[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-4dceafc8-6a94-4399-aabf-547cb3a4df1b":3,"$f-MYg6Dn8aKDALkMPVvlwAHJ-vtBuEqqqZsKFnQQjPD8":43},{"id":4,"title":5,"description":6,"categoryId":7,"moduleId":8,"tags":9,"prompt":10,"icon":11,"source":12,"sourceUrl":13,"authorId":14,"authorName":15,"isPublic":16,"stars":17,"runs":18,"createdAt":19,"updatedAt":19,"module":20,"category":27,"packages":34},"4dceafc8-6a94-4399-aabf-547cb3a4df1b","security-pen-testing","使用时，当用户请求进行安全审计、渗透测试、漏洞扫描、OWASP Top 10检查或攻击性安全评估时。涵盖静态分析、依赖扫描、秘密检测、API安全测试和渗透测试报告生成。","cat_coding_review","mod_coding","alirezarezvani,coding","---\nname: \"security-pen-testing\"\ndescription: \"Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.\"\n---\n\n# Security Penetration Testing\n\nHands-on offensive security testing skill for finding vulnerabilities before attackers do. This is NOT compliance checking (see senior-secops) or security policy writing (see senior-security) — this is about systematic vulnerability discovery through authorized testing.\n\n---\n\n## Table of Contents\n\n- [Overview](#overview)\n- [OWASP Top 10 Systematic Audit](#owasp-top-10-systematic-audit)\n- [Static Analysis](#static-analysis)\n- [Dependency Vulnerability Scanning](#dependency-vulnerability-scanning)\n- [Secret Scanning](#secret-scanning)\n- [API Security Testing](#api-security-testing)\n- [Web Vulnerability Testing](#web-vulnerability-testing)\n- [Infrastructure Security](#infrastructure-security)\n- [Pen Test Report Generation](#pen-test-report-generation)\n- [Responsible Disclosure Workflow](#responsible-disclosure-workflow)\n- [Workflows](#workflows)\n- [Anti-Patterns](#anti-patterns)\n- [Cross-References](#cross-references)\n\n---\n\n## Overview\n\n### What This Skill Does\n\nThis skill provides the methodology, checklists, and automation for **offensive security testing** — actively probing systems to discover exploitable vulnerabilities. It covers web applications, APIs, infrastructure, and supply chain security.\n\n### Distinction from Other Security Skills\n\n| Skill | Focus | Approach |\n|-------|-------|----------|\n| **security-pen-testing** (this) | Finding vulnerabilities | Offensive — simulate attacker techniques |\n| senior-secops | Security operations | Defensive — monitoring, incident response, SIEM |\n| senior-security | Security policy | Governance — policies, frameworks, risk registers |\n| skill-security-auditor | CI\u002FCD gates | Automated — pre-merge security checks |\n\n### Prerequisites\n\nAll testing described here assumes **written authorization** from the system owner. Unauthorized testing is illegal under the CFAA and equivalent laws worldwide. Always obtain a signed scope-of-work or rules-of-engagement document before starting.\n\n---\n\n## OWASP Top 10 Systematic Audit\n\nUse the vulnerability scanner tool for automated checklist generation:\n\n```bash\n# Generate OWASP checklist for a web application\npython scripts\u002Fvulnerability_scanner.py --target web --scope full\n\n# Quick API-focused scan\npython scripts\u002Fvulnerability_scanner.py --target api --scope quick --json\n```\n\n### Quick Reference\n\n| # | Category | Key Tests |\n|---|----------|-----------|\n| A01 | Broken Access Control | IDOR, vertical escalation, CORS, JWT claim manipulation, forced browsing |\n| A02 | Cryptographic Failures | TLS version, password hashing, hardcoded keys, weak PRNG |\n| A03 | Injection | SQLi, NoSQLi, command injection, template injection, XSS |\n| A04 | Insecure Design | Rate limiting, business logic abuse, multi-step flow bypass |\n| A05 | Security Misconfiguration | Default credentials, debug mode, security headers, directory listing |\n| A06 | Vulnerable Components | Dependency audit (npm\u002Fpip\u002Fgo), EOL checks, known CVEs |\n| A07 | Auth Failures | Brute force, session cookie flags, session invalidation, MFA bypass |\n| A08 | Integrity Failures | Unsafe deserialization, SRI checks, CI\u002FCD pipeline integrity |\n| A09 | Logging Failures | Auth event logging, sensitive data in logs, alerting thresholds |\n| A10 | SSRF | Internal IP access, cloud metadata endpoints, DNS rebinding |\n\n```bash\n# Audit dependencies\npython scripts\u002Fdependency_auditor.py --file package.json --severity high\npython scripts\u002Fdependency_auditor.py --file requirements.txt --json\n```\n\nSee [owasp_top_10_checklist.md](references\u002Fowasp_top_10_checklist.md) for detailed test procedures, code patterns to detect, remediation steps, and CVSS scoring guidance for each category.\n\n---\n\n## Static Analysis\n\n**Recommended tools:** CodeQL (custom queries for project-specific patterns), Semgrep (rule-based scanning with auto-fix), ESLint security plugins (`eslint-plugin-security`, `eslint-plugin-no-unsanitized`).\n\nKey patterns to detect: SQL injection via string concatenation, hardcoded JWT secrets, unsafe YAML\u002Fpickle deserialization, missing security middleware (e.g., Express without Helmet).\n\nSee [attack_patterns.md](references\u002Fattack_patterns.md) for code patterns and detection payloads across injection types.\n\n---\n\n## Dependency Vulnerability Scanning\n\n**Ecosystem commands:** `npm audit`, `pip audit`, `govulncheck .\u002F...`, `bundle audit check`\n\n**CVE Triage Workflow:**\n1. **Collect** — Run ecosystem audit tools, aggregate findings\n2. **Deduplicate** — Group by CVE ID across direct and transitive deps\n3. **Prioritize** — Critical + exploitable + reachable = fix immediately\n4. **Remediate** — Upgrade, patch, or mitigate with compensating controls\n5. **Verify** — Rerun audit to confirm fix, update lock files\n\n```bash\npython scripts\u002Fdependency_auditor.py --file package.json --severity critical --json\n```\n\n---\n\n## Secret Scanning\n\n**Tools:** TruffleHog (git history + filesystem), Gitleaks (regex-based with custom rules).\n\n```bash\n# Scan git history for verified secrets\ntrufflehog git file:\u002F\u002F. --only-verified --json\n\n# Scan filesystem\ntrufflehog filesystem . --json\n```\n\n**Integration points:** Pre-commit hooks (gitleaks, trufflehog), CI\u002FCD gates (GitHub Actions with `trufflesecurity\u002Ftrufflehog@main`). Configure `.gitleaks.toml` for custom rules (AWS keys, API keys, private key headers) and allowlists for test fixtures.\n\n---\n\n## API Security Testing\n\n### Authentication Bypass\n\n- **JWT manipulation:** Change `alg` to `none`, RS256-to-HS256 confusion, claim modification (`role: \"admin\"`, `exp: 9999999999`)\n- **Session fixation:** Check if session ID changes after authentication\n\n### Authorization Flaws\n\n- **IDOR\u002FBOLA:** Change resource IDs in every endpoint — test read, update, delete across users\n- **BFLA:** Regular user tries admin endpoints (expect 403)\n- **Mass assignment:** Add privileged fields (`role`, `is_admin`) to update requests\n\n### Rate Limiting & GraphQL\n\n- **Rate limiting:** Rapid-fire requests to auth endpoints; expect 429 after threshold\n- **GraphQL:** Test introspection (should be disabled in prod), query depth attacks, batch mutations bypassing rate limits\n\nSee [attack_patterns.md](references\u002Fattack_patterns.md) for complete JWT manipulation payloads, IDOR testing methodology, BFLA endpoint lists, GraphQL introspection\u002Fdepth\u002Fbatch attack patterns, and rate limiting bypass techniques.\n\n---\n\n## Web Vulnerability Testing\n\n| Vulnerability | Key Tests |\n|--------------|-----------|\n| **XSS** | Reflected (script\u002Fimg\u002Fsvg payloads), Stored (persistent fields), DOM-based (innerHTML + location.hash) |\n| **CSRF** | Replay without token (expect 403), cross-session token replay, check SameSite cookie attribute |\n| **SQL Injection** | Error-based (`' OR 1=1--`), union-based enumeration, time-based blind (`SLEEP(5)`), boolean-based blind |\n| **SSRF** | Internal IPs, cloud metadata endpoints (AWS\u002FGCP\u002FAzure), IPv6\u002Fhex\u002Fdecimal encoding bypasses |\n| **Path Traversal** | `..\u002F..\u002F..\u002Fetc\u002Fpasswd`, URL encoding, double encoding bypasses |\n\nSee [attack_patterns.md](references\u002Fattack_patterns.md) for complete test payloads (XSS filter bypasses, context-specific XSS, SQL injection per database engine, SSRF bypass techniques, and DOM-based XSS source\u002Fsink pairs).\n\n---\n\n## Infrastructure Security\n\n**Key checks:**\n- **Cloud storage:** S3 bucket public access (`aws s3 ls s3:\u002F\u002Fbucket --no-sign-request`), bucket policies, ACLs\n- **HTTP security headers:** HSTS, CSP (no `unsafe-inline`\u002F`unsafe-eval`), X-Content-Type-Options, X-Frame-Options, Referrer-Policy\n- **TLS configuration:** `nmap --script ssl-enum-ciphers -p 443 target.com` or `testssl.sh` — reject TLS 1.0\u002F1.1, RC4, 3DES, export-grade ciphers\n- **Port scanning:** `nmap -sV target.com` — flag dangerous open ports (FTP\u002F21, Telnet\u002F23, Redis\u002F6379, MongoDB\u002F27017)\n\n---\n\n## Pen Test Report Generation\n\nGenerate professional reports from structured findings:\n\n```bash\n# Generate markdown report from findings JSON\npython scripts\u002Fpentest_report_generator.py --findings findings.json --format md --output report.md\n\n# Generate JSON report\npython scripts\u002Fpentest_report_generator.py --findings findings.json --format json --output report.json\n```\n\n### Findings JSON Format\n\n```json\n[\n  {\n    \"title\": \"SQL Injection in Login Endpoint\",\n    \"severity\": \"critical\",\n    \"cvss_score\": 9.8,\n    \"cvss_vector\": \"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H\",\n    \"category\": \"A03:2021 - Injection\",\n    \"description\": \"The \u002Fapi\u002Flogin endpoint is vulnerable to SQL injection via the email parameter.\",\n    \"evidence\": \"Request: POST \u002Fapi\u002Flogin {\\\"email\\\": \\\"' OR 1=1--\\\", \\\"password\\\": \\\"x\\\"}\\nResponse: 200 OK with admin session token\",\n    \"impact\": \"Full database access, authentication bypass, potential remote code execution\",\n    \"remediation\": \"Use parameterized queries. Replace string concatenation with prepared statements.\",\n    \"references\": [\"https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F89.html\"]\n  }\n]\n```\n\n### Report Structure\n\n1. **Executive Summary**: Business impact, overall risk level, top 3 findings\n2. **Scope**: What was tested, what was excluded, testing dates\n3. **Methodology**: Tools used, testing approach (black\u002Fgray\u002Fwhite box)\n4. **Findings Table**: Sorted by severity with CVSS scores\n5. **Detailed Findings**: Each with description, evidence, impact, remediation\n6. **Remediation Priority Matrix**: Effort vs. impact for each fix\n7. **Appendix**: Raw tool output, full payload lists\n\n---\n\n## Responsible Disclosure Workflow\n\nResponsible disclosure is **mandatory** for any vulnerability found during authorized testing. Standard timeline: report on day 1, follow up at day 7, status update at day 30, public disclosure at day 90.\n\n**Key principles:** Never exploit beyond proof of concept, encrypt all communications, do not access real user data, document everything with timestamps.\n\nSee [responsible_disclosure.md](references\u002Fresponsible_disclosure.md) for full disclosure timelines (standard 90-day, accelerated 30-day, extended 120-day), communication templates, legal considerations, bug bounty program integration, and CVE request process.\n\n---\n\n## Workflows\n\n### Workflow 1: Quick Security Check (15 Minutes)\n\nFor pre-merge reviews or quick health checks:\n\n```bash\n# 1. Generate OWASP checklist\npython scripts\u002Fvulnerability_scanner.py --target web --scope quick\n\n# 2. Scan dependencies\npython scripts\u002Fdependency_auditor.py --file package.json --severity high\n\n# 3. Check for secrets in recent commits\n# (Use gitleaks or trufflehog as described in Secret Scanning section)\n\n# 4. Review HTTP security headers\ncurl -sI https:\u002F\u002Ftarget.com | grep -iE \"(strict-transport|content-security|x-frame|x-content-type)\"\n```\n\n**Decision**: If any critical or high findings, block the merge.\n\n### Workflow 2: Full Penetration Test (Multi-Day Assessment)\n\n**Day 1 — Reconnaissance:**\n1. Map the attack surface: endpoints, authentication flows, third-party integrations\n2. Run automated OWASP checklist (full scope)\n3. Run dependency audit across all manifests\n4. Run secret scan on full git history\n\n**Day 2 — Manual Testing:**\n1. Test authentication and authorization (IDOR, BOLA, BFLA)\n2. Test injection points (SQLi, XSS, SSRF, command injection)\n3. Test business logic flaws\n4. Test API-specific vulnerabilities (GraphQL, rate limiting, mass assignment)\n\n**Day 3 — Infrastructure and Reporting:**\n1. Check cloud storage permissions\n2. Verify TLS configuration and security headers\n3. Port scan for unnecessary services\n4. Compile findings into structured JSON\n5. Generate pen test report\n\n```bash\n# Generate final report\npython scripts\u002Fpentest_report_generator.py --findings findings.json --format md --output pentest-report.md\n```\n\n### Workflow 3: CI\u002FCD Security Gate\n\nAutomated security checks on every PR: secret scanning (TruffleHog), dependency audit (`npm audit`, `pip audit`), SAST (Semgrep with `p\u002Fsecurity-audit`, `p\u002Fowasp-top-ten`), and security headers check on staging.\n\n**Gate Policy**: Block merge on critical\u002Fhigh findings. Warn on medium. Log low\u002Finfo.\n\n---\n\n## Anti-Patterns\n\n1. **Testing in production without authorization** — Always get written permission and use staging\u002Ftest environments when possible\n2. **Ignoring low-severity findings** — Low findings compound; a chain of lows can become a critical exploit path\n3. **Skipping responsible disclosure** — Every vulnerability found must be reported through proper channels\n4. **Relying solely on automated tools** — Tools miss business logic flaws, chained exploits, and novel attack vectors\n5. **Testing without a defined scope** — Scope creep leads to legal liability; document what is and isn't in scope\n6. **Reporting without remediation guidance** — Every finding must include actionable remediation steps\n7. **Storing evidence insecurely** — Pen test evidence (screenshots, payloads, tokens) is sensitive; encrypt and restrict access\n8. **One-time testing** — Security testing must be continuous; integrate into CI\u002FCD and schedule periodic assessments\n\n---\n\n## Cross-References\n\n| Skill | Relationship |\n|-------|-------------|\n| [senior-secops](..\u002Fsenior-secops\u002FSKILL.md) | Defensive security operations — monitoring, incident response, SIEM configuration |\n| [senior-security](..\u002Fsenior-security\u002FSKILL.md) | Security policy and governance — frameworks, risk registers, compliance |\n| [dependency-auditor](..\u002F..\u002Fengineering\u002Fdependency-auditor\u002FSKILL.md) | Deep supply chain security — SBOMs, license compliance, transitive risk |\n| [code-reviewer](..\u002Fcode-reviewer\u002FSKILL.md) | Code review practices — includes security review checklist |\n","","imported","https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills","user_system_seed","SkillOPIC",true,249,1327,"2026-05-16 13:56:47",{"id":8,"name":21,"slug":22,"icon":23,"description":24,"sort":25,"createdAt":26},"编程开发","coding","mdi-code-braces","代码生成、调试、审查，提升开发效率",2,"2026-05-16 12:53:40",{"id":7,"name":28,"slug":29,"icon":30,"description":31,"moduleId":8,"sort":32,"skillCount":33,"createdAt":26},"代码审查","review","mdi-magnify-scan","代码质量分析、安全审查",4,145,[35],{"id":36,"skillId":4,"version":37,"fileName":38,"fileSize":39,"filePath":40,"fileHash":41,"manifest":42,"createdAt":19},"18864616-cfa8-4d4e-8d7a-f532eaaccfdf","1.0.0","security-pen-testing.zip",41958,"uploads\u002Fskills\u002F4dceafc8-6a94-4399-aabf-547cb3a4df1b\u002Fsecurity-pen-testing.zip","6cb6fca12cc1395bcfd5f122fa342aa9df1ff3e946eea8bb0cc4b059bc0fdbaa","[{\"path\":\"SKILL.md\",\"isDirectory\":false,\"size\":13923},{\"path\":\"references\u002Fattack_patterns.md\",\"isDirectory\":false,\"size\":15372},{\"path\":\"references\u002Fowasp_top_10_checklist.md\",\"isDirectory\":false,\"size\":18137},{\"path\":\"references\u002Fresponsible_disclosure.md\",\"isDirectory\":false,\"size\":11452},{\"path\":\"scripts\u002Fdependency_auditor.py\",\"isDirectory\":false,\"size\":21056},{\"path\":\"scripts\u002Fpentest_report_generator.py\",\"isDirectory\":false,\"size\":19028},{\"path\":\"scripts\u002Fvulnerability_scanner.py\",\"isDirectory\":false,\"size\":27269}]",{"code":44,"message":45,"data":46},200,"success",{"items":47,"stats":48,"page":51},[],{"averageRating":49,"totalRatings":49,"ratingCounts":50},0,[49,49,49,49,49],{"limit":52,"offset":49,"hasMore":53,"nextOffset":52,"ratedOnly":16},15,false]