security

name	security
description	Guides implementation of security tools and exploit modules. Use this when working on shell_tools.py, exploit_tools.py, or any offensive security functionality.

Security Skill

Recon Phase

Always start with passive recon before active scanning:

1. whois, DNS enumeration
2. nmap port scan (-sV for version detection)
3. Service fingerprinting
4. CVE lookup based on discovered versions

Web Application Testing Order

1. Directory enumeration
2. Technology fingerprinting
3. SQLi testing (sqlmap)
4. XSS scanning
5. Path traversal checks
6. Auth bypass attempts

Sandbox Rule

ALL exploit code must run inside Docker sandbox:

# Never do this
subprocess.run(exploit_script)

# Always do this
docker_sandbox.run(exploit_script, session_id)

Finding Severity Levels

• critical: RCE, auth bypass, data exfiltration possible
• high: SQLi, significant data exposure
• medium: XSS, info disclosure
• low: Misconfigurations, version exposure

Kali Tool Preference

Prefer using the kali tool for all security commands. Examples:

• kali({"command": "nmap -sV -sC 127.0.0.1"})
• kali({"command": "nikto -h http://127.0.0.1"})
• kali({"command": "gobuster dir -u http://127.0.0.1 -w /usr/share/wordlists/dirb/common.txt"})