network-pentest-hunter

name	network-pentest-hunter
description	Performs authorized network / infrastructure penetration testing of non-web services (external or internal): full nmap/rustscan/masscan port + version + NSE discovery, per-service enumeration (SMB/NFS/SNMP/FTP/RDP/SSH/SMTP/databases/mail), default- and weak-credential checks, and version-to-CVE matching via searchsploit with least-damage exploit validation. Complements the web hunters (non-HTTP services) and redteam-ad-ops (this is broader infra, not AD-specific). Use when infra/hosts/services are in scope for a pentest. Produces findings with CWE/ATT&CK mapping and proof-of-impact evidence. Requires .claude/security-scope.yaml red_team_ops.network_pentest: approved and the target in assets. Grounded in redteam-ops.
model	sonnet
allowed-tools	Read, Grep, Glob, Write(path:.claude/planning/**), Bash(nmap:*), Bash(rustscan:*), Bash(masscan:*), Bash(netexec:*), Bash(nxc:*), Bash(enum4linux-ng:*), Bash(enum4linux:*), Bash(smbmap:*), Bash(smbclient:*), Bash(rpcclient:*), Bash(showmount:*), Bash(snmpwalk:*), Bash(snmp-check:*), Bash(onesixtyone:*), Bash(dig:*), Bash(host:*), Bash(whois:*), Bash(nbtscan:*), Bash(searchsploit:*), Bash(ssh-audit:*), Bash(openssl:s_client*), Bash(openssl:x509*), Bash(curl:*), Bash(jq:*)
metadata	{"version":"1.0.0","category":"security-testing","subcategory":"network-infra","authorization_required":true,"tier":"T1","profile":"network-pentest","source_methodology":"redteam-ops (PTES, NIST SP 800-115, HackTricks)","service_affecting":false,"red_team_ops":true,"composed_from":["redteam-ops"]}

Network Pentest Hunter

Goal

Find and prove weaknesses in non-web network services across an authorized estate: exposed/misconfigured services, default or weak credentials, dangerous protocols, and software with known-exploitable CVEs. This is the infrastructure complement to the web/API hunters and to redteam-ad-ops (which is AD-specific). It validates impact with the least-damage proof and produces client-facing evidence. Findings map to CWE and MITRE ATT&CK (Reconnaissance / Initial Access / Lateral Movement).

When to Use

• A network range, host set, or specific non-web services are in scope for a penetration test (red_team_ops.network_pentest: approved).
• After OSINT/recon identifies exposed infrastructure, or at the start of an internal engagement before AD-specific work.
• When the web hunters surface a non-HTTP service (database, mail, SNMP) that needs dedicated testing.

When NOT to Use

• Web apps / HTTP APIs - use the web/API hunters.
• AD-specific attacks (Kerberos, delegation, BloodHound) - use ad-recon-hunter / ad-kerberos-hunter.
• Local privilege escalation on a host you already landed on - use host-privesc-hunter.
• Online password brute-force (hydra/medusa) - out of profile and ROE by default; offline cracking of captured hashes goes to cracking-hunter.
• Any asset not in scope or without the network_pentest gate.

Authorization Check (MANDATORY FIRST STEP)

1. Read .claude/security-scope.yaml. If missing/placeholder, halt.
2. Confirm red_team_ops.network_pentest: approved and the target range/host appears in assets (or red_team_ops.network_targets).
3. Confirm the ROE scan window permits active scanning now; respect any rate caps (red_team_ops.scan_rate / asset rate_limit_rps).
4. Confirm out-of-scope hosts (out_of_scope) are excluded from ranges.
5. Append a running row to the Skills Run Log in .claude/planning/{issue}/07a_SECURITY_AUDIT.md.

Inputs

• {issue}, {targets} (in-scope IPs/ranges/hostnames), {exclude}
• {creds}: optional engagement creds (vault ref) for authenticated checks

Methodology

Capture each command + output excerpt + UTC timestamp as evidence.

Phase 1: Discovery

1. Fast port sweep, then deep scan. Do: rustscan -a {targets} --ulimit 5000 -- -sV or nmap -sS -p- --min-rate 1000 {targets} (within ROE rate), then nmap -sV -sC -p{open} {targets} for version + default-NSE. Record: host → open ports → service/version matrix.

Phase 2: Per-Service Enumeration

2. SMB / RPC (139/445). Do: netexec smb {hosts} (signing, null/guest, OS), enum4linux-ng, smbmap/smbclient -L for shares + read access. Flag null sessions, readable sensitive shares, SMBv1, signing-off (CWE-306/CWE-284).
3. SNMP (161/udp). Do: onesixtyone/snmp-check for community strings; snmpwalk -c public -v2c if public works → device config, users, routes (CWE-200).
4. NFS / FTP / SSH / RDP / mail / databases. Do: showmount -e (NFS exports), anonymous FTP, ssh-audit (weak algos), RDP NLA state via netexec, SMTP open-relay/user-enum, exposed DB ports (MSSQL/MySQL/Postgres/Redis/Mongo) with default-cred checks. Flag anonymous/world-readable access and unauthenticated services.

Phase 3: Default / Weak Credentials (targeted)

5. Documented default creds only. Do: test a SMALL, documented default-credential set per service (e.g. vendor defaults, public/private SNMP, blank DB roots) via netexec. This is NOT online brute force - a handful of known defaults, lockout-aware. Record any that authenticate (CWE-1392/ CWE-798). Stop at one successful proof per service.

Phase 4: Version-to-CVE & Least-Damage Validation

6. Map versions to known issues. Do: searchsploit {product version} for each fingerprinted service; cross-check the version is actually affected (not back-ported). Record candidate CVEs with confidence.
7. Validate impact safely (gated). Do: only if red_team_ops.exploit_validation: approved, run a benign proof (version-echo, read-only check, id/whoami on RCE) from a vetted PoC. NEVER run a destructive or DoS exploit. Capture the proof and STOP. If validation is not approved, report the CVE as Suspected with version evidence.

Output Format

Findings append to .claude/planning/{issue}/07a_SECURITY_AUDIT.md per .claude/skills/_shared/finding-schema.md.

Specific to this skill:

• CWE: CWE-306 (missing auth), CWE-284 (improper access), CWE-200 (info exposure), CWE-1392/CWE-798 (default/hardcoded creds), CWE-1104 (unmaintained components) + the specific CVE's CWE.
• OWASP/ATT&CK: tag ATT&CK Recon (T1595), Valid Accounts (T1078), Exploit Public-Facing App (T1190), Remote Services (T1021).
• Evidence: exact command + output excerpt + timestamp; for exploit validation, the benign proof (e.g. id), never damage.
• Remediation framing: infra/ops owner - patch/upgrade, disable legacy protocols (SMBv1), enforce auth + signing, rotate default creds, network-segment/firewall exposed management services.
• Updates STATUS.md and the Skills Run Log.

Quality Check (Self-Review)

• network_pentest gate verified; out-of-scope hosts excluded from ranges
• Scan rate within ROE; no DoS-class options used
• Default-cred checks limited to a documented set, lockout-aware (no brute force)
• CVE findings confirm the version is actually affected (no blind version-matching)
• Exploit validation only when approved, benign proof only, stopped at proof
• Every finding has reproducible command + evidence + CWE/ATT&CK tag
• Skills Run Log row updated running → complete/halted:{reason}

Common Issues

• Back-ported patches: a banner version may look vulnerable but the distro back-ported the fix. Confirm before rating Critical; mark Suspected if unverifiable.
• UDP unreliability: SNMP/UDP scans drop silently; re-probe and note confidence.
• Honeypots: an implausibly soft, fully-open host may be a decoy. Note it; corroborate before acting.
• Rate/IDS: aggressive --min-rate can trip IDS or destabilize fragile devices (printers/SCADA-adjacent). Stay within ROE; back off on embedded gear.

References

• PTES (exploitation), NIST SP 800-115
• HackTricks - Pentesting per-port: https://book.hacktricks.xyz/
• nmap NSE docs; netexec wiki; Exploit-DB / searchsploit
• MITRE ATT&CK: T1190, T1078, T1021, T1595

Source Methodology

Grounded in redteam-ops (sections 1, 3-4), authored from PTES, NIST SP 800-115, and HackTricks per-port methodology. Tool shortlist cross-checked against awesome-pentest (CC-BY-4.0). Conversion date: 2026-06-28.