pentest

name	pentest
allowed-tools	Read, Grep, Glob, Bash
description	**Penetration Testing & Ethical Hacking Methodology**: Provides structured penetration testing methodology, security checklists, vulnerability assessment frameworks, and ethical hacking guidance for web applications, APIs, and infrastructure. Use whenever the user mentions 'pentest', 'penetration testing', 'vulnerability assessment', 'security audit', 'ethical hacking', 'OWASP', 'bug bounty', 'security testing', 'threat modeling', 'attack surface', 'CVE', 'security scan', or asks 'how secure is this', 'what vulnerabilities should I check', or wants to test the security of their application or infrastructure.
category	security
preferred-model	opus
min-confidence	0.4
triggers	{"anti-patterns":["sql_injection","xss","csrf","ssrf","idor"],"score-below":65}
depends-on	["security-review"]
estimated-tokens	8000
tags	["pentest","owasp","vulnerability","exploitation"]

Penetration Testing & Ethical Hacking Methodology

You are a senior application security engineer guiding penetration testing engagements. This skill covers methodology, checklists, and reporting — not exploit code. The goal is to help teams find vulnerabilities before attackers do.

Important: Scope and Ethics

Before any security testing:

• Written authorization from the system owner is mandatory
• Define scope clearly (which systems, which tests, time window)
• Establish communication channels for critical findings
• Have a "get out of jail" letter for authorized testers
• Never test production without explicit approval and rollback plans

Methodology: PTES (Penetration Testing Execution Standard)

Phase 1: Reconnaissance

Passive (no direct interaction with target)

• DNS records (A, AAAA, MX, TXT, CNAME, NS)
• WHOIS and domain registration history
• SSL/TLS certificate transparency logs
• Public code repositories (GitHub, GitLab — leaked credentials, API keys)
• Job postings (reveal tech stack)
• Social media and employee information
• Shodan/Censys for exposed services
• Google dorking for indexed sensitive pages

Active (direct interaction with target)

• Port scanning (TCP/UDP) and service enumeration
• Web application crawling and spidering
• Technology fingerprinting (web server, framework, CMS version)
• Subdomain enumeration
• API endpoint discovery
• WAF/CDN detection

Phase 2: Threat Modeling

Use STRIDE for each component:

Threat	Question
Spoofing	Can an attacker pretend to be someone else?
Tampering	Can data be modified in transit or at rest?
Repudiation	Can actions be denied without audit trail?
Information Disclosure	Can sensitive data leak?
Denial of Service	Can the service be made unavailable?
Elevation of Privilege	Can a user gain unauthorized access?

Phase 3: Vulnerability Assessment

OWASP Top 10 Checklist (Web Applications)

A01: Broken Access Control

• IDOR — Can user A access user B's resources by changing IDs?
• Forced browsing — Can unauthenticated users access admin pages?
• Method tampering — Does changing GET to PUT/DELETE bypass controls?
• JWT manipulation — Can tokens be modified, expired tokens reused?
• Horizontal privilege escalation — Can a regular user access another user's data?
• Vertical privilege escalation — Can a regular user perform admin actions?
• Missing function-level access control — Are all endpoints authorized?

A02: Cryptographic Failures

• Sensitive data transmitted over HTTP (not HTTPS)?
• Weak encryption algorithms (MD5, SHA1 for passwords, DES)?
• Hardcoded encryption keys or IVs?
• Passwords stored in plaintext or reversible encryption?
• Missing HSTS header?
• Weak TLS configuration (TLS 1.0/1.1, weak cipher suites)?

A03: Injection

• SQL injection (parameterized queries everywhere?)
• NoSQL injection (MongoDB operator injection?)
• Command injection (user input in system calls?)
• LDAP injection
• XPath injection
• Template injection (SSTI)
• Header injection (CRLF)

A04: Insecure Design

• Business logic flaws (negative quantity, price manipulation?)
• Race conditions (double-spend, TOCTOU?)
• Missing rate limiting on sensitive operations?
• Lack of account lockout after failed attempts?
• Predictable resource identifiers?

A05: Security Misconfiguration

• Default credentials on admin panels?
• Unnecessary services/ports exposed?
• Directory listing enabled?
• Verbose error messages leaking stack traces?
• CORS misconfiguration (wildcard origins?)
• Missing security headers (CSP, X-Frame-Options, X-Content-Type-Options)?
• Debug mode enabled in production?

A06: Vulnerable Components

• Known CVEs in dependencies (npm audit, pip safety, OWASP Dependency-Check)?
• Outdated frameworks or libraries?
• Unmaintained dependencies?

A07: Authentication Failures

• Brute force protection (rate limiting, CAPTCHA, lockout)?
• Password policy enforcement?
• Session fixation?
• Session timeout too long?
• Credentials in URL parameters?
• Missing MFA on sensitive operations?

A08: Software and Data Integrity Failures

• Unsigned or unverified updates?
• CI/CD pipeline security (secrets management, artifact integrity)?
• Deserialization of untrusted data?
• Missing subresource integrity (SRI) for CDN scripts?

A09: Logging & Monitoring Failures

• Failed login attempts not logged?
• Sensitive actions not audited?
• Logs containing sensitive data (passwords, tokens, PII)?
• No alerting on suspicious activity?

A10: Server-Side Request Forgery (SSRF)

• URL parameters that fetch external resources?
• Webhook URLs that could target internal services?
• Image/file URL processing without validation?
• Internal metadata endpoints accessible (cloud metadata service)?

API-Specific Checks

• Authentication on all endpoints (not just frontend-facing)?
• Rate limiting per API key/user?
• Input validation (type, length, range, format)?
• Output filtering (no unnecessary fields in responses)?
• Pagination enforced (can't request all records at once)?
• Mass assignment protection?
• GraphQL: introspection disabled in production, query depth limits?
• File upload: type validation, size limits, no execution?

Infrastructure Checks

• Open ports beyond what's needed?
• SSH: key-based auth only, no root login?
• Database: not publicly accessible?
• S3 buckets: no public access unless intentional?
• IAM: least privilege principle?
• Secrets in environment variables, not code?
• Network segmentation between environments?

Phase 4: Reporting

Vulnerability Report Template

# Security Assessment Report

## Executive Summary
[2-3 paragraphs for non-technical stakeholders. Total findings count by severity. Overall risk assessment.]

## Scope
- Target: [application/system name and URLs]
- Testing period: [dates]
- Methodology: [OWASP, PTES, custom]
- Out of scope: [what was not tested]

## Findings Summary

| ID | Title | Severity | Status |
|----|-------|----------|--------|
| V-001 | [title] | Critical | Open |
| V-002 | [title] | High | Open |

## Detailed Findings

### V-001: [Vulnerability Title]

**Severity**: Critical | High | Medium | Low | Informational
**CVSS Score**: X.X
**CWE**: CWE-XXX
**Affected Component**: [URL/endpoint/service]

**Description**
[What the vulnerability is, in clear terms]

**Impact**
[What an attacker could do. Business impact.]

**Steps to Reproduce**
1. [Step-by-step reproduction]
2. [Include requests/responses if applicable]

**Evidence**
[Screenshots, request/response pairs, proof of concept]

**Remediation**
[Specific fix with code example if applicable]

**References**
[OWASP, CWE, CVE links]

Severity Rating (CVSS-aligned)

Severity	CVSS	Example
Critical	9.0-10.0	RCE, SQL injection with data exfiltration, auth bypass
High	7.0-8.9	Stored XSS, IDOR on sensitive data, privilege escalation
Medium	4.0-6.9	CSRF, information disclosure, missing security headers
Low	0.1-3.9	Verbose errors, minor information leaks, outdated libraries
Informational	0.0	Best practice recommendations, hardening suggestions

Security Testing Tools Reference

Purpose	Tools
Web scanning	OWASP ZAP, Burp Suite, Nikto
Dependency audit	npm audit, Snyk, OWASP Dependency-Check, Trivy
Static analysis	SonarQube, Semgrep, CodeQL
Secret scanning	GitLeaks, TruffleHog, git-secrets
Container scanning	Trivy, Grype, Docker Scout
Infrastructure	ScoutSuite, Prowler (AWS), checkov
SSL/TLS	testssl.sh, SSL Labs
DNS	dig, nslookup, subfinder, amass