pentesting-checklist-guide

# Pentesting Checklist Guide > Skill by [ara.so](https://ara.so) — Security Skills collection. ## Overview PentestingChecklist is a comprehensive, interactive security assessment framework covering 23 platforms (Web, API, Mobile, Cloud, Active Directory, Kubernetes, LLM, and more) with over 1,000 security checks. Built in TypeScript with React, it runs entirely client-side with no backend—all data persists in browser localStorage. **Key capabilities:** - Hierarchical checklist structure: Platform → Category → Technology → Check - Global search across all checks, descriptions, tags, and references - Progress tracking with per-check status (Open/Closed/N/A) - Notes and findings capture - Export to Markdown, CSV, Excel, or JSON - Import/export for assessment portability **Live deployment:** https://checklist.m14r41.in/ ## Project Structure ``` src/ ├── data/ │ ├── platforms/ # 23 platform checklist definitions │ │ ├── web.ts │ │ ├── api.ts │ │ ├── mobile.ts │ │ ├── cloud.ts │ │ ├── active-directory.ts │ │ └── ... │ └── types.ts # Core data models ├── components/ │ ├── Checklist.tsx # Main checklist component │ ├── ChecklistItem.tsx # Individual check rendering │ ├── Search.tsx # Global search (⌘K/Ctrl+K) │ ├── Export.tsx # Export functionality │ └── ProgressBar.tsx # Progress tracking ├── hooks/ │ ├── useLocalStorage.ts # Browser persistence │ └── useProgress.ts # Progress calculation └── utils/ ├── export.ts # Export formatters └── search.ts # Search indexing ``` ## Data Model ### Core Types ```typescript // src/data/types.ts export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info'; export type CheckStatus = 'open' | 'closed' | 'na' | 'unchecked'; export interface Check { id: string; title: string; description: string; severity: Severity; tags: string[]; tools?: string[]; references?: string[]; } export interface Technology { id: string; name: string; checks: Check[]; } export interface Category { id: string; name: string; description: string; technologies: Technology[]; } export interface Platform { id: string; name: string; slug: string; description: string; icon: string; categories: Category[]; } export interface CheckState { status: CheckStatus; notes: string; timestamp: number; } export interface AssessmentData { [checkId: string]: CheckState; } ``` ## Adding a New Platform ### Step 1: Create Platform Definition ```typescript // src/data/platforms/example-platform.ts import { Platform } from '../types'; export const examplePlatform: Platform = { id: 'example-platform', name: 'Example Platform', slug: 'example-platform', description: 'Security assessment checklist for Example Platform', icon: '🔒', categories: [ { id: 'authentication', name: 'Authentication', description: 'Authentication and session management checks', technologies: [ { id: 'oauth', name: 'OAuth 2.0', checks: [ { id: 'oauth-redirect-validation', title: 'Validate OAuth redirect_uri parameter', description: 'Verify that redirect_uri is strictly validated against a whitelist to prevent open redirect vulnerabilities', severity: 'high', tags: ['oauth', 'open-redirect', 'authorization'], tools: ['Burp Suite', 'OWASP ZAP'], references: [ 'https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1', 'https://owasp.org/www-community/attacks/OAuth_2_0_Open_Redirect' ] }, { id: 'oauth-state-parameter', title: 'Check for CSRF protection via state parameter', description: 'Ensure OAuth state parameter is used and properly validated to prevent CSRF attacks', severity: 'high', tags: ['oauth', 'csrf', 'session'], tools: ['Burp Suite'], references: [ 'https://datatracker.ietf.org/doc/html/rfc6749#section-10.12' ] } ] } ] }, { id: 'authorization', name: 'Authorization', description: 'Access control and privilege escalation checks', technologies: [ { id: 'rbac', name: 'Role-Based Access Control', checks: [ { id: 'rbac-horizontal-authz', title: 'Test for horizontal authorization bypass', description: 'Verify users cannot access resources belonging to other users at the same privilege level', severity: 'critical', tags: ['idor', 'authz', 'access-control'], tools: ['Burp Suite', 'Autorize extension'], references: [ 'https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema' ] } ] } ] } ] }; ``` ### Step 2: Register Platform ```typescript // src/data/platforms/index.ts import { Platform } from '../types'; import { webPlatform } from './web'; import { apiPlatform } from './api'; import { examplePlatform } from './example-platform'; export const platforms: Platform[] = [ webPlatform, apiPlatform, examplePlatform, // ... other platforms ]; export const getPlatformBySlug = (slug: string): Platform | undefined => { return platforms.find(p => p.slug === slug); }; ``` ## Working with Assessment Data ### Saving Check Status ```typescript // src/hooks/useLocalStorage.ts import { useState, useEffect } from 'react'; import { AssessmentData, CheckState } from '../data/types'; const STORAGE_KEY = 'pentesting-checklist-data'; export function useAssessmentData() { const [data, setData] = useState<AssessmentData>(() => { const stored = localStorage.getItem(STORAGE_KEY); return stored ? JSON.parse(stored) : {}; }); useEffect(() => { localStorage.setItem(STORAGE_KEY, JSON.stringify(data)); }, [data]); const updateCheck = (checkId: string, state: Partial<CheckState>) => { setData(prev => ({ ...prev, [checkId]: { ...prev[checkId], ...state, timestamp: Date.now() } })); }; const clearAllData = () => { setData({}); localStorage.removeItem(STORAGE_KEY); }; return { data, updateCheck, clearAllData }; } ``` ### Using Assessment Data in Components ```typescript // src/components/ChecklistItem.tsx import React, { useState } from 'react'; import { Check, CheckState } from '../data/types'; interface ChecklistItemProps { check: Check; state?: CheckState; onUpdate: (checkId: string, state: Partial<CheckState>) => void; } export function ChecklistItem({ check, state, onUpdate }: ChecklistItemProps) { const [notesOpen, setNotesOpen] = useState(false); const [notes, setNotes] = useState(state?.notes || ''); const handleStatusChange = (status: CheckState['status']) => { onUpdate(check.id, { status }); }; const handleNoteSave = () => { onUpdate(check.id, { notes }); setNotesOpen(false); }; const severityColors = { critical: 'bg-red-100 text-red-800', high: 'bg-orange-100 text-orange-800', medium: 'bg-yellow-100 text-yellow-800', low: 'bg-blue-100 text-blue-800', info: 'bg-gray-100 text-gray-800' }; return ( <div className="border-b p-4"> <div className="flex items-start gap-3"> <input type="checkbox" checked={state?.status === 'closed'} onChange={() => handleStatusChange( state?.status === 'closed' ? 'open' : 'closed' )} className="mt-1" /> <div className="flex-1"> <div className="flex items-center gap-2"> <h4 className="font-medium">{check.title}</h4> <span className={`text-xs px-2 py-1 rounded ${severityColors[check.severity]}`}> {check.severity} </span> </div> <p className="text-sm text-gray-600 mt-1">{check.description}</p> {check.tags && ( <div className="flex gap-1 mt-2"> {check.tags.map(tag => ( <span key={tag} className="text-xs bg-gray-100 px-2 py-1 rounded"> #{tag} </span> ))} </div> )} {check.tools && ( <div className="text-xs text-gray-500 mt-2"> 🛠️ Tools: {check.tools.join(', ')} </div> )} {check.references && ( <div className="mt-2"> {check.references.map((ref, i) => ( <a key={i} href={ref} target="_blank" rel="noopener noreferrer" className="text-xs text-blue-600 hover:underline block" > 📚 {ref} </a> ))} </div> )} <div className="mt-3 flex gap-2"> <button onClick={() => handleStatusChange('open')} className={`text-xs px-3 py-1 rounded ${ state?.status === 'open' ? 'bg-red-500 text-white' : 'bg-gray-200' }`} > Open </button> <button onClick={() => handleStatusChange('closed')} className={`text-xs px-3 py-1 rounded ${ state?.status === 'closed' ? 'bg-green-500 text-white' : 'bg-gray-200' }`} > Closed </button> <button onClick={() => handleStatusChange('na')} className={`text-xs px-3 py-1 rounded ${ state?.status === 'na' ? 'bg-gray-500 text-white' : 'bg-gray-200' }`} > N/A </button> <button onClick={() => setNotesOpen(!notesOpen)} className="text-xs px-3 py-1 rounded bg-blue-100 hover:bg-blue-200" > 📝 Notes </button> </div> {notesOpen && ( <div className="mt-3"> <textarea value={notes} onChange={(e) => setNotes(e.target.value)} placeholder="Add findings, payloads, evidence..." className="w-full p-2 border rounded text-sm" rows={4} /> <button onClick={handleNoteSave} className="mt-2 px-3 py-1 bg-blue-500 text-white rounded text-sm" > Save Note </button> </div> )} </div> </div> </div> ); } ``` ## Progress Tracking ### Calculate Progress ```typescript // src/hooks/useProgress.ts import { Platform, AssessmentData } from '../data/types'; export interface ProgressStats { total: number; checked: number; open: number; closed: number; na: number; percentage: number; } export function calculateProgress( platform: Platform, data: AssessmentData ): ProgressStats { let total = 0; let checked = 0; let open = 0; let closed = 0; let na = 0; platform.categories.forEach(category => { category.technologies.forEach(technology => { technology.checks.forEach(check => { total++; const state = data[check.id]; if (state) { checked++; if (state.status === 'open') open++; if (state.status === 'closed') closed++;