pentesting-checklist-interactive

# PentestingChecklist Interactive Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. ## Overview PentestingChecklist is a comprehensive, client-side security assessment checklist covering 23 platforms with over 1,000 security checks. It runs entirely in the browser with no backend, storing all progress and notes in localStorage. The tool provides hierarchical organization (Platform → Category → Technology → Check), global search, progress tracking, severity filtering, and export capabilities for penetration testers, bug bounty hunters, and security engineers. **Key platforms covered:** Web Application, API, Mobile, Cloud (AWS/Azure/GCP), Active Directory, Kubernetes, LLM Security, MCP Security, Blockchain, IoT, CI/CD, and 12 more. **Live instance:** [checklist.m14r41.in](https://checklist.m14r41.in) ## Installation & Setup ### Running Locally ```bash # Clone the repository git clone https://github.com/m14r41/PentestingChecklist.git cd PentestingChecklist # Install dependencies npm install # Start development server npm run dev # Build for production npm run build # Preview production build npm run preview ``` ### Project Structure ``` PentestingChecklist/ ├── src/ │ ├── components/ # React components │ ├── data/ # Checklist data files │ ├── types/ # TypeScript type definitions │ ├── utils/ # Utility functions │ └── App.tsx # Main application ├── public/ # Static assets └── package.json ``` ## Core Concepts ### Data Structure The checklist uses a 4-level hierarchy: ```typescript interface Platform { id: string; name: string; description: string; categories: Category[]; } interface Category { id: string; name: string; technologies: Technology[]; } interface Technology { id: string; name: string; checks: Check[]; } interface Check { id: string; title: string; description: string; severity: 'critical' | 'high' | 'medium' | 'low' | 'info'; tags: string[]; tools?: string[]; references?: string[]; } ``` ### State Management All assessment data is stored in localStorage: ```typescript // Progress tracking structure interface AssessmentState { checkStatus: Record<string, 'open' | 'closed' | 'na'>; checkNotes: Record<string, string>; progress: { overall: number; perPlatform: Record<string, number>; perCategory: Record<string, number>; }; } ``` ## Key Features & Usage ### 1. Navigation & Hierarchy **Expand/Collapse All:** ```typescript // Expand all sections const expandAll = () => { setExpandedCategories(new Set(categories.map(c => c.id))); setExpandedTechnologies(new Set(technologies.map(t => t.id))); }; // Collapse all sections const collapseAll = () => { setExpandedCategories(new Set()); setExpandedTechnologies(new Set()); }; ``` **Platform-specific views:** - `/checklist` - All platforms view - `/web` - Web Application platform - `/api` - API Security platform - `/mobile` - Mobile Security platform - `/cloud` - Cloud Security platform - `/active-directory` - Active Directory platform - `/kubernetes` - Kubernetes Security platform - `/llm` - LLM Security platform - `/mcp` - MCP Security platform - (and 14 more platform-specific routes) ### 2. Global Search (⌘K / Ctrl+K) Search across all content types: ```typescript // Search implementation const searchChecklist = (query: string) => { const results = []; platforms.forEach(platform => { platform.categories.forEach(category => { category.technologies.forEach(technology => { technology.checks.forEach(check => { const searchable = [ check.title, check.description, ...check.tags, ...(check.tools || []), ...(check.references || []) ].join(' ').toLowerCase(); if (searchable.includes(query.toLowerCase())) { results.push({ platform: platform.name, category: category.name, technology: technology.name, check: check }); } }); }); }); }); return results; }; ``` ### 3. Status Tracking Mark checks with different statuses: ```typescript type CheckStatus = 'open' | 'closed' | 'na'; // Set check status const setCheckStatus = (checkId: string, status: CheckStatus) => { const currentState = getAssessmentState(); currentState.checkStatus[checkId] = status; saveAssessmentState(currentState); }; // Get all open findings const getOpenFindings = () => { const state = getAssessmentState(); return Object.entries(state.checkStatus) .filter(([_, status]) => status === 'open') .map(([checkId, _]) => findCheckById(checkId)); }; ``` ### 4. Notes Management Add contextual notes to checks: ```typescript // Add/update note for a check const updateCheckNote = (checkId: string, note: string) => { const state = getAssessmentState(); if (note.trim()) { state.checkNotes[checkId] = note; } else { delete state.checkNotes[checkId]; } saveAssessmentState(state); }; // Get note for a check const getCheckNote = (checkId: string): string => { const state = getAssessmentState(); return state.checkNotes[checkId] || ''; }; ``` ### 5. Severity Filtering Filter checks by severity level: ```typescript type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info'; const filterBySeverity = ( checks: Check[], severities: Set<Severity> ): Check[] => { if (severities.size === 0) return checks; return checks.filter(check => severities.has(check.severity)); }; // Example usage const activeSeverities = new Set<Severity>(['critical', 'high']); const filteredChecks = filterBySeverity(allChecks, activeSeverities); ``` ### 6. Progress Calculation Track completion percentage: ```typescript // Calculate platform progress const calculatePlatformProgress = (platformId: string): number => { const platform = findPlatformById(platformId); const totalChecks = countChecksInPlatform(platform); const completedChecks = countCompletedChecks(platform); return totalChecks > 0 ? (completedChecks / totalChecks) * 100 : 0; }; // Calculate overall progress const calculateOverallProgress = (): number => { const totalChecks = platforms.reduce( (sum, p) => sum + countChecksInPlatform(p), 0 ); const completedChecks = platforms.reduce( (sum, p) => sum + countCompletedChecks(p), 0 ); return totalChecks > 0 ? (completedChecks / totalChecks) * 100 : 0; }; ``` ## Export & Import ### Export Formats **Markdown Export:** ```typescript const exportToMarkdown = (): string => { const state = getAssessmentState(); let markdown = `# Security Assessment Report\n\n`; markdown += `Generated: ${new Date().toISOString()}\n\n`; platforms.forEach(platform => { markdown += `## ${platform.name}\n\n`; platform.categories.forEach(category => { category.technologies.forEach(technology => { technology.checks.forEach(check => { const status = state.checkStatus[check.id]; const note = state.checkNotes[check.id]; if (status === 'open') { markdown += `### [${check.severity.toUpperCase()}] ${check.title}\n`; markdown += `**Status:** ${status}\n\n`; markdown += `${check.description}\n\n`; if (note) markdown += `**Notes:** ${note}\n\n`; } }); }); }); }); return markdown; }; ``` **CSV Export:** ```typescript const exportToCSV = (): string => { const state = getAssessmentState(); const rows = [ ['Platform', 'Category', 'Technology', 'Check', 'Severity', 'Status', 'Notes'] ]; platforms.forEach(platform => { platform.categories.forEach(category => { category.technologies.forEach(technology => { technology.checks.forEach(check => { rows.push([ platform.name, category.name, technology.name, check.title, check.severity, state.checkStatus[check.id] || 'unchecked', state.checkNotes[check.id] || '' ]); }); }); }); }); return rows.map(row => row.map(cell => `"${cell}"`).join(',')).join('\n'); }; ``` **JSON Export:** ```typescript interface ExportData { version: string; exportDate: string; state: AssessmentState; metadata: { totalChecks: number; completedChecks: number; progress: number; }; } const exportToJSON = (): string => { const state = getAssessmentState(); const exportData: ExportData = { version: '1.0', exportDate: new Date().toISOString(), state: state, metadata: { totalChecks: countAllChecks(), completedChecks: countCompletedChecks(), progress: calculateOverallProgress() } }; return JSON.stringify(exportData, null, 2); }; ``` ### Import from JSON ```typescript const importFromJSON = (jsonString: string): boolean => { try { const data: ExportData = JSON.parse(jsonString); // Validate version compatibility if (data.version !== '1.0') { console.warn('Version mismatch, attempting import anyway'); } // Restore state saveAssessmentState(data.state); return true; } catch (error) { console.error('Import failed:', error); return false; } }; ``` ## LocalStorage Management ### Save and Load State ```typescript const STORAGE_KEY = 'pentesting-checklist-state'; const saveAssessmentState = (state: AssessmentState): void => { try { localStorage.setItem(STORAGE_KEY, JSON.stringify(state)); } catch (error) { console.error('Failed to save state:', error); } }; const getAssessmentState = (): AssessmentState => { try { const stored = localStorage.getItem(STORAGE_KEY); if (stored) { return JSON.parse(stored); } } catch (error) { console.error('Failed to load state:', error); } return { checkStatus: {}, checkNotes: {}, progress: { overall: 0, perPlatform: {}, perCategory: {} } }; }; const clearAssessmentState = (): void => { localStorage.removeItem(STORAGE_KEY); }; ``` ## Common Patterns ### Starting a New Assessment ```typescript // Initialize new assessment for a specific platform const startNewAssessment = (platformId: string) => { // Optionally clear previous state const clearPrevious = confirm('Clear previous assessment data?'); if (clearPrevious) { clearAssessmentState(); } // Navigate to platform navigate(`/${platformId}`); // Expand all sections for comprehensive review expandAll(); }; ``` ### Filtering Open Findings ```typescript // Get all open findings with critical/high severity const getCriticalOpenFindings = () => { const state = getAssessmentState(); return platforms.flatMap(platform => platform.categories.flatMap(category => category.technologies.flatMap(technology =>