PenKit51

Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.

Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.

Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.

API安全测试的专业技能和方法论

JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation

AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths

BFLA testing for action-level authorization failures across endpoints, admin functions, and API operations

agent-browser CLI for headless Chrome via shell. Snapshot-and-ref workflow, click/fill/extract, screenshots, multi-tab, multi-session, network mocking. Pre-installed in the sandbox; invoke via exec_command.

Business logic testing for workflow bypass, state manipulation, and domain invariant violations

云安全审计的专业技能和方法论

RCE testing covering command injection, deserialization, template injection, and code evaluation

容器安全测试的专业技能和方法论

CSRF testing covering token bypass, SameSite cookies, CORS misconfigurations, and state-changing request abuse

Exhaustive security assessment with maximum coverage, depth, and vulnerability chaining

Insecure deserialization testing for Java, Python, PHP, .NET, Ruby, and Node.js covering gadget chains, type confusion, and safe validation

Security testing playbook for Django applications covering ORM injection, middleware gaps, auth/session flaws, and template issues

Rules of engagement, scope definition, and authorized penetration test planning

Security testing playbook for FastAPI applications covering ASGI, dependency injection, and API vulnerabilities

ffuf fuzzing syntax with matcher/filter strategy and non-interactive defaults.

File upload security testing covering extension bypass, content-type manipulation, and path traversal

Firebase/Firestore security testing covering security rules, Cloud Functions, and client-side trust issues

GraphQL security testing covering introspection, resolver injection, batching attacks, and authorization bypass

HTTP header injection testing covering CRLF / response splitting, cache poisoning, Host-header confusion, cookie fixation, and proxy / forwarding header smuggling

HTTP request smuggling testing covering CL.TE, TE.CL, H2.CL, H2.TE, and HTTP/2 desync techniques with practical detection and exploitation methodology

ProjectDiscovery httpx probing syntax, exact probe flags, and automation-safe output patterns.

IDOR/BOLA testing for object-level authorization failures and cross-account data access

安全事件响应的专业技能和方法论

Information disclosure testing covering error messages, debug endpoints, metadata leakage, and source exposure

Katana crawler syntax, depth/js/known-files behavior, and stable concurrency controls.

Kubernetes cluster security testing - RBAC, API exposure, container escapes, network policies, secrets, and supply chain

LDAP注入漏洞测试的专业技能和方法论

Testing LLM-backed features for prompt injection, jailbreaks, system-prompt leakage, tool/agent abuse, and unsafe output handling

Mass assignment testing for unauthorized field binding and privilege escalation via API parameters

移动应用安全测试的专业技能和方法论

Naabu port-scanning syntax with host input, scan-type, verification, and rate controls.

Security testing playbook for NestJS applications covering guards, pipes, decorators, module boundaries, and multi-transport auth

网络渗透测试的专业技能和方法论

Security testing playbook for Next.js covering App Router, Server Actions, RSC, and Edge runtime vulnerabilities

Canonical Nmap CLI syntax, two-pass scanning workflow, and sandbox-safe bounded scan patterns.

NoSQL injection testing covering MongoDB operator injection, authentication bypass, blind extraction, GraphQL variable injection, and Redis/DynamoDB/Elasticsearch/Neo4j-specific attack surfaces