pentest

name	pentest
description	Spring Boot security scanner — OWASP Top 10, SpEL injection, Actuator exploitation, Jackson deserialization, mass assignment, and Spring Security misconfiguration detection. Includes 6 automated scanning scripts and real CVE patterns. Use when performing security reviews, penetration testing, vulnerability assessments, security audits, or checking for known CVEs in Spring Boot projects. Run /pentest-scan for automated full-project scan.
triggers	{"natural":["security scan","pentest","owasp","vulnerability","security review","security audit","cve check"],"code":["SecurityConfig","@PreAuthorize","CSRF","XSS","SQL injection","SpEL","Actuator"]}
applicability	{"always":false,"triggers":{"auto_fire":["/pentest-scan invocation","high-stakes lane security review"],"command":["/pentest-scan","/threat-model"],"task_keywords":["security","OWASP","pentest","vulnerability","CVE","threat model","SSRF","injection","auth bypass"],"related_rules":["rules/common/security.md","rules/java/security.md"]}}
relevance_assessment	HIGH 100%: /pentest-scan or /threat-model invoked OR security audit task HIGH 80%+: high-stakes lane Review S2 stage MEDIUM 40-79%: auth / crypto / input-validation code change LOW 1-39%: tangential security touch (e.g., logging level for security event) ZERO: pure refactor, no security boundary

Spring Boot Security Scanner

Authorization required. Confirm context: pentest engagement, defensive review, CTF, or research.

Automated Scripts

SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/skills/pentest"

# Full scan (runs all scanners, outputs JSON + markdown report)
bash "$SKILL_DIR/scripts/scan-runner.sh" src/main

# Individual scanners
bash "$SKILL_DIR/scripts/endpoint-mapper.sh" src/main
bash "$SKILL_DIR/scripts/secrets-scanner.sh" .
bash "$SKILL_DIR/scripts/injection-scanner.sh" src/main
bash "$SKILL_DIR/scripts/security-config-audit.sh" .
bash "$SKILL_DIR/scripts/dependency-checker.sh" .

4-Phase Scan Methodology

Phase 1 — Reconnaissance: endpoint-mapper.sh + security-config-audit.sh. Read project-profile.json. Identify auth mechanism (JWT, session, OAuth2).

Phase 2 — OWASP Top 10 + Spring-Specific: A01–A10 with Spring risks (SpEL injection, Actuator exposure, Jackson deser). See references/scan-methodology.md for mapping table + vulnerability matrix.

Phase 3 — Spring-Critical Deep-Dive: RCE vectors: SpEL injection, Actuator chains, Jackson enableDefaultTyping(), mass assignment, SecurityFilterChain ordering. See references/attack-patterns.md.

Phase 4 — Report: Save to .claude/docs/security/pentest-report-{date}.md with severity counts, findings (file, evidence, attack vector, fix), tool recommendations.

Severity Classification

Severity	Criteria	Examples
CRITICAL	RCE, auth bypass, data breach	SpEL injection, exposed actuator/heapdump, enableDefaultTyping()
HIGH	Privilege escalation, data exposure	Missing @PreAuthorize, IDOR, hardcoded secrets
MEDIUM	Defense-in-depth gap	CSRF disabled, missing @Valid, weak hashing
LOW	Best practice violation	Missing security headers, unscoped @RequestMapping

References

• Scan methodology — OWASP Top 10 mapping table, Spring-critical vulnerability matrix, report template
• Attack patterns — SpEL injection, Jackson deser, mass assignment, SecurityFilterChain, actuator chains
• Actuator exploitation — RCE chains, data leak endpoints, secure configuration
• OWASP Top 10 — Detection commands, vulnerable vs secure code per category
• Spring CVEs — Real CVEs (2022-2026) with detection and mitigation

Related Skills

• spring-security — SecurityFilterChain configuration, JWT validation, CORS
• observability-patterns — PII logging detection (A09), audit trail
• testing-workflow — Security test phase in verification pipeline