pentest

Plugin pentest from marketplace claude-pentest in Stickman230/claude-pentest. Commands read from the repo's manifest — 1 month ago.

Skills (7)

• authenticating

  Authentication testing skill - automates signup, login, 2FA bypass, CAPTCHA solving, and bot detection evasion using Playwright MCP. Tests authentication security controls. Includes behavioral biometrics simulation, OTP handling, and automated account creation for security assessments.

• common-appsec-patterns

  Application security testing coordinator for common vulnerability patterns including XSS, injection flaws, and client-side security issues. Orchestrates specialized testing agents to identify and validate common application security weaknesses.

• cve-testing

  CVE vulnerability testing coordinator that identifies technology stacks, researches known vulnerabilities, and tests applications for exploitable CVEs using public exploits and proof-of-concept code.

• domain-assessment

  Domain reconnaissance coordinator that orchestrates subdomain discovery and port scanning to build comprehensive domain attack surface inventory

• mks

  MKS (Metasploit-Kali Server) tool preference guide. Mount in Phase 0/1 alongside the primary skill. Provides URL resolution, REST endpoint patterns, response parsing, error handling, and fallback rules for all MKS-backed Kali tools.

• pentest

  Penetration testing orchestrator that coordinates specialized attack agents. Provides attack indexes, methodology frameworks, and documentation. Execution delegated to specialized agents (SQL Injection, XSS, SSRF, etc.). Use for engagement planning and attack coordination.

• web-application-mapping

  Comprehensive web application reconnaissance and mapping coordinator that orchestrates passive browsing, active endpoint discovery, attack surface analysis, and headless browser automation for complete application coverage.

Slash commands (5)

• /pentest:pentest-attacks

  Define the attack profile for an engagement — select which attack categories and skills to use. Saves to .pentest-attacks.json. If run before /pentest:pentest, the orchestrator will respect the selection. If run standalone, does not launch a pentest.

• /pentest:pentest-exit

  Close pentest session — summarizes findings, ensures outputs are saved, lifts isolation, and prompts for /clear

• /pentest:pentest-kali

  Connect to a Metasploit-Kali Server (MKS) REST API — verifies connectivity, discovers available Kali tools, and configures agents to prefer MKS endpoints over local Bash equivalents.

• /pentest:pentest-scope

  Define or update engagement scope — saves scope to disk without launching a pentest. Can be run before or during an engagement. If a pentest is active and the target changes drastically, warns the operator and suggests a new engagement.

• /pentest:pentest

  Activate pentest mode — displays ASCII art, configures session isolation, collects engagement scope, then OWNS the engagement: pre-flight, recon, planning (via the pentester-orchestrator planner), executor dispatch, a time-budget quota loop, aggregation, and report generation.

Subagents (15)

• csp-bypass-tester

  Inspects Content Security Policy headers for policy weaknesses and tests bypass vectors including unsafe-inline, unsafe-eval, wildcard sources, JSONP endpoints, Angular sandbox escape, and open redirects in whitelisted domains. Uses Playwright for browser-based CSP inspection and script execution te

• csrf-tester

  Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override. Generates browser-loadable PoC HTML for confirmed findings. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

• cve-tester

  Identifies technology stacks, researches known CVEs in NVD/Exploit-DB/GitHub, adapts public PoC exploits, and validates exploitability against live targets. Follows 4-phase workflow. Deployed by cve-testing skill coordinator.

• domain-assessment

  Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate transparency), port scanning (nmap, masscan), and service enumeration. Builds attack surface inventory. Follows 4-phase workflow. Deployed by domain-assessment skill coordinat

• injection-tester

  Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap for automated SQLi detection and curl for manual probing. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

• inventory-api-discovery

  Discovers REST API endpoints, GraphQL schemas, SOAP/WSDL services, WebSocket connections, and API documentation (Swagger/OpenAPI/Postman). Enumerates versioned APIs (v1/v2/v3) and undocumented endpoints. Produces structured API endpoint inventory. Follows 4-phase workflow. Deployed by web-applicatio

• inventory-directory-scanner

  Runs active directory and file brute-forcing using ffuf, gobuster, feroxbuster, nikto, and dirsearch to discover directories, files, backup files, configuration files, admin panels, and hidden resources. Produces structured directory inventory. Follows 4-phase workflow. Deployed by web-application-m

• inventory-javascript-mapper

  Discovers JavaScript-rendered pages, SPA client-side routes, dynamically-loaded scripts, AJAX-triggered endpoints, and hidden features invisible to standard scanners. Uses Playwright headless browser automation to execute JavaScript and extract framework route registries (React Router, Vue Router, A

• inventory-software-catalog

  Identifies and catalogs all dependencies, frameworks, libraries, and versions across backend and frontend stacks. Generates a Software Bill of Materials (SBOM) and correlates component versions against known CVE databases to flag components needing CVE testing. Follows 4-phase workflow. Deployed by

• inventory-surface-analyzer

  Synthesizes outputs from all four mapping agents (software-catalog, directory-scanner, api-discovery, javascript-mapper) into a unified attack surface report. Categorizes surfaces by type and risk, deduplicates overlapping findings, and produces a prioritized testing checklist. Reads-only from prior

• patt-fetcher

  On-demand PayloadsAllTheThings fetcher. Use when a pentest agent needs full payloads not in local payloads/ files. Input: PATT category name (see URL Map). Output: relevant payloads extracted from PATT GitHub raw content.

• Pentester Executor

  Executes specific vulnerability tests. Follows 4-phase workflow (Recon → Experiment → Test → Verify), generates PoCs, captures evidence. Specialized by attack type.

• Pentester Orchestrator

  Penetration-test PLANNER. Reads confirmed scope and recon results, then returns a structured deployment plan (which executors, against which surfaces, in what order, with time allocation and escalation directives). Does NOT deploy executors itself — the /pentest:pentest command (main session) owns d

• prototype-pollution-tester

  Tests for client-side JavaScript prototype pollution via URL query parameters, hash fragments, and JSON payloads. Verifies pollution by evaluating Object.prototype in browser DOM via Playwright. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

• xss-tester

  Tests for reflected, stored, and DOM-based XSS vulnerabilities across HTML, attribute, JavaScript, URL, and CSS contexts. Covers framework-specific sinks (React dangerouslySetInnerHTML, Vue v-html, Angular bypass), WAF evasion, and CSP bypass techniques. Uses Playwright for browser-based evidence ca

Similar plugins