Pentesting

---
layer: peripheral
name: pentesting
description: Usar cuando se ejecuta un pentest contra una aplicación o infraestructura.
metadata:
  # --- metadata.savia.* (SE-333) ---
  savia.agent: pentester
  savia.maturity: beta
  savia.category: governance
  savia.context: fork
  savia.context_cost: high
  savia.priority: high
  savia.summary: "Pipeline de pentesting dinamico con 5 fases (Shannon-inspired). Queue-driven, proof-based, politica no exploit no report. Input: URL/sistema. Output: informe con pruebas de explotacion."
  savia.tags: "pentesting, security, owasp, proof-based"
---

# Pentesting Skill — Pipeline Shannon

## §1 — Arsenal (detalle en `checklists.md`)

**Recon**: nmap, dig, whois, subfinder, amass, gobuster, ffuf, whatweb, crt.sh, testssl.sh
**Web**: SQLi (error/blind/time/UNION), XSS (reflected/stored/DOM), SSTI, XXE, SSRF, CSRF, CMDi, path traversal, file upload, deserialization, business logic
**Auth**: brute force, JWT (none/key-confusion/claim-tamper), OAuth abuse, SAML, session fixation
**AuthZ**: IDOR, BOLA/BFLA, priv escalation (H/V), forced browsing, mass assignment
**API**: REST param pollution, GraphQL introspection/DoS, gRPC reflection, WebSocket, rate limit bypass
**Infra**: nmap NSE, mitmproxy, scapy, Redis/Mongo/ES/MySQL, TLS audit
**Container**: Docker socket escape, privileged mode, K8s RBAC/etcd/pod escape, Helm injection
**Cloud**: AWS IMDS/S3/IAM, Azure MI/SAS/RBAC, GCP metadata/SA keys
**Crypto**: MD5/SHA1/ECB detection, padding oracle, hardcoded keys, PRNG prediction

## §2 — Herramientas

```bash
# apt: nmap dnsutils whois nikto dirb tcpdump netcat socat openssl jq
# pip: sqlmap wfuzz mitmproxy scapy requests beautifulsoup4 pyjwt pycryptodome httpx
```

## §3 — Informe final (Fase 5)

```markdown
# Pentest Report — {sistema}
**Fecha:** {fecha} | **Entorno:** {env} | **Scope:** {desc}
## Executive Summary
Riesgo: {level} | Hallazgos probados: C:{n} H:{n} M:{n} L:{n}
Descartados (sin prueba L3): {n}
## Proven Findings (solo L3 — con evidencia)
## Attack Chains (diagramas de cadenas exitosas)
## Failed Attempts (L1/L2 — transparencia, sin contar como hallazgos)
## Remediation Roadmap (P0-P3)
## Positive Findings (controles que funcionaron)
```

## §4 — Reglas por entorno

**DEV**: ✅ todo. Fuzzing agresivo, exploits, brute force, DoS controlado. ⚠️ No destruir datos sin backup.
**PRE**: ✅ OWASP, fuzzing moderado. ❌ No brute force, no DoS, no datos ajenos.
**PROD**: ✅ Solo pasivo (headers, TLS, DNS, auth test). ❌ No exploits, no fuzzing. Todo reversible.

## §5 — Checklists (detalle en `checklists.md`)

**Web**: headers, TLS, cookies, CORS, auth, authz, input validation, upload, errors, rate limit, business logic
**API**: auth, authz/endpoint, validation, mass assignment, rate limit, pagination, content-type, versioning, docs
**Infra**: ports, versions, creds, SSH, firewall, DNS, email security, certs
**Cloud**: non-root, no privileged, pinned images, RBAC, network policies, secrets, IAM, storage

## §6 — MITRE ATT&CK

| Táctica | Técnicas |
|---------|----------|
| Reconnaissance | Active scanning, open websites |
| Initial Access | Exploit public app, valid accounts |
| Execution | Command interpreter, exploitation |
| Persistence | Account manipulation, scheduled task |
| Priv Escalation | Exploitation, token manipulation |
| Credential Access | Brute force, credential dumping |
| Lateral Movement | Remote services, exploitation |
| Exfiltration | Over C2, web service, alt protocol |

## §7 — CVSS v3.1 simplificado

| Factor | Peso | Valores |
|--------|------|---------|
| Attack Vector | 0.3 | Network(1.0) Adjacent(0.7) Local(0.5) Physical(0.2) |
| Complexity | 0.2 | Low(1.0) High(0.5) |
| Privileges | 0.2 | None(1.0) Low(0.6) High(0.3) |
| Impact | 0.3 | High(1.0) Medium(0.6) Low(0.3) |

## §8 — STRIDE quick-ref

| Cat | Pregunta | Controles |
|-----|----------|-----------|
| Spoofing | ¿Suplantar? | Auth, MFA, tokens |
| Tampering | ¿Modificar? | Integridad, HMAC |
| Repudiation | ¿Negar? | Audit logs |
| Info Disclosure | ¿Acceder? | Encryption, ACL |
| DoS | ¿Tumbar? | Rate limiting, WAF |
| Elevation | ¿Escalar? | RBAC, least privilege |

## §9 — Vulnerability Queue Format (Fase 3 → Fase 4)

Cada archivo `03-vuln-{clase}.json` contiene:
```json
{"vulnerabilities": [
  {"id": "INJ-001", "endpoint": "/api/search", "parameter": "q",
   "type": "sqli_error", "sink": "SQL query string interpolation",
   "source_file": "app.py:42", "confidence": "high",
   "suggested_payload": "' OR '1'='1", "notes": "No parameterized query"}
]}
```
Campos requeridos: `id`, `endpoint`, `parameter`, `type`, `confidence`.
Si `confidence` < `medium`, no se intenta exploitation.

## §10 — Verificación binaria (SE-351, gate de EXPLOITED)

Un hallazgo solo se marca **`EXPLOITED`** (y pasa a L3) si `scripts/poc-verify.sh`
devuelve **`VERIFIED`** contra el oráculo del target. La evidencia la produce el
programa (exit code / regex), NO el juicio del agente. "Facts, not claims".

```
bash scripts/poc-verify.sh verify --oracle rules/poc-verify/{target}.json \
  --poc {path_al_poc} --name PT-{NNN}
# VERDICT: VERIFIED   → EXPLOITED / L3
# VERDICT: NOT_VERIFIED → ATTEMPTED_FAILED (no reportar)
# VERDICT: TIMEOUT    → ATTEMPTED_FAILED (timeout)
```

- El **recibo JSON** generado (`output/security/poc-verify-*.json`) se adjunta al
  hallazgo como evidencia reproducible.
- `security-auditor` puede re-ejecutar el verificador para confirmar/desmentir.
- Oráculos por target en `rules/poc-verify/`. CRIT-001: PoCs solo en entornos
  controlados (Docker local `network=none` o comando local time-boxed), **NUNCA**
  contra producción sin autorización escrita. Sin red a proveedor.