Pentest

---
name: pentest
description: "PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation."
metadata:
  triggers:
    keywords:
    - pentest
    - workflow
---
# Pentest Skill

> [!IMPORTANT]
> PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

## Instructions

When the user asks to perform this workflow, execute the following steps:


# 🕵️‍♂️ Penetration Test (PTES-Aligned)

Goal: Execute a 7-phase red-team assessment across backend APIs, frontend web apps, and mobile clients. Deliver an audit-grade Hacker Score (0-100) with verified Proof-of-Concept exploits and per-finding remediation.

## Steps

1. **Phase 0 — Scope & Authorization**:
   - Determine mode (`whitebox`, `greybox`, `blackbox`) and targets.
   - Verify explicit authorization. **Stop if unauthorized.**
2. **Phase 1 — Intel Gathering (Recon)**:
   - Identify tech stack, endpoints, parameters, local storage, schemes, and secrets.
   - Use `common-security-audit` and `common-dast-tooling`.
3. **Phase 2 — Threat Modeling**:
   - Rank endpoints by risk: `exposure × sensitivity × auth_coverage`.
   - Prioritize attack plan (top-10 highest-risk endpoints).
4. **Phase 3 — Vulnerability Analysis**:
   - Run vulnerability scans.
   - Delegate: SAST/SCA to `specialist-aspm-correlator`, dynamic/logic to `specialist-logic-hacker`, binary/mobile to `specialist-mobile-reverser`.
5. **Phase 4 — Exploitation (PoC-Required)**:
   - **Policy: No Exploit = No Report.** Unverified findings are discarded.
   - Construct reproducible PoC for each confirmed vulnerability.
6. **Phase 5 — Post-Exploitation**:
   - Assess blast radius: lateral movement, privilege escalation, data exfiltration, persistence.
7. **Phase 6 — Hacker Score & Reporting**:
   - Score: Deduct from 100: Critical -25 (cap 25), High -15 (cap 40), Medium -8, Low -3.
   - Deliver findings in the standard template below.

## Output Template

### Executive Summary

- **Hacker Score**: X/100 ([Critical/Vulnerable/Moderate/Hardened])
- **Target Scope**: [repos, URLs, mobile apps]
- **Findings**: [Critical/High/Medium/Low counts]

### Findings Table

| ID | Title | Platform | Severity | CVSS | CWE | PoC |
|---|---|---|---|---|---|---|
| SEC-01 | | [backend|frontend|mobile] | [Critical|High|Medium|Low] | | | [Yes|No] |

### Finding Details

#### SEC-[ID]: [Title]
- **Affected Component**: [file:line or endpoint]
- **Proof of Concept**:
  - Preconditions: [auth, configuration]
  - Steps: [command/payload, expected vs actual]
  - Evidence: [response, screenshot, logs]
- **Impact & Blast Radius**: [access, lateral movement]
- **Remediation**: [specific code fix, diff, or configuration change]