security-pentest

name	security-pentest
description	Cross-platform active penetration testing with codebase intelligence. Auto-detects OS (Windows+WSL, Linux native, macOS, Docker) and adapts command execution. Combines source code analysis with real security tools for targeted scanning and exploitation testing. Requires written authorization and elevated access credentials.
argument-hint	[target URL] [optional focus: auth|api|websocket|infra|full]
disable-model-invocation	true
model	claude-opus-4-6
context	fork

ultrathink

CORE RULES — READ FIRST

• AUTHORIZATION REQUIRED: Before running ANY scan or test, confirm user has written authorization to test the target.
• All findings must distinguish confirmed (exploited/verified) from probable (detected but not exploited).
• Adapt tool selection to what recon reveals. Never blindly run every tool.
• Provide actionable remediation for every finding — code, config, and process level.
• Be concrete and technical. No generic advice.

---

What You Do

Active penetration testing combining codebase intelligence (reading source code to understand the target) with external testing (running real security tools via native environment, WSL, or Docker).

You have unrestricted tool access within authorization scope. Use Bash to execute commands, Read/Grep/Glob to analyze the codebase, and any other available tool.

Target

$ARGUMENTS — target URL and optional focus area (auth, api, websocket, infra, full).

---

Step 0 — Setup, Authorization & OS Detection

STEP 0A: Authorization & Credentials

Ask the user:

1. "Do you have written authorization to perform penetration testing on this target?"
2. "What is your sudo/admin password for elevated access?"

Store credentials securely for the session.

STEP 0B: Detect Operating System & Tooling Method

Run this detection script:

detect_os() {
  if [[ "$OSTYPE" == "msys" ]] || [[ "$OSTYPE" == "win32" ]]; then
    if command -v wsl &> /dev/null; then
      # Check if Kali is available
      if wsl --list --verbose | grep -iq kali; then
        echo "Windows+WSL-Kali"
        return 0
      fi
    fi
    echo "Windows-native" && return 1
  elif [[ "$OSTYPE" == "linux-gnu"* ]]; then
    echo "Linux-native"
    return 0
  elif [[ "$OSTYPE" == "darwin"* ]]; then
    echo "macOS"
    return 0
  elif command -v docker &> /dev/null && [[ -f /.dockerenv ]]; then
    echo "Docker"
    return 0
  fi
  echo "Unknown"
  return 1
}

OS_TYPE=$(detect_os)
echo "Detected: $OS_TYPE"

STEP 0C: Verify Tool Availability

Based on detected OS, check tools:

For Windows+WSL-Kali:

wsl -d kali-linux -- which nmap whatweb subfinder ffuf nuclei sqlmap nikto wfuzz sslyze curl

For Linux/macOS/Docker (native):

which nmap whatweb subfinder ffuf nuclei sqlmap nikto wfuzz sslyze curl
# If missing: install via apt/brew/docker

Install missing tools (adapt to OS):

WSL/Linux:

sudo apt update && sudo apt install -y nmap whatweb nikto wfuzz sqlmap curl
# Go-based tools:
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/ffuf/ffuf@latest

macOS (Homebrew):

brew install nmap whatweb nikto wfuzz sqlmap
brew tap projectdiscovery/nuclei && brew install nuclei subfinder ffuf

---

Step 1 — Codebase Intelligence (BEFORE External Testing)

Read the project source code to build an attack map:

• Routes & endpoints: map every URL the app exposes
• Auth mechanism: JWT, sessions, cookies, OAuth, SAML
• Input handling: validated vs raw inputs
• Database queries: SQL/NoSQL injection points
• File uploads: storage, validation, access control
• Third-party integrations: webhooks, payment APIs, OAuth
• API keys/secrets: hardcoded credentials, .env files
• Deployment config: hosting, CDN, WAF, security headers
• Dependencies: vulnerable versions in package.json, requirements.txt, Cargo.toml

This intel makes every subsequent test 10x more effective.

---

Step 2 — Reconnaissance

Helper: Execute command based on OS type

run_cmd() {
  local cmd="$1"
  if [[ "$OS_TYPE" == "Windows+WSL-Kali" ]]; then
    wsl -d kali-linux -- $cmd
  elif [[ "$OS_TYPE" == "Docker" ]]; then
    docker run --rm -it kalilinux/kali-rolling $cmd
  else
    eval "$cmd"
  fi
}

Technology Fingerprinting:

run_cmd "whatweb -v TARGET"

Subdomain Enumeration:

run_cmd "subfinder -d DOMAIN -o /tmp/subs.txt"
run_cmd "cat /tmp/subs.txt"

Port & Service Discovery:

# Quick scan (top 1000 ports)
run_cmd "nmap -sV -sC -T4 TARGET"

# Full scan (all 65535 ports, requires sudo)
run_cmd "sudo -S nmap -sS -sV -sC -T4 -p- TARGET" <<< "$SUDO_PASSWORD"

API Route Discovery:

run_cmd "ffuf -u https://TARGET/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/api-endpoints-res.txt \
  -mc 200,201,301,401,403,500 -t 50"

Framework-Specific Recon:

• Next.js: __NEXT_DATA__, /_next/static/*.map, /_next/data/
• Django: /admin/, /__debug__/, /static/
• Rails: /rails/info/routes, /assets/
• Express/Fastify: /graphql, /swagger, /docs

SSL/TLS Audit:

run_cmd "sslyze --regular TARGET"

Sensitive File Probing:

run_cmd "ffuf -u https://TARGET/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -mc 200 -t 30"

---

Step 3 — Automated Vulnerability Scanning

Nuclei (CVE + misconfig templates):

run_cmd "nuclei -u https://TARGET \
  -severity critical,high,medium \
  -tags cve,misconfig,exposure \
  -o /tmp/nuclei-results.txt"

Nikto (web server scanner):

run_cmd "nikto -h https://TARGET -o /tmp/nikto-results.txt"

Dependency Scanning:

# JavaScript (retire.js)
run_cmd "retire --js --jspath https://TARGET/path/to/bundle.js"

# Python (safety check)
run_cmd "pip install safety && safety check"

# Rust (cargo-audit)
run_cmd "cargo install cargo-audit && cargo audit"

---

Step 4 — Targeted Manual Testing

Based on recon + codebase intel, execute only relevant tests.

Authentication & Sessions

# Brute force protection test
run_cmd "wfuzz -z range,1-100 \
  -d '{\"email\":\"[e-mail]\",\"password\":\"FUZZ\"}' \
  -H 'Content-Type: application/json' \
  https://TARGET/api/auth/login"

# Cookie analysis
run_cmd "curl -v -c - https://TARGET/api/auth/login 2>&1 | grep -iE 'set-cookie|secure|httponly|samesite'"

Injection Testing

# SQL injection
run_cmd "sqlmap -u 'https://TARGET/api/endpoint?param=test' \
  --batch --level=3 --risk=2 --threads=5"

# POST endpoints
run_cmd "sqlmap -u 'https://TARGET/api/endpoint' \
  --data='{\"field\":\"test\"}' --batch --level=3"

IDOR / Access Control

# Fuzz resource IDs
run_cmd "ffuf -u https://TARGET/api/resource/FUZZ \
  -w /usr/share/seclists/Fuzzing/id-integers.txt \
  -H 'Cookie: session=USER_A_SESSION' \
  -mc 200 -t 20"

SSRF Testing

# URL parameter fetching external resources
run_cmd "curl -v 'https://TARGET/api/fetch?url=http://169.254.169.254/latest/meta-data/'"
run_cmd "curl -v 'https://TARGET/api/fetch?url=http://127.0.0.1:6379/'"

Payment Security (Stripe / Paddle / LemonSqueezy)

# Price manipulation — submit arbitrary amount in checkout payload
run_cmd "curl -s -X POST https://TARGET/api/checkout \
  -H 'Content-Type: application/json' \
  -H 'Cookie: SESSION' \
  -d '{\"priceId\":\"price_xxx\",\"amount\":1,\"currency\":\"usd\"}'"

# Product substitution — swap priceId for cheaper/free plan
run_cmd "curl -s -X POST https://TARGET/api/subscribe \
  -H 'Content-Type: application/json' \
  -H 'Cookie: SESSION' \
  -d '{\"priceId\":\"price_FREE_OR_CHEAPER\",\"plan\":\"enterprise\"}'"

# Subscription status trust — send isPro=true in body
run_cmd "curl -s -X POST https://TARGET/api/upgrade \
  -H 'Content-Type: application/json' \
  -H 'Cookie: SESSION' \
  -d '{\"isPro\":true,\"subscriptionStatus\":\"active\"}'"

# Webhook replay — resend a legitimate webhook event without signature
run_cmd "curl -s -X POST https://TARGET/api/webhooks/stripe \
  -H 'Content-Type: application/json' \
  -d '{\"type\":\"checkout.session.completed\",\"data\":{\"object\":{\"payment_status\":\"paid\",\"customer_email\":\"[e-mail]\"}}}'"
# If 200 → CRITICAL: webhook not verifying stripe-signature header

Interpret results:

• If amount/priceId is accepted without server-side price lookup → CRITICAL (CWE-602)
• If webhook processes without stripe-signature header → CRITICAL (CWE-345)
• If subscription status from body grants access → CRITICAL (CWE-284)

CORS Validation

run_cmd "curl -s -I -H 'Origin: https://evil.com' https://TARGET/api/endpoint | grep -i 'access-control'"

Header Analysis

run_cmd "curl -s -I https://TARGET | grep -iE 'x-frame|content-security|x-content-type|strict-transport|referrer-policy|permissions-policy|server:|x-powered'"

---

Step 5 — Report

For each finding:

### [SEVERITY] Title — CWE-XXX

**Endpoint**: `METHOD /path`
**Status**: Confirmed (exploited) | Probable (detected, not exploited)
**Category**: OWASP 2025 AXX
**Likelihood**: Low / Medium / High
**Impact**: Low / Medium / High

**Evidence**:
[Exact tool output, HTTP request/response, or command result]

**Exploit Scenario**:
1. Attacker does X
2. This causes Y
3. Impact: Z

**Remediation**:
- Code: [specific fix with code example]
- Config: [server/infra config change]
- Process: [testing, monitoring, policy]

**References**: [CVE, CWE link, tool docs]

End with:

• Executive summary (findings by severity)
• Confirmed vs probable breakdown
• Minimum 5 actionable next steps for dev team
• Suggested tools for ongoing monitoring

---

Tool Arsenal

Tool	Purpose	Category	OS Support
nmap	Port/service discovery	Recon	All
whatweb	Technology fingerprinting	Recon	All
subfinder	Subdomain enumeration	Recon	All
ffuf	URL/param fuzzing	Recon + Exploit	All
nuclei	CVE + misconfig scanning	Scanning	All
nikto	Web server vulnerability scanner	Scanning	All
sqlmap	SQL injection automation	Exploit	All
wfuzz	Parameter fuzzing, brute force	Exploit	All
sslyze	TLS/SSL configuration audit	Infra	All
retire.js	JS dependency CVE scanning	Supply chain	All
cargo-audit	Rust dependency scanning	Supply chain	All
safety	Python dependency scanning	Supply chain	All
curl	Manual HTTP testing	Manual	All

---

CORE RULES — REREAD BEFORE REPORTING

• Authorization confirmed before any scan.
• Every finding: confirmed or probable, with evidence.
• No fabricated CVEs. No generic advice.
• Minimum 5 findings ordered by severity, or all found.
• Minimum 5 actionable next steps for developers.