARGET_URL>/FUZZ -e .php,.py,.js,.env,.bak,.sql,.conf,.yml,.json -mc 200,301,302,403

# Virtual host discovery
ffuf -w <WORDLIST> -u <TARGET_URL> -H "Host: FUZZ.<DOMAIN>" -mc 200

5B. Sensitive File Discovery

# Check for common exposed files
for f in .env .env.local .env.production .git/config .git/HEAD robots.txt sitemap.xml .htaccess web.config package.json composer.json debug.log error.log; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "<TARGET_URL>/$f")
  echo "$f -> $code"
done

---

Phase 6: Python Code Security Audit

6A. Bandit (Static Analysis)

# Full scan
bandit -r <REPO_PATH> -f json -o bandit-report.json

# High severity only
bandit -r <REPO_PATH> -ll -f json -o bandit-high.json

# Specific checks
bandit -r <REPO_PATH> -t B101,B102,B103,B104,B105,B106,B107,B108,B110

6B. Manual Code Audit Checklist

# Hardcoded credentials
grep -rn "password\s*=\s*['\"]" <REPO_PATH> --include="*.py"

# Dangerous eval/exec
grep -rn "eval(\|exec(\|__import__\|subprocess\.call\|os\.system\|os\.popen" <REPO_PATH> --include="*.py"

# Insecure deserialization
grep -rn "pickle\.load\|yaml\.load\|marshal\.load" <REPO_PATH> --include="*.py"

# SQL string concatenation (injection risk)
grep -rn "execute.*%s\|execute.*format\|execute.*f'" <REPO_PATH> --include="*.py"

# Debug mode in production
grep -rn "DEBUG\s*=\s*True\|debug=True\|FLASK_DEBUG\|DJANGO_DEBUG" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml"

---

Phase 7: Git History Secret Scanning

# Gitleaks full history scan
gitleaks detect --source=<REPO_PATH> --report-format=json --report-path=gitleaks-report.json -v

# TruffleHog deep scan
trufflehog filesystem <REPO_PATH> --json > trufflehog-report.json

# Check for large files that shouldn't be in git
find <REPO_PATH> -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.pfx" -o -name "*.jks" -o -name "id_rsa*" -o -name "*.sqlite" -o -name "*.db" 2>/dev/null

# Check .gitignore coverage
cat <REPO_PATH>/.gitignore 2>/dev/null
# Verify .env, secrets, keys are listed

---

Phase 8: Authentication & Authorization Bypass

8A. Authentication Testing

# Test endpoints without auth
curl -v <TARGET_URL>/api/protected-endpoint

# Test with invalid token
curl -H "Authorization: Bearer invalid" <TARGET_URL>/api/protected-endpoint

# Test with empty auth
curl -H "Authorization: " <TARGET_URL>/api/protected-endpoint

# JWT manipulation (if applicable)
# Decode JWT, modify claims, re-encode with none algorithm

8B. Authorization Testing (IDOR)

# Test accessing other users' resources by ID manipulation
# /api/users/1/profile → try /api/users/2/profile
# /api/orders/100 → try /api/orders/101

# Test role escalation
# User role accessing admin endpoints
# Buyer accessing seller endpoints
# Seller accessing admin endpoints

8C. Code Audit for Auth Issues

# Missing auth decorators
grep -rn "def \w\+.*request" <REPO_PATH> --include="*.py" | head -30
grep -rn "@login_required\|@authenticated\|@requires_auth\|@permission" <REPO_PATH> --include="*.py"

# Compare: endpoints defined vs endpoints protected
grep -rn "@app\.route\|@router\.\|path(" <REPO_PATH> --include="*.py" -l

---

Phase 9: CSRF / SSRF Detection

9A. CSRF Testing

# Check for CSRF token in forms
grep -rn "csrf\|csrftoken\|_token\|authenticity_token" <REPO_PATH> --include="*.py" --include="*.html" --include="*.js"

# Check CSRF middleware
grep -rn "CsrfViewMiddleware\|csrf_protect\|csrf_exempt\|@csrf_exempt" <REPO_PATH> --include="*.py"

# State-changing endpoints without CSRF protection
grep -rn "methods.*POST\|methods.*PUT\|methods.*DELETE\|@csrf_exempt" <REPO_PATH> --include="*.py"

9B. SSRF Testing

# Find URL fetching code
grep -rn "requests\.get\|requests\.post\|urllib\|urlopen\|fetch\|http\.client\|aiohttp" <REPO_PATH> --include="*.py"

# Check if user input feeds into URL fetching
grep -rn "request\.\(args\|form\|json\|data\).*requests\.\|request\.\(args\|form\|json\|data\).*url" <REPO_PATH> --include="*.py"

---

Phase 10: Configuration Audit

# .env exposure
find <REPO_PATH> -name ".env" -o -name ".env.*" ! -name ".env.example" 2>/dev/null

# Debug mode
grep -rn "DEBUG\s*=\s*True\|debug\s*=\s*True\|FLASK_ENV.*development" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml" --include="*.yml"

# Default/weak credentials
grep -rn "admin.*password\|root.*password\|test.*password\|password.*123\|default.*key" <REPO_PATH> --include="*.py" --include="*.yaml" --include="*.env*" --include="*.json"

# Insecure HTTP
grep -rn "http://" <REPO_PATH> --include="*.py" --include="*.js" --include="*.env*" | grep -v "localhost\|127\.0\.0\.1\|http://schemas"

# Verbose error messages
grep -rn "traceback\|stack_trace\|full_traceback\|DEBUG.*True" <REPO_PATH> --include="*.py"

# Open CORS
grep -rn "Access-Control-Allow-Origin.*\*\|CORS_ALLOW_ALL\|allow_all_origins\|CORS.*True" <REPO_PATH> --include="*.py" --include="*.js"

# Security headers check
curl -sI <TARGET_URL> | grep -i "strict-transport\|x-content-type\|x-frame\|content-security-policy\|referrer-policy\|permissions-policy"

---

Finding Report Template

# Security Penetration Test Report

**Target**: [project name / URL]
**Date**: [YYYY-MM-DD]
**Tester**: Claude (Authorized Pentest)

## Executive Summary
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X

## Findings

### [FINDING-001] [SEVERITY] Title

- **Phase**: (which phase discovered this)
- **Category**: Secret Leak / SQLi / XSS / Auth Bypass / IDOR / CSRF / SSRF / Config / etc.
- **Severity**: CRITICAL / HIGH / MEDIUM / LOW
- **Location**: file:line or endpoint
- **Description**: What was found
- **Evidence**: Command output or code snippet
- **Impact**: What an attacker could exploit
- **Recommendation**: How to fix
- **CVSS (optional)**: Base score estimate

---

(repeat for each finding)

## Tools Used
- nmap, nikto, nuclei, sqlmap, ffuf, gitleaks, trufflehog, bandit, manual review

## Appendix
- Full scan outputs attached as separate files

Severity Classification

Severity	Criteria	Examples
CRITICAL	Immediate exploitation possible, data breach risk	Hardcoded API keys with admin access, unauthenticated admin endpoints, SQLi on prod DB
HIGH	Exploitable with some effort, significant impact	Secrets in git history, IDOR on sensitive data, privilege escalation
MEDIUM	Requires specific conditions, moderate impact	Missing rate limiting, CSRF on non-critical forms, verbose errors
LOW	Informational, minimal direct impact	HTTP used internally, missing security headers, debug endpoints on non-prod

Output Directory

All reports saved to docs/security/:

• nmap-*.txt — network scan results
• nuclei-report.txt — vulnerability scan
• nikto-report.txt — web server scan
• sqlmap-*.txt — SQL injection results
• ffuf-dirs.json — directory brute force
• bandit-report.json — Python code audit
• gitleaks-report.json — git secret scan
• trufflehog-report.json — deep secret scan
• pentest-report.md — consolidated findings report