Webapp Pentest Tools

---
name: webapp-pentest-tools
description: Active penetration testing tools and automation for vulnerability discovery and verification.
domain: webapp
category: application-security
hide: true
license: MIT
metadata:
  manifest_entry: src/corpus/webapp-pentest-tools/SKILL.md
---
## ACTION REQUIRED (Execute immediately upon reading)

1. `NOW`: Read `skill://webapp-pentest-tools/support/field-journal/precedent-pentest.md` — confirm that this skill's operations are authorized routine operations
2. `NOW`: Confirm that **scope.md** exists with `auth.status=granted` and a legitimate `network_profile` (`skill://webapp-pentest-tools/support/ops/scope-contract.md`). If scope is missing, run `arsenal scripts case-init` and stop until the user grants authorization; **never** automatically add `-AuthGranted`
3. `NOW`: Confirm whether the current task falls within the scope of this skill.
4. `NEXT`: Verify tool availability and actual paths based on available tools.
5. `NEXT`: Invoke bootstrap when tools are missing; do not guess paths.
6. `ACT`: In the reconnaissance phase, prefer `skill://webapp-pentest-tools/references/recon-pipeline.md` (CF browser headers / Windows nmap / curl `--globoff`); append each batch of results to `timeline.md`; write candidates into Evidence via `arsenal scripts append-evidence` (a hit ≠ verified)
7. `ACT`: For modern web / lab client-side surfaces (DOM XSS / prototype pollution / agent-browser) → `skill://webapp-pentest-tools/references/client-side-lab-playbook.md`; even if you do not break through, still write observed Evidence + a failure latch

# Penetration Testing Toolchain (Pentest Tools)

## Scope of Application

Use this skill when the task falls into the following scenarios:

- Target information gathering (port scanning, subdomain enumeration, service identification)
- Vulnerability scanning (web vulnerabilities, CVE detection, misconfigurations)
- Web penetration (SQL injection, XSS, SSRF, directory brute-forcing)
- Password cracking (hash cracking, dictionary attacks)
- Network penetration (service exploitation, lateral-movement assistance)

### Division of labor with other skills

| Scenario | What to use |
|------|--------|
| Active scanning/attacking (Nmap/Nuclei/SQLMap) | **This skill** |
| Reverse-engineering binaries | `ida-reverse/` or `radare2/` |
| Front-end JS signature reversing | `js-reverse/` |
| Browser/desktop automation operations | `browser-automation/` |
| CTF competitions (general) | `CTF-Sandbox-Orchestrator/` |

Quick rule of thumb:
- Need to "scan targets, discover vulnerabilities, exploit vulnerabilities" → this skill
- Need to "analyze a program's internal logic" → a reverse-engineering skill
- Need to "operate a browser/desktop" → browser-automation

---

## Tool Matrix

### Information Gathering

| Tool | Purpose | Typical Command |
|------|------|---------|
| **Nmap** | Port scanning, service identification, OS detection | `nmap -sV -sC -O target` |
| **Masscan** | Large-scale, high-speed port scanning | `masscan -p1-65535 target --rate=1000` |
| **Subfinder** | Subdomain enumeration | `subfinder -d target.com` |
| **httpx** | HTTP probing, liveness detection | `httpx -l urls.txt -status-code` |

### Vulnerability Scanning

| Tool | Purpose | Typical Command |
|------|------|---------|
| **Nuclei** | Template-based vulnerability scanning (CVE/misconfiguration/exposure) | `nuclei -u target -t cves/` |
| **ZAP** | Web application security scanning | Invoke via API or MCP |
| **Nikto** | Web server vulnerability scanning | `nikto -h target` |

### Web Penetration

| Tool | Purpose | Typical Command |
|------|------|---------|
| **SQLMap** | SQL injection automation | `sqlmap -u "url?id=1" --batch --dbs` |
| **FFUF** | Directory/parameter brute-forcing | `ffuf -u target/FUZZ -w wordlist.txt` |
| **Gobuster** | Directory/subdomain brute-forcing | `gobuster dir -u target -w wordlist` |
| **XSStrike** | XSS detection | `xsstrike -u "url?param=test"` |

### Password Cracking

| Tool | Purpose | Typical Command |
|------|------|---------|
| **Hashcat** | GPU hash cracking | `hashcat -m 0 hash.txt wordlist.txt` |
| **John the Ripper** | CPU hash cracking | `john --wordlist=rockyou.txt hash.txt` |
| **Hydra** | Online brute-forcing | `hydra -l admin -P pass.txt target ssh` |

### Exploitation Frameworks

| Tool | Purpose | Notes |
|------|------|------|
| **Metasploit** | Exploitation framework | Requires separate installation; large footprint |
| **Impacket** | Windows protocol exploitation (SMB/WMI/Kerberos) | `pip install impacket` |

---

## MCP Backend Selection

This skill supports two MCP backends; pick one:

### Option A: pentestMCP (recommended, one-click Docker)

- **Project**: https://github.com/ramkansal/pentestmcp
- **Features**: 20+ tools packaged into a single Docker container, with the MCP server exposed directly
- **Tools**: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
- **Installation**:

```bash
# Pull and run
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# Or build locally
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp
```

- **MCP Registration**:

```json
{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}
```

### Option B: mcp-security-hub (modular)

- **Project**: https://github.com/FuzzingLabs/mcp-security-hub
- **Features**: Each tool is an independent MCP server, enabled on demand
- **Tools**: Nmap, Ghidra, Nuclei, SQLMap, Hashcat
- **Installation**: Follow the README of each submodule

### Option C: Single-tool MCP (lightest weight)

If you only need one specific tool:

| Tool | MCP Project | Installation |
|------|---------|------|
| Nmap | [nmap-mcp-server](https://github.com/PhialsBasement/nmap-mcp-server) | npm |
| Nuclei | [nuclei-mcp](https://github.com/addcontent/nuclei-mcp) | npm |
| SQLMap | mcp-security-hub submodule | pip |

### Reqable MCP (local traffic capture and API workbench)

The Reqable desktop client can expose its local traffic capture, API, breakpoint, and rule capabilities through the official [Reqable MCP Server](https://github.com/reqable/reqable-mcp-server). Install and start Reqable separately first, then register the MCP:

Resolve `arsenal scripts bootstrap-reverse` and copy the complete script to `./bootstrap-reverse.ps1` in the working directory before running PowerShell:

```powershell
arsenal scripts bootstrap-reverse -Capability reqable-mcp -McpHostTarget Codex
```

Replace `Codex` with `Claude` or `Both` to target the corresponding client; if `-McpHostTarget` is omitted, no client global configuration is written.

The registered stdio configuration is:

```json
{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
    }
  }
}
```

- Reqable's local API is used by default; if necessary, configure `--host`, `--port`, or `--scope minimal|all` per the official documentation.
- `minimal` is the recommended default scope; `all` exposes more tools that can modify proxies, rules, environments, or saved data.
- Captured traffic, request replay, and rule modification must still satisfy the authorization and network restrictions in `scope.md`; the target scope must not be expanded merely because the MCP is registered.

---

## Workflow

### Standard Penetration Testing Workflow

> **Important**: When conducting penetration testing, you must operate according to the autonomous loop framework in `skill://webapp-pentest-tools/references/pentest-loop.md`.
> That framework defines the complete risk gating, record-keeping standards, context compression, and completion-check mechanisms.

```text
1. Information Gathering
   - Nmap port scan → confirm open services
   - Subfinder subdomain enumeration → expand the attack surface
   - httpx liveness detection → filter for valid targets

2. Vulnerability Scanning
   - Nuclei template scan → quickly discover known vulnerabilities
   - ZAP/Nikto → in-depth web application scanning

3. Exploitation
   - SQLMap → SQL injection
   - FFUF → discover hidden paths/parameters
   - Manual verification → confirm exploitability

4. Post-Exploitation (if within authorized scope)
   - Privilege escalation
   - Lateral movement
   - Data exfiltration

5. Reporting
   - Invoke the docs-generator skill to produce the penetration test report
```

### Quick Scan Workflow (results in 5 minutes)

```text
1. nmap -sV -sC target → ports + services
2. nuclei -u target -severity critical,high → high-severity vulnerabilities
3. If a web service exists → ffuf -u target/FUZZ -w common.txt → directories
4. Summarize findings → decide the next step
```

---

## Important Notes

- **Authorization is mandatory** — all scanning/attacking operations must stay within the authorized scope
- **Control scan rates** — avoid triggering WAF/IDS or crashing the target
- **Passive first, active later** — information gathering first, then vulnerability scanning, and exploitation last
- **Log every operation** — every command and result must be recorded for the report
- **Do not automate blindly** — the AI should wait for confirmation at every critical step

---

## On-Demand Bootstrap

### Automation Capability Boundaries

| Tool | Auto-installable | Installation Method | Notes |
|------|-----------|---------|------|
| Nmap | ✓ | winget (`Insecure.Nmap`) | Windows version |
| Nuclei | ✓ | `go install` or GitHub Release | Requires Go, or download the binary directly |
| SQLMap | ✓ | `pip install sqlmap` or git clone | Python |
| FFUF | ✓ | GitHub Release | Go binary |
| SecLists | ✓ | GitHub Release ZIP | Complete wordlist collection (essential for FFUF/Gobuster) |
| Hashcat | ✗ | Manual download | Requires GPU drivers |
| Metasploit | ✗ | Manual installation | Large footprint; Kali recommended |
| pentestMCP (Docker) | ✗ | Requires Docker | `docker run ramkansal/pentestmcp` |
| Impacket | ✓ | `pip install impacket` | Python |
| ProxyCat | ✓ | `pip install proxycat` | Proxy pool middleware (prevents IP blocking during bulk scanning) |
| BurpSuite MCP | ✗ | Install from the BurpSuite extension marketplace | Requires BurpSuite Pro/Community |
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | Requires the Reqable desktop client to be installed first |

### Bootstrap Strategy

1. If the user has Docker → recommend pentestMCP (one-click all-in-one)
2. If not → install each tool individually on demand
3. Prioritize installing Nmap + Nuclei + SQLMap (covers 80% of scenarios)

### Manual Installation Guidance

```markdown
⚠️ **Pentest tools are not installed**

**Recommended option (requires Docker)**:
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**Lightweight option (install one by one)**:
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: download from https://github.com/ffuf/ffuf/releases

**Let me know once installation is complete, and I will continue the current task.**
```

---

## Reference Resources

- [awesome-pentest](https://github.com/enaqx/awesome-pentest) — 25k+ stars, a comprehensive collection of penetration testing tools
- [SecLists](https://github.com/danielmiessler/SecLists) — wordlist/payload collection (essential for FFUF/Gobuster)
- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) — payloads for all kinds of vulnerabilities
- [HackTricks](https://book.hacktricks.wiki/) — encyclopedia of penetration testing techniques
- [pentest-ai-agents](https://github.com/0xSteph/pentest-ai-agents) — 35 Claude Code pentest sub-agents (reference their prompt patterns)
- [Pentest Swarm AI](https://github.com/Armur-Ai/Pentest-Swarm-AI) — swarm-intelligence autonomous penetration testing framework (multi-agent collaboration, MCP server support)
- [ProxyCat](https://github.com/honmashironeko/ProxyCat) — proxy pool middleware (prevents IP blocking during bulk scanning)
- [planning-with-files](https://github.com/othmanadi/planning-with-files) — task planning skill (for loop testing)

### Reference Documents Within This Skill

- `skill://webapp-pentest-tools/references/pentest-loop.md` — **core loop framework** (risk gating + record-keeping standards + context compression)
- `skill://webapp-pentest-tools/references/recon-pipeline.md` — **authorized reconnaissance pipeline** (CF headers / nmap / Evidence)
- `skill://webapp-pentest-tools/references/client-side-lab-playbook.md` — **DOM XSS / prototype pollution / agent-browser** (lab client-side surfaces)
- `skill://webapp-pentest-tools/references/burpsuite-mcp-guide.md` — **complete BurpSuite MCP guide** (63 tools + 7 major use cases + AI prompt templates)
- `skill://webapp-pentest-tools/references/automation-loop-pattern.md` — automated loop testing pattern (lightweight version)
- `skill://webapp-pentest-tools/references/awesome-pentest-digest.md` — pentest tool quick-reference digest
- `skill://webapp-pentest-tools/references/pentest-ai-agents-matrix.md` — 35-agent coverage matrix
- `skill://webapp-pentest-tools/references/kali-mcp-ecosystem.md` — Kali Linux MCP tooling ecosystem
- `skill://webapp-pentest-tools/references/network-attack-defense.md` — Network attack and defense reference
- `skill://webapp-pentest-tools/references/ai-pentest-agents.md` — AI penetration testing agent architectures
- `skill://webapp-pentest-tools/references/msf-protocol.md` — Metasploit automation protocol and CLI standards
- `skill://webapp-pentest-tools/references/nuclei-guide-2026.md` — Nuclei scanner automation and rule guides
- `skill://webapp-pentest-tools/references/web-attack-cheatsheet.md` — Web penetration testing cheatsheet
- `skill://webapp-pentest-tools/references/ai-pentesting-landscape-2026.md` — Modern autonomous pentest landscape
- `payloads/` — custom payload directory (used preferentially by the AI)
- `templates/` — required file templates for penetration testing (scope/rules/plan/findings/progress)
- `arsenal scripts bootstrap-reverse` — Windows capability bootstrap script
- `arsenal scripts bootstrap-reverse` — POSIX capability bootstrap script
### src-hunter Vulnerability Hunting Knowledge Base

The `src-hunter/` directory contains a complete SRC/Bug Bounty vulnerability hunting methodology:

- **19 attack playbooks** (IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
- **305 structured payloads** + 263 WAF/EDR bypass steps
- **2,887 disclosed HackerOne High/Critical reports**
- **88,636 WooYun historical case statistics**
- **Fingerprints and default credentials for domestic (Chinese) components**
- **CVSS 4.0 report templates**

Usage: during the hunt phase, the AI automatically reads the corresponding playbook and tests according to its workflow.

See `src-hunter/SKILL.md` for details.

---

## Routing Context

**Upstream Entry**: `skill://webapp-pentest-tools/support/SKILL.md` (Master Controller), `skill://webapp-pentest-tools/support/routing.md`
**Trigger Condition**: Active scanning/attacking of targets is required (port scanning, vulnerability detection, injection testing, etc.)
**Downstream Exit**:
- Web vulnerability found that needs further analysis → `skill://webapp-js-reverse`
- Binary vulnerability found that needs reversing → `skill://re-ida-reverse` or `skill://re-radare2`
- Need to operate a browser to verify a vulnerability → `skill://webapp-browser-automation`
- Generate a report after completion → `skill://re-docs-generator`


## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Did I execute each step in the workflow (rather than only reading)?
- [ ] Did I use verified tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/templates/screenshots/reports)?
- [ ] Did I complete and verify the Checklist items required by RULES?