pentest-framework

Plugin pentest-framework from marketplace sabania-pentest-cli in sabania/pentest-cli. Commands read from the repo's manifest — 1 month ago.

Skills (12)

• business-logic

  Business logic and authorization testing. IDOR, privilege escalation, workflow bypass, payment manipulation.

• cli-reference

  Show all available pentest-cli commands and how to use them.

• pentest-advanced

  Advanced attack testing. Request smuggling, race conditions, cache poisoning, subdomain takeover.

• pentest-auth

  Authentication and session security testing. JWT, OAuth, sessions, brute force.

• pentest-cloud

  Cloud and infrastructure testing. Storage misconfig, WAF detection, email security.

• pentest-discover

  Discovery scan. JS bundles, API endpoints, GraphQL, secrets, BaaS backends.

• pentest-full

  Complete security audit. Runs ALL passive + active tests and generates report.

• pentest-inject

  Injection testing. SQLi, XSS, SSTI, SSRF, and more. Requires user consent for active testing.

• pentest-recon

  Full reconnaissance scan on a deployed app. Subdomains, DNS, ports, tech stack, OSINT.

• pentest-report

  Generate PDF security report from findings.

• pentest-scan

  Security configuration scan. Headers, SSL/TLS, CORS, SRI checks.

• setup

  Install pentest-cli and verify the security testing environment. Run this first.

Subagents (8)

• advanced-agent

  Advanced attack specialist. Tests request smuggling, race conditions, cache poisoning, subdomain takeover.

• auth-agent

  Authentication and session tester. Analyzes JWT tokens, OAuth flows, session management, credential attacks.

• discovery-agent

  Discovery specialist. Reverse engineers JS bundles, finds API endpoints, probes BaaS backends.

• injection-agent

  Injection tester. Tests SQLi, XSS, SSTI, SSRF, XXE, and other injection vectors.

• logic-agent

  Business logic analyst. Tests IDOR, privilege escalation, payment bypass, workflow manipulation, and authorization flaws.

• recon-agent

  Reconnaissance specialist. Maps attack surface: subdomains, ports, DNS, tech stack, OSINT.

• report-agent

  Report generator. Aggregates all findings into a professional PDF security report.

• scanner-agent

  Configuration scanner. Tests security headers, SSL/TLS, CORS, WAF, and web server hardening.