| name | pentest-tools |
| description | Tool selection policy for BearStrike based on target type, scan risk, and signal strength. |
pentest-tools
Selection policy
- Domain recon: subfinder, amass, dnsenum, theharvester, xray-suite-subdomain, sublist3r.
- Live host and service map: nmap, masscan, rustscan, xray-suite-servicescan.
- Web surface: httpx, whatweb, ffuf, gobuster, dirsearch, katana, parsero.
- Dynamic web discovery: xray-suite-crawlergo and xray-suite-headless-browser.
- Vulnerability checks: nuclei, nikto, sqlmap, dalfox, commix, vulnx, xray-suite-webscan.
- WAF and defense checks: wafw00f.
- OSINT enrichment: sherlock, spiderfoot, sublist3r.
- CMS and stack specific: joomscan, whatweb.
- AD and enterprise recon: ldapdomaindump, enum4linux-ng, netexec.
- Proxy/manual logic-bug analysis: mitmproxy (mitmdump), zaproxy, zap-cli.
Execution guardrails
- Prefer passive or low-noise modes first.
- Use install checks before run.
- Capture stdout/stderr as evidence for reports.
- Read planning skill first.
- Read research-notes before running aggressive scans.
- Read xray-suite skill before any xray-suite-* run.
- If WAF or rate-limit signals appear, reduce speed and narrow scope.
Tool routing by hypothesis
Use tool selection based on question, not habit:
- "What is live?" -> httpx
- "What endpoints exist?" -> katana/gau/waybackurls/parsero
- "Where are hidden params?" -> arjun + gospider/hakrawler
- "Can we confirm low-noise vuln signals?" -> nuclei constrained templates
- "Do we need manual request/response mutation?" -> mitmdump or zap-cli session
- "Is this AD/enterprise asset?" -> ldapdomaindump + enum4linux-ng
Anti-timeout discipline
- Prefer async MCP job flow for long tools.
- Do not launch many heavy tools at once on the same host.
- Limit initial phase to 3-5 tools, then branch by evidence.
- If a tool is interactive (mitmproxy, GUI stacks), run it in a dedicated terminal.
- For MCP reliability, poll job_status and job_result instead of waiting on one long call.
