메뉴
Operator OPSEC + evidence handling — operator identity hygiene, source IP design, burner infrastructure, evidence chain of custody, log retention advisory. Triggers on OPSEC, operator anonymity, source IP hygiene, burner infrastructure, evidence chain, chain of custody, log retention, attribution, fingerprint hygiene.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.
iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.
| name | pentest-opsec-evidence |
| description | Operator OPSEC + evidence handling — operator identity hygiene, source IP design, burner infrastructure, evidence chain of custody, log retention advisory. Triggers on OPSEC, operator anonymity, source IP hygiene, burner infrastructure, evidence chain, chain of custody, log retention, attribution, fingerprint hygiene. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Grep |
| metadata | {"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-opsec-evidence","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents opsec-anonymizer"} |
Operator OPSEC + engagement evidence handling. Minimizing the operator's footprint on the target during a pentest + storing evidence at legal grade.
1. Burner cloud VM (AWS / DO / Linode)
- Account: pentest-firm name, real name (do not hide the legal account)
- VM: single engagement, shut down at the end
- Region: pick a region the client can observe
2. Residential proxy (selective use)
- Use without legal authorization is wrong (even Tor carries attribution potential)
- For testing within a bug bounty / authorized engagement
3. Bastion + jump host
- Operator <-> Bastion (own) <-> Cloud VM <-> target
- Bastion log: timestamp + command + operator
# Burp / proxy config
- User-Agent: realistic, version-current
- Accept-Language: target locale
- JA3 fingerprint: common browser (Chrome 119 default)
# Tool customization
nmap --max-rate 100 --randomize-hosts
curl -A "Mozilla/5.0 (compatible)" --resolve ...
# DNS over HTTPS (DoH)
# When making DNS queries toward the target, use 1.1.1.1 DoH instead of your own ISP DNS
# SNI: cloudfront / cloudflare cover behind
# (for authorized use only — within a legal framework)
| Tool | Default Footprint | Stealthy Alternative |
|---|---|---|
| nmap (default) | -sC -sV LOUD | -sT -sV --top-ports 100 --max-rate 100 |
| sqlmap (default) | Many requests, banner | --random-agent --delay 2 --threads 1 |
| BloodHound (default) | Mass LDAP | --throttle 30 --jitter 20 |
| ffuf | 1000 req/s | -t 5 -p 1 |
| nuclei | All templates | -tags sqli,xss only |
Per engagement:
1. Set up a VM (cloud / your own VPS)
2. Separate SSH key pair (engagement-specific)
3. Tooling stack install (Kali Light / Parrot)
4. Engagement end: snapshot + destroy
5. Snapshot: encrypted (BitLocker / VeraCrypt) cold storage
Persistent:
- Bug bounty researcher: dedicated workstation (1)
- Pentest firm: per-customer VM template
- Red team operator: 3 tiers (recon/exploit/post-ex isolated)
To store forensic-grade evidence:
# Evidence Log Entry
## EVIDENCE ID: EVD-2026-05-15-001
**Engagement**: ACME Corp Pentest 2026 Q2
**Acquired**: 2026-05-15 14:23:01 UTC
**Acquired by**: <analyst name>, <analyst signature/badge>
**From**: ACME-WEB-PROD-01 (192.168.50.10) — authorized via Letter of Auth
**Tool**: nmap 7.93 — `nmap -sV --top-ports 1000 ...`
**File**: evidence/nmap_acme-web-prod-01_20260515_142301.xml
**Size**: 12,432 bytes
**SHA-256**: abc123def456...
## Chain
- 2026-05-15 14:23 — Acquired by <analyst>
- 2026-05-15 14:25 — Hashed + signed (SHA-256 + GPG)
- 2026-05-15 18:00 — Transferred to encrypted vault (LUKS)
- 2026-05-15 18:01 — Hash re-verified (matches)
- 2026-05-22 09:00 — Used in report writing (read-only)
- 2026-06-15 12:00 — Engagement closeout, vault sealed
- 2027-05-15 — Scheduled destruction (retention 1 year)
| Type | Retention | Encryption | Format |
|-----|-----------|------------|--------|
| Raw tool output | Engagement + 1 year | At rest + GPG | Original (xml, json, txt) |
| Screen recording | Engagement + 1 year | At rest | mp4 |
| HAR file (browser) | Engagement + 1 year | At rest | har.gz |
| Command history | Engagement + 1 year | At rest | shell history |
| Sensitive data (PII evidence) | Engagement + 30 days | Strong + 2FA | Encrypted, restricted |
| Cred-related | Engagement + 7 days | Strong | hashed, never plain |
- [ ] Hash check of all evidence files
- [ ] Transfer to the encrypted vault
- [ ] Burner VM snapshot + destroy
- [ ] Source IP whitelist removed by the client
- [ ] VPN config destroyed
- [ ] Engagement-specific SSH key destroyed
- [ ] Tools cache cleared (~/.cache/, ~/.local/share/sqlmap, ...)
- [ ] Browser history / Burp project cleared
- [ ] Client communications archived
- [ ] Retention timer started
- Tool default banner suppression (nmap --send-eth)
- HTTP User-Agent normalization
- Time-zone alignment (operator TZ != server log TZ pattern)
- Username convention (no "admin", "root" account)
- File timestamp normalization (touch -t after copy)
- No persistent-identity guarantee (single engagement)