# Pentest

> **Penetration Testing & Ethical Hacking Methodology**: Provides structured penetration testing methodology, security checklists, vulnerability assessment frameworks, and ethical hacking guidance for web applications, APIs, and infrastructure. Use whenever the user mentions 'pentest', 'penetration testing', 'vulnerability assessment', 'security audit', 'ethical hacking', 'OWASP', 'bug bounty', 'se…

- **Type:** Skill
- **Install:** `agentstack add skill-camilooscargbaptista-cto-toolkit-pentest`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [camilooscargbaptista](https://agentstack.voostack.com/s/camilooscargbaptista)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [camilooscargbaptista](https://github.com/camilooscargbaptista)
- **Source:** https://github.com/camilooscargbaptista/cto-toolkit/tree/main/pentest

## Install

```sh
agentstack add skill-camilooscargbaptista-cto-toolkit-pentest
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Penetration Testing & Ethical Hacking Methodology

You are a senior application security engineer guiding penetration testing engagements. This skill covers methodology, checklists, and reporting — not exploit code. The goal is to help teams find vulnerabilities before attackers do.

## Important: Scope and Ethics

Before any security testing:
- Written authorization from the system owner is mandatory
- Define scope clearly (which systems, which tests, time window)
- Establish communication channels for critical findings
- Have a "get out of jail" letter for authorized testers
- Never test production without explicit approval and rollback plans

## Methodology: PTES (Penetration Testing Execution Standard)

### Phase 1: Reconnaissance

**Passive (no direct interaction with target)**
- DNS records (A, AAAA, MX, TXT, CNAME, NS)
- WHOIS and domain registration history
- SSL/TLS certificate transparency logs
- Public code repositories (GitHub, GitLab — leaked credentials, API keys)
- Job postings (reveal tech stack)
- Social media and employee information
- Shodan/Censys for exposed services
- Google dorking for indexed sensitive pages

**Active (direct interaction with target)**
- Port scanning (TCP/UDP) and service enumeration
- Web application crawling and spidering
- Technology fingerprinting (web server, framework, CMS version)
- Subdomain enumeration
- API endpoint discovery
- WAF/CDN detection

### Phase 2: Threat Modeling

Use STRIDE for each component:

| Threat | Question |
|--------|----------|
| **S**poofing | Can an attacker pretend to be someone else? |
| **T**ampering | Can data be modified in transit or at rest? |
| **R**epudiation | Can actions be denied without audit trail? |
| **I**nformation Disclosure | Can sensitive data leak? |
| **D**enial of Service | Can the service be made unavailable? |
| **E**levation of Privilege | Can a user gain unauthorized access? |

### Phase 3: Vulnerability Assessment

#### OWASP Top 10 Checklist (Web Applications)

**A01: Broken Access Control**
- [ ] IDOR — Can user A access user B's resources by changing IDs?
- [ ] Forced browsing — Can unauthenticated users access admin pages?
- [ ] Method tampering — Does changing GET to PUT/DELETE bypass controls?
- [ ] JWT manipulation — Can tokens be modified, expired tokens reused?
- [ ] Horizontal privilege escalation — Can a regular user access another user's data?
- [ ] Vertical privilege escalation — Can a regular user perform admin actions?
- [ ] Missing function-level access control — Are all endpoints authorized?

**A02: Cryptographic Failures**
- [ ] Sensitive data transmitted over HTTP (not HTTPS)?
- [ ] Weak encryption algorithms (MD5, SHA1 for passwords, DES)?
- [ ] Hardcoded encryption keys or IVs?
- [ ] Passwords stored in plaintext or reversible encryption?
- [ ] Missing HSTS header?
- [ ] Weak TLS configuration (TLS 1.0/1.1, weak cipher suites)?

**A03: Injection**
- [ ] SQL injection (parameterized queries everywhere?)
- [ ] NoSQL injection (MongoDB operator injection?)
- [ ] Command injection (user input in system calls?)
- [ ] LDAP injection
- [ ] XPath injection
- [ ] Template injection (SSTI)
- [ ] Header injection (CRLF)

**A04: Insecure Design**
- [ ] Business logic flaws (negative quantity, price manipulation?)
- [ ] Race conditions (double-spend, TOCTOU?)
- [ ] Missing rate limiting on sensitive operations?
- [ ] Lack of account lockout after failed attempts?
- [ ] Predictable resource identifiers?

**A05: Security Misconfiguration**
- [ ] Default credentials on admin panels?
- [ ] Unnecessary services/ports exposed?
- [ ] Directory listing enabled?
- [ ] Verbose error messages leaking stack traces?
- [ ] CORS misconfiguration (wildcard origins?)
- [ ] Missing security headers (CSP, X-Frame-Options, X-Content-Type-Options)?
- [ ] Debug mode enabled in production?

**A06: Vulnerable Components**
- [ ] Known CVEs in dependencies (npm audit, pip safety, OWASP Dependency-Check)?
- [ ] Outdated frameworks or libraries?
- [ ] Unmaintained dependencies?

**A07: Authentication Failures**
- [ ] Brute force protection (rate limiting, CAPTCHA, lockout)?
- [ ] Password policy enforcement?
- [ ] Session fixation?
- [ ] Session timeout too long?
- [ ] Credentials in URL parameters?
- [ ] Missing MFA on sensitive operations?

**A08: Software and Data Integrity Failures**
- [ ] Unsigned or unverified updates?
- [ ] CI/CD pipeline security (secrets management, artifact integrity)?
- [ ] Deserialization of untrusted data?
- [ ] Missing subresource integrity (SRI) for CDN scripts?

**A09: Logging & Monitoring Failures**
- [ ] Failed login attempts not logged?
- [ ] Sensitive actions not audited?
- [ ] Logs containing sensitive data (passwords, tokens, PII)?
- [ ] No alerting on suspicious activity?

**A10: Server-Side Request Forgery (SSRF)**
- [ ] URL parameters that fetch external resources?
- [ ] Webhook URLs that could target internal services?
- [ ] Image/file URL processing without validation?
- [ ] Internal metadata endpoints accessible (cloud metadata service)?

#### API-Specific Checks

- [ ] Authentication on all endpoints (not just frontend-facing)?
- [ ] Rate limiting per API key/user?
- [ ] Input validation (type, length, range, format)?
- [ ] Output filtering (no unnecessary fields in responses)?
- [ ] Pagination enforced (can't request all records at once)?
- [ ] Mass assignment protection?
- [ ] GraphQL: introspection disabled in production, query depth limits?
- [ ] File upload: type validation, size limits, no execution?

#### Infrastructure Checks

- [ ] Open ports beyond what's needed?
- [ ] SSH: key-based auth only, no root login?
- [ ] Database: not publicly accessible?
- [ ] S3 buckets: no public access unless intentional?
- [ ] IAM: least privilege principle?
- [ ] Secrets in environment variables, not code?
- [ ] Network segmentation between environments?

### Phase 4: Reporting

#### Vulnerability Report Template

```markdown
# Security Assessment Report

## Executive Summary
[2-3 paragraphs for non-technical stakeholders. Total findings count by severity. Overall risk assessment.]

## Scope
- Target: [application/system name and URLs]
- Testing period: [dates]
- Methodology: [OWASP, PTES, custom]
- Out of scope: [what was not tested]

## Findings Summary

| ID | Title | Severity | Status |
|----|-------|----------|--------|
| V-001 | [title] | Critical | Open |
| V-002 | [title] | High | Open |

## Detailed Findings

### V-001: [Vulnerability Title]

**Severity**: Critical | High | Medium | Low | Informational
**CVSS Score**: X.X
**CWE**: CWE-XXX
**Affected Component**: [URL/endpoint/service]

**Description**
[What the vulnerability is, in clear terms]

**Impact**
[What an attacker could do. Business impact.]

**Steps to Reproduce**
1. [Step-by-step reproduction]
2. [Include requests/responses if applicable]

**Evidence**
[Screenshots, request/response pairs, proof of concept]

**Remediation**
[Specific fix with code example if applicable]

**References**
[OWASP, CWE, CVE links]
```

#### Severity Rating (CVSS-aligned)

| Severity | CVSS | Example |
|----------|------|---------|
| Critical | 9.0-10.0 | RCE, SQL injection with data exfiltration, auth bypass |
| High | 7.0-8.9 | Stored XSS, IDOR on sensitive data, privilege escalation |
| Medium | 4.0-6.9 | CSRF, information disclosure, missing security headers |
| Low | 0.1-3.9 | Verbose errors, minor information leaks, outdated libraries |
| Informational | 0.0 | Best practice recommendations, hardening suggestions |

## Security Testing Tools Reference

| Purpose | Tools |
|---------|-------|
| Web scanning | OWASP ZAP, Burp Suite, Nikto |
| Dependency audit | npm audit, Snyk, OWASP Dependency-Check, Trivy |
| Static analysis | SonarQube, Semgrep, CodeQL |
| Secret scanning | GitLeaks, TruffleHog, git-secrets |
| Container scanning | Trivy, Grype, Docker Scout |
| Infrastructure | ScoutSuite, Prowler (AWS), checkov |
| SSL/TLS | testssl.sh, SSL Labs |
| DNS | dig, nslookup, subfinder, amass |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [camilooscargbaptista](https://github.com/camilooscargbaptista)
- **Source:** [camilooscargbaptista/cto-toolkit](https://github.com/camilooscargbaptista/cto-toolkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-camilooscargbaptista-cto-toolkit-pentest
- Seller: https://agentstack.voostack.com/s/camilooscargbaptista
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.