claude-extpt

Plugin claude-extpt from marketplace claude-extpt in xcoy0te/Claude-ExternalPentest. Commands read from the repo's manifest — 6 days ago.

Skills (10)

• ext-cloud-and-takeover

  External cloud-exposure and DNS hygiene testing for an authorized pentest - subdomain takeover (dangling CNAME/NS/MX against the can-i-take-over-xyz fingerprint DB), exposed cloud storage (AWS S3, Azure Blob, GCP buckets), and cloud asset discovery. Use when recon surfaces dangling DNS records or th

• ext-compliance-mapping

  A high-level conceptual mapping from EXTERNAL-pentest finding classes to the compliance controls they relate to. Weak/legacy TLS relates to crypto-in-transit, so it brushes PCI-DSS 4.2.1, NIS2 Art.21(2)(h), ISO/IEC 27001 A.8.24; an internet-exposed admin interface relates to network exposure and sec

• ext-methodology

  The order of operations for an authorized EXTERNAL penetration test, aligned to PTES (7 phases) and OWASP WSTG. Use whenever planning or driving an external assessment and you need to know what to run before what - pre-engagement/scope, passive intelligence gathering (OSINT), active recon & enumerat

• ext-opsec-reporting

  OPSEC and reporting guidance for an authorized external pentest - what is loud or risky (DoS-adjacent scans, brute force, intrusive nuclei/sqlmap), how to stay attributable, in-scope and rate-limited, plus how to structure findings (CVSS v3.1 severity, evidence, reproduction, business impact, remedi

• ext-passive-osint

  The passive intelligence-gathering phase of an authorized external pentest - mapping an organization's external attack surface with little or no traffic to the target. Covers ASN/IP-range discovery, reverse-WHOIS, certificate transparency, passive subdomain enumeration, DNS records, tech fingerprint

• ext-recon-enum

  The active recon and enumeration command reference for an authorized external pentest - host discovery, port scanning (nmap/naabu/masscan) with rate control, service/version detection, TLS testing, HTTP probing and fingerprinting (httpx/whatweb), screenshots, content discovery (ffuf/feroxbuster/kata

• ext-service-attacks

  Enumerating and (on approval) testing common non-web external services exposed on a perimeter - SSH, FTP, SMB, RDP, SMTP/IMAP/POP3, DNS, databases (MySQL/MSSQL/Postgres/Redis/Mongo), VPN/SSL-VPN portals, and admin/remote-management panels. Use when an external host exposes a non-HTTP service and you

• ext-tooling-setup

  How to verify and install the standard external-pentest toolchain before running the plugin, and what to substitute when a tool is missing. Use at the start of an engagement to check the box has the required binaries and wordlists, or when a command fails because a tool is not installed. Covers the

• ext-udp-services

  The UDP-services enumeration and safe-testing checklist for an authorized external pentest - the counterpart to ext-service-attacks (which is TCP-focused). Use whenever a UDP scan (nmap -sU) or an unprivileged probe surfaces an open/open|filtered UDP port, or a firewall/VPN appliance is in scope. Co

• ext-web-testing

  A non-destructive external web-application testing checklist mapped to the OWASP Web Security Testing Guide (WSTG) 12 categories - information gathering (INFO), configuration/deployment (CONF), identity (IDNT), authentication (ATHN), authorization (ATHZ), session (SESS), input validation (INPV incl.

Slash commands (5)

• /claude-extpt:ext-attack-paths

  Launch the ext-attack-planner agent to reason from the enumerated exposures to likely footholds, then present a ranked plan for human approval before any exploitation.

• /claude-extpt:ext-exploit

  Execute ONE approved step from the external attack plan via the ext-exploit-operator agent, with human confirmation before anything intrusive. Reads the scope and attack plan; records exactly what ran for the report.

• /claude-extpt:ext-recon

  Launch the ext-enumerator agent to run passive+active recon and service/web enumeration against the in-scope targets, producing a structured inventory for the attack planner.

• /claude-extpt:ext-report

  Launch the ext-reporter agent to turn the external-pentest engagement artifacts (scope, inventory, attack plan, loot) into a structured client report - executive summary, severity-ranked findings with evidence and remediation, detection notes, compliance-control mapping, and a command appendix. Prod

• /claude-extpt:ext-scope

  Define and record the scope of an authorized external penetration test (target IPs/hostnames, out-of-scope, window, rate limits, forbidden actions) into a per-engagement scope file the other commands read.

Subagents (4)

• ext-attack-planner

  Reasons from an external-pentest inventory to the most likely footholds in an authorized engagement. Correlates services/versions/web findings/cloud exposure with known vulns, default creds, misconfigurations and takeovers, and presents a ranked, human-approved plan mapped to CVSS. It plans and expl

• ext-enumerator

  Runs the RECON + ENUMERATION phase of an authorized external penetration test against the in-scope targets (IPs, CIDRs, hostnames, or wildcard domains) defined in scope.md. Starts with passive OSINT, then active discovery, driving standard tools (subfinder, dnsx, httpx, naabu/nmap, testssl, nuclei,

• ext-exploit-operator

  Executes ONE approved step from an external-pentest attack plan in an authorized engagement. Runs the specific check/exploit with care, ALWAYS asks for human confirmation before any intrusive or state-changing action, stays in scope, avoids anything that risks disruption, and records exactly what ra

• ext-reporter

  Turns the artifacts of an authorized external penetration test (scope, inventory, attack plan, recon/loot) into a structured client report - executive summary, scope, methodology, severity-ranked findings with CVSS/evidence/reproduction/impact/remediation, detection notes, remediation roadmap, and a

Similar plugins