| name | artifactory-pentesting |
| description | Security testing and vulnerability assessment for JFrog Artifactory instances. Use this skill whenever the user mentions Artifactory security, wants to test an Artifactory instance, needs to enumerate Artifactory vulnerabilities, or is doing penetration testing on package repositories. This skill covers reconnaissance, vulnerability identification, exploitation techniques, and post-exploitation for Artifactory. |
Artifactory Pentesting Skill
A comprehensive guide for security testing JFrog Artifactory instances.
Overview
This skill helps you assess the security of Artifactory instances through systematic reconnaissance, vulnerability identification, and exploitation techniques. Artifactory is a popular artifact repository manager that can contain critical vulnerabilities if misconfigured.
When to Use This Skill
- Testing Artifactory instances for security vulnerabilities
- Enumerating exposed repositories and artifacts
- Identifying misconfigurations in Artifactory deployments
- Assessing RCE, SSRF, and path traversal vulnerabilities
- Post-exploitation after gaining initial access
Reconnaissance
Initial Enumeration
Start by identifying the Artifactory instance and its configuration:
-
Identify the instance: Look for Artifactory banners, login pages, or API endpoints
-
Check for exposed endpoints: Common paths include:
/artifactory/ - Main web interface/artifactory/api/ - API endpoints/artifactory/api/security/ - Security-related endpoints/artifactory/api/system/ - System information
-
Gather version information: Check the About page or API responses for version details
