pentesting-from-beginner-to-advanced

The assistant provides a structured web application penetration testing learning path from fundamentals to advanced techniques. Activate when users ask about "learning pentesting," "web security training," "OWASP vulnerabilities," "BurpSuite tutorial," "penetration testing roadmap," or "web app security course."

跳到安装

仓库: zebbern/SecOps-CLI-Guides
最近来源活动: 2026年1月2日 20:12
检测到的 SKILL.md 语言: 英语
星标: 35
分支: 10

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/zebbern/SecOps-CLI-Guides --skill pentesting-from-beginner-to-advanced

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

active-directory-attacks

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

2026-01-02

api-fuzzing-for-bug-bounty

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.

2026-01-02

aws-penetration-testing

This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.

2026-01-02

查看这个仓库的全部 Skills

name	Pentesting from Beginner to Advanced
description	The assistant provides a structured web application penetration testing learning path from fundamentals to advanced techniques. Activate when users ask about "learning pentesting," "web security training," "OWASP vulnerabilities," "BurpSuite tutorial," "penetration testing roadmap," or "web app security course."
version	1.0.0
tags	["training","web-security","owasp","burpsuite","learning-path"]

Pentesting from Beginner to Advanced

Purpose

Provide a structured learning path for web application penetration testing, progressing from foundational concepts through advanced exploitation techniques. Guide learners through each phase of the web security assessment process.

Inputs/Prerequisites

Basic computer and networking knowledge
Kali Linux or security-focused OS
BurpSuite installed and configured
Lab environment (bWAPP, DVWA, or similar)
Web browser with developer tools

Outputs/Deliverables

Foundational web security knowledge
Practical exploitation skills
Understanding of OWASP Top 10
Ability to conduct web application assessments
Vulnerability identification and reporting skills

Core Workflow

Phase 1: History and Fundamentals

Understanding the Internet:

Learn how the internet was developed
Understand client-server architecture
Grasp basic web communication models

Key Concepts:

HTTP protocol fundamentals
Request/response structure
Client vs server-side processing

Phase 2: Web and Server Technology

HTTP Protocol Basics:

HTTP Request Structure:
GET /page HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Cookie: session=abc123

HTTP Response Structure:
HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=xyz789

<html>...</html>

Essential Concepts:

Topic	Description
HTTP Methods	GET, POST, PUT, DELETE, OPTIONS
Status Codes	200 OK, 301 Redirect, 403 Forbidden, 404 Not Found, 500 Error
Headers	Request and response metadata
Cookies	Session management, tracking
Sessions	Server-side state management
URLs	Structure and parameters
REST APIs	Resource-based web services

Encoding Types:

# URL Encoding
Space -> %20
< -> %3C
> -> %3E
" -> %22

# HTML Encoding
< -> &lt;
> -> &gt;
& -> &amp;

# Base64 Encoding
echo "text" | base64
echo "dGV4dAo=" | base64 -d

Phase 3: Lab Setup with BurpSuite

Install BurpSuite:

# Download from PortSwigger
# Configure browser proxy: 127.0.0.1:8080
# Import Burp CA certificate

Configure Browser:

Set proxy to 127.0.0.1:8080
Import BurpSuite CA certificate
Disable certificate validation for testing

BurpSuite Modules:

Module	Purpose
Proxy	Intercept and modify traffic
Repeater	Manually modify and resend requests
Intruder	Automated attacks and fuzzing
Scanner	Automated vulnerability detection
Decoder	Encode/decode data
Comparer	Compare responses
Sequencer	Analyze session token randomness

Set Up Practice Lab:

# Install Docker
apt install docker.io

# Run bWAPP
docker run -d -p 80:80 raesene/bwapp

# Run DVWA
docker run -d -p 80:80 vulnerables/web-dvwa

# Access at http://localhost

Phase 4: Application Mapping

Discovery Techniques:

# Robots.txt analysis
curl http://target/robots.txt

# Directory brute forcing
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
dirbuster -u http://target -l /usr/share/wordlists/dirb/common.txt

# Spidering with Burp
# Use Target > Site Map > Spider

Entry Point Identification:

Forms and input fields
URL parameters
Hidden fields
Cookies
HTTP headers

Technology Fingerprinting:

# Whatweb
whatweb http://target

# Wappalyzer (browser extension)

# Nmap fingerprinting
nmap -sV --script http-enum target

# Banner grabbing
curl -I http://target

Phase 5: OWASP Top 10 Vulnerabilities

1. Injection (A03:2021)

# SQL Injection
' OR 1=1--
" OR ""="
'; DROP TABLE users;--

# Command Injection
; ls -la
| cat /etc/passwd
&& whoami

# LDAP Injection
*)(uid=*))(|(uid=*

2. Broken Authentication (A07:2021)

- Weak passwords
- Session fixation
- Credential stuffing
- Missing MFA
- Insecure password recovery

3. Cross-Site Scripting (A03:2021)

<!-- Reflected XSS -->
<script>alert('XSS')</script>

<!-- Stored XSS -->
<img src=x onerror="alert('XSS')">

<!-- DOM-based XSS -->
<svg onload="alert('XSS')">

<!-- Filter bypass -->
<ScRiPt>alert('XSS')</ScRiPt>
<img src="x" onerror="alert('XSS')">

4. Insecure Direct Object Reference (A01:2021)

# IDOR Examples
/api/user/123    -> /api/user/124
/download?id=1   -> /download?id=2
/invoice/10001   -> /invoice/10002

5. Security Misconfiguration (A05:2021)

- Default credentials
- Unnecessary features enabled
- Error messages revealing info
- Missing security headers
- Outdated software

6. Sensitive Data Exposure (A02:2021)

- Unencrypted transmission
- Weak encryption
- Exposed API keys
- Hardcoded credentials
- Information in error messages

7. Missing Access Controls (A01:2021)

- Horizontal privilege escalation
- Vertical privilege escalation
- Forced browsing to admin pages
- API without authentication

8. Cross-Site Request Forgery (A01:2021)

<!-- CSRF Attack Form -->
<form action="http://target/transfer" method="POST">
  <input type="hidden" name="amount" value="10000">
  <input type="hidden" name="to" value="attacker">
  <input type="submit" value="Click Me!">
</form>

9. Components with Known Vulnerabilities (A06:2021)

# Check for CVEs
searchsploit apache 2.4
searchsploit wordpress 5.0

# Retire.js for JavaScript
retire --path /path/to/js

10. Insufficient Logging (A09:2021)

- Failed login attempts not logged
- No audit trail
- Logs not monitored
- Logs stored insecurely

Phase 6: Session Management Testing

Session Analysis:

# Burp Sequencer
# Analyze token randomness and predictability

# Check for:
- Session fixation
- Session hijacking
- Weak session tokens
- Missing timeout
- Insecure transmission

Cookie Security Flags:

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Strict

Flag	Purpose
Secure	HTTPS only
HttpOnly	No JavaScript access
SameSite	CSRF protection

Phase 7: Bypassing Client-Side Controls

Hidden Field Manipulation:

<!-- Original -->
<input type="hidden" name="price" value="100">

<!-- Modified in Burp -->
<input type="hidden" name="price" value="1">

JavaScript Validation Bypass:

Disable JavaScript in browser
Intercept and modify with Burp
Replay requests with modified values

Phase 8: Authentication Attacks

Common Techniques:

# Brute force
hydra -l admin -P passwords.txt target http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Username enumeration
# Different responses for valid/invalid users

# Password reset flaws
# Predictable tokens, no rate limiting

Phase 9: Access Control Testing

IDOR Testing:

# Increment IDs
/user/1 -> /user/2

# Change parameters
?role=user -> ?role=admin

# Use Burp Intruder for automation

Phase 10: Input Validation Testing

Injection Points:

# All user input
# URL parameters
# Form fields
# Headers (User-Agent, Referer)
# Cookies
# File uploads

Fuzzing with Burp:

Send request to Intruder
Mark injection points
Select payload list
Analyze responses

Phase 11: Error Code Analysis

# Force errors for information
- Invalid input types
- Long strings
- Special characters
- SQL syntax errors

# Look for:
- Stack traces
- Database errors
- Path disclosure
- Version information

Phase 12: Cryptography Testing

# Check for:
- Weak algorithms (MD5, SHA1, DES)
- ECB mode usage
- Hardcoded keys
- Missing encryption

# SSL/TLS testing
sslscan target:443
testssl.sh target

Phase 13: Business Logic Vulnerabilities

Common Issues:

Price manipulation
Skipping workflow steps
Race conditions
Abuse of functionality

Testing Approach:

Understand normal workflow
Attempt to skip steps
Modify values mid-process
Test race conditions

Quick Reference

Essential Tools

Tool	Purpose
BurpSuite	Web proxy and testing
OWASP ZAP	Open source alternative
sqlmap	SQL injection automation
Nikto	Web server scanning
Gobuster	Directory enumeration

Testing Checklist

□ Map application and entry points
□ Test authentication mechanisms
□ Check authorization controls
□ Test input validation
□ Analyze session management
□ Check for injection flaws
□ Test business logic
□ Review error handling
□ Assess cryptographic implementation

Constraints

Only test authorized systems
Lab environments are essential for learning
Real-world applications may differ from labs
Tools require understanding, not just execution

Examples

Example 1: Quick XSS Test

<script>alert(document.domain)</script>

Example 2: SQLi Detection

' OR '1'='1

Troubleshooting

Issue	Solution
Burp not intercepting	Check proxy settings, CA certificate
Lab not loading	Verify Docker is running
Payloads blocked	Try encoding, alternative syntax
Tool errors	Check dependencies, permissions

pentesting-from-beginner-to-advanced

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

Pentesting from Beginner to Advanced

Purpose

Inputs/Prerequisites

Outputs/Deliverables

Core Workflow

Phase 1: History and Fundamentals

Phase 2: Web and Server Technology

Phase 3: Lab Setup with BurpSuite

Phase 4: Application Mapping

Phase 5: OWASP Top 10 Vulnerabilities

Phase 6: Session Management Testing

Phase 7: Bypassing Client-Side Controls

Phase 8: Authentication Attacks

Phase 9: Access Control Testing

Phase 10: Input Validation Testing

Phase 11: Error Code Analysis

Phase 12: Cryptography Testing

Phase 13: Business Logic Vulnerabilities

Quick Reference

Essential Tools

Testing Checklist

Constraints

Examples

Example 1: Quick XSS Test

Example 2: SQLi Detection

Troubleshooting

Pentesting from Beginner to Advanced

Purpose

Inputs/Prerequisites

Outputs/Deliverables

Core Workflow

Phase 1: History and Fundamentals

Phase 2: Web and Server Technology

Phase 3: Lab Setup with BurpSuite

Phase 4: Application Mapping

Phase 5: OWASP Top 10 Vulnerabilities

Phase 6: Session Management Testing

Phase 7: Bypassing Client-Side Controls

Phase 8: Authentication Attacks

Phase 9: Access Control Testing

Phase 10: Input Validation Testing

Phase 11: Error Code Analysis

Phase 12: Cryptography Testing

Phase 13: Business Logic Vulnerabilities

Quick Reference

Essential Tools

Testing Checklist

Constraints

Examples

Example 1: Quick XSS Test

Example 2: SQLi Detection

Troubleshooting