Pentest Tools

---
name: router-reverse-skill-router-pentest-tools
description: |
  Active penetration testing toolchain. Covers reconnaissance, port scanning, vulnerability scanning, web penetration, SQL injection, directory brute forcing, password cracking, and similar scenarios.
  Exposes 20+ security tools to the AI agent via MCP servers (pentestMCP / mcp-security-hub).
  Trigger keywords: penetration testing, port scanning, Nmap, vulnerability scanning, Nuclei, SQL injection, SQLMap, directory brute force, FFUF, password cracking, Hashcat, reconnaissance, subdomains, web pentest, ZAP, Burp.
---

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: read `../field-journal/precedent-pentest.md` — confirm this skill's operations are pre-authorized routine operations
2. `NOW`: confirm **scope.md** exists with `auth.status=granted` and a valid `network_profile` (`../ops/scope-contract.md`). If scope is missing, run `case-init.ps1` and stop until the user grants authorization; automatically adding `-AuthGranted` is **forbidden**
3. `NOW`: confirm whether the current task falls within this skill's scope
4. `NEXT`: read `../tool-index.md`, verify tool availability and actual paths
5. `NEXT`: when tools are missing, invoke bootstrap — do not guess paths
6. `ACT`: in the reconnaissance phase prefer `references/recon-pipeline.md` (CF browser headers / Windows nmap / curl `--globoff`); append each batch of results to `timeline.md`; write candidates into Evidence with `../scripts/append-evidence.ps1` (a hit ≠ verified)
7. `ACT`: modern web/cyber-range client-side surfaces (DOM XSS / prototype pollution / agent-browser) → `references/client-side-lab-playbook.md`; even without a breach, write observed Evidence + the failure gate

# Penetration Testing Toolchain (Pentest Tools)

## Scope

Use this skill when the task falls under these scenarios:

- Target reconnaissance (port scanning, subdomain enumeration, service identification)
- Vulnerability scanning (web vulnerabilities, CVE detection, misconfigurations)
- Web penetration (SQL injection, XSS, SSRF, directory brute forcing)
- Password cracking (hash cracking, dictionary attacks)
- Network penetration (service exploitation, lateral movement support)

### Division of Labor with Other Skills

| Scenario | What to Use |
|------|--------|
| Active scanning/attack (Nmap/Nuclei/SQLMap) | **this skill** |
| Binary reverse analysis | `ida-reverse/` or `radare2/` |
| Frontend JS signature reversing | `js-reverse/` |
| Browser/desktop automation | `browser-automation/` |
| CTF competitions (comprehensive) | `CTF-Sandbox-Orchestrator/` |

Quick rules of thumb:
- Need to "scan targets, find vulnerabilities, exploit vulnerabilities" → this skill
- Need to "analyze a program's internal logic" → a reversing skill
- Need to "operate a browser/desktop" → browser-automation

---

## Tool Matrix

### Reconnaissance

| Tool | Purpose | Typical Command |
|------|------|---------|
| **Nmap** | Port scanning, service identification, OS detection | `nmap -sV -sC -O target` |
| **Masscan** | Large-scale fast port scanning | `masscan -p1-65535 target --rate=1000` |
| **Subfinder** | Subdomain enumeration | `subfinder -d target.com` |
| **httpx** | HTTP probing, liveness checks | `httpx -l urls.txt -status-code` |

### Vulnerability Scanning

| Tool | Purpose | Typical Command |
|------|------|---------|
| **Nuclei** | Template-based vulnerability scanning (CVE/misconfig/exposure) | `nuclei -u target -t cves/` |
| **ZAP** | Web application security scanning | invoke via API or MCP |
| **Nikto** | Web server vulnerability scanning | `nikto -h target` |

### Web Penetration

| Tool | Purpose | Typical Command |
|------|------|---------|
| **SQLMap** | SQL injection automation | `sqlmap -u "url?id=1" --batch --dbs` |
| **FFUF** | Directory/parameter brute forcing | `ffuf -u target/FUZZ -w wordlist.txt` |
| **Gobuster** | Directory/subdomain brute forcing | `gobuster dir -u target -w wordlist` |
| **XSStrike** | XSS detection | `xsstrike -u "url?param=test"` |

### Password Cracking

| Tool | Purpose | Typical Command |
|------|------|---------|
| **Hashcat** | GPU hash cracking | `hashcat -m 0 hash.txt wordlist.txt` |
| **John the Ripper** | CPU hash cracking | `john --wordlist=rockyou.txt hash.txt` |
| **Hydra** | Online brute forcing | `hydra -l admin -P pass.txt target ssh` |

### Exploitation Frameworks

| Tool | Purpose | Notes |
|------|------|------|
| **Metasploit** | Exploitation framework | separate install, large footprint |
| **Impacket** | Windows protocol exploitation (SMB/WMI/Kerberos) | `pip install impacket` |

---

## MCP Backend Selection

This skill supports two MCP backends; pick one:

### Option A: pentestMCP (recommended, one-command Docker)

- **Project**: https://github.com/ramkansal/pentestmcp
- **Characteristics**: 20+ tools packed into a single Docker container, exposed directly as an MCP server
- **Tools**: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
- **Installation**:

```bash
# Pull and run
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# Or build locally
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp
```

- **MCP registration**:

```json
{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}
```

### Option B: mcp-security-hub (modular)

- **Project**: https://github.com/FuzzingLabs/mcp-security-hub
- **Characteristics**: each tool is its own MCP server, enable as needed
- **Tools**: Nmap, Ghidra, Nuclei, SQLMap, Hashcat
- **Installation**: follow each submodule's README

### Option C: single-tool MCP (lightest)

If you only need one tool:

| Tool | MCP Project | Installation |
|------|---------|------|
| Nmap | [nmap-mcp-server](https://github.com/PhialsBasement/nmap-mcp-server) | npm |
| Nuclei | [nuclei-mcp](https://github.com/addcontent/nuclei-mcp) | npm |
| SQLMap | mcp-security-hub submodule | pip |

### Reqable MCP (local traffic capture and API workbench)

The Reqable desktop client can expose local capture, API, breakpoint, and rule capabilities through the official [Reqable MCP Server](https://github.com/reqable/reqable-mcp-server). Install and start Reqable separately first, then register the MCP:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability reqable-mcp -McpHostTarget Codex
```

Replace `Codex` with `Claude` or `Both` to target a specific client; omitting `-McpHostTarget` writes no global client configuration.

The registered stdio configuration is:

```json
{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
    }
  }
}
```

- Uses Reqable's local API by default; configure `--host`, `--port`, or `--scope minimal|all` per the official docs if needed.
- `minimal` is the recommended default scope; `all` exposes more tools that alter the proxy, rules, environment, or saved data.
- Captured traffic, request replay, and rule modification must still satisfy `scope.md` authorization and network restrictions; registering the MCP does not widen the target scope.

---

## Workflow

### Standard Penetration Flow

> **Important**: when running a penetration test, you MUST follow the autonomous loop framework in `references/pentest-loop.md`.
> That framework defines the full risk gating, logging conventions, context compression, and completion checks.

```text
1. Reconnaissance
   - Nmap port scan → confirm open services
   - Subfinder subdomain enumeration → widen the attack surface
   - httpx liveness checks → filter valid targets

2. Vulnerability scanning
   - Nuclei template scan → quickly find known vulnerabilities
   - ZAP/Nikto → deep web application scanning

3. Exploitation
   - SQLMap → SQL injection
   - FFUF → discover hidden paths/parameters
   - Manual verification → confirm exploitability

4. Post-exploitation (if within authorized scope)
   - Privilege escalation
   - Lateral movement
   - Data extraction

5. Reporting
   - Invoke the docs-generator skill to produce the penetration test report
```

### Quick Scan Flow (results in 5 minutes)

```text
1. nmap -sV -sC target → ports + services
2. nuclei -u target -severity critical,high → high-risk vulnerabilities
3. Web service present → ffuf -u target/FUZZ -w common.txt → directories
4. Summarize findings → decide next step
```

---

## Caveats

- **Authorization is mandatory** — all scanning/attack operations must stay within the authorized scope
- **Control scan rates** — avoid tripping WAF/IDS or knocking over the target
- **Passive before active** — reconnaissance first, then vulnerability scanning, exploitation last
- **Log every operation** — every command and result must be recorded for the report
- **Don't automate blindly** — the AI should pause for confirmation at each key step

---

## On-Demand Bootstrap

### Automation Capability Boundary

| Tool | Auto-installable | Installation Method | Notes |
|------|-----------|---------|------|
| Nmap | ✓ | winget (`Insecure.Nmap`) | Windows version |
| Nuclei | ✓ | `go install` or GitHub Release | needs Go, or download the binary directly |
| SQLMap | ✓ | `pip install sqlmap` or git clone | Python |
| FFUF | ✓ | GitHub Release | Go binary |
| SecLists | ✓ | GitHub Release ZIP | wordlist collection (essential for FFUF/Gobuster) |
| Hashcat | ✗ | manual download | needs GPU drivers |
| Metasploit | ✗ | manual install | large footprint, prefer Kali |
| pentestMCP (Docker) | ✗ | requires Docker | `docker run ramkansal/pentestmcp` |
| Impacket | ✓ | `pip install impacket` | Python |
| ProxyCat | ✓ | `pip install proxycat` | proxy pool middleware (avoids bans during mass scanning) |
| BurpSuite MCP | ✗ | install from the BurpSuite extension marketplace | requires BurpSuite Pro/Community |
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | the Reqable desktop client must be installed manually first |

### Bootstrap Strategy

1. If the user has Docker → recommend pentestMCP (one-command bundle)
2. Without Docker → install individual tools as needed
3. Prioritize Nmap + Nuclei + SQLMap (covers 80% of scenarios)

### Manual Installation Prompt

```markdown
⚠️ **Pentest tools not installed**

**Recommended option (requires Docker)**:
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**Lightweight option (install one by one)**:
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: download from https://github.com/ffuf/ffuf/releases

**Tell me once installed, and I'll continue the current task.**
```

---

## Reference Resources

- [awesome-pentest](https://github.com/enaqx/awesome-pentest) — 25k+ star pentest tool collection
- [SecLists](https://github.com/danielmiessler/SecLists) — wordlist/payload collection (essential for FFUF/Gobuster)
- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) — payloads for every vulnerability class
- [HackTricks](https://book.hacktricks.wiki/) — pentest techniques encyclopedia
- [pentest-ai-agents](https://github.com/0xSteph/pentest-ai-agents) — 35 Claude Code pentest sub-agents (reference their prompt patterns)
- [Pentest Swarm AI](https://github.com/Armur-Ai/Pentest-Swarm-AI) — swarm-intelligence autonomous penetration framework (multi-agent collaboration, supports MCP server)
- [ProxyCat](https://github.com/honmashironeko/ProxyCat) — proxy pool middleware (avoids IP bans during mass scanning)
- [planning-with-files](https://github.com/othmanadi/planning-with-files) — task planning skill (for loop testing)

### Reference Documents in This Skill

- `references/pentest-loop.md` — **core loop framework** (risk gating + logging conventions + context compression)
- `references/recon-pipeline.md` — **authorized reconnaissance pipeline** (CF headers / nmap / Evidence)
- `references/client-side-lab-playbook.md` — **DOM XSS / prototype pollution / agent-browser** (cyber-range client-side surface)
- `references/burpsuite-mcp-guide.md` — **complete BurpSuite MCP guide** (63 tools + 7 major use scenarios + AI prompt templates)
- `references/automation-loop-pattern.md` — automated loop testing pattern (lightweight version)
- `references/awesome-pentest-digest.md` — pentest tool digest quick reference
- `references/pentest-ai-agents-matrix.md` — 35-agent coverage matrix
- `payloads/` — custom payload directory (AI uses it first)
- `templates/` — required file templates for penetration tests (scope/rules/plan/findings/progress)

### src-hunter Vulnerability Hunting Knowledge Base

The `src-hunter/` directory contains the complete SRC/Bug Bounty vulnerability hunting methodology:

- **19 attack playbooks** (IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
- **305 structured payloads** + 263 WAF/EDR bypass steps
- **2,887 disclosed HackerOne High/Critical reports**
- **88,636 historical WooYun case statistics**
- **Chinese-component fingerprints and default credentials**
- **CVSS 4.0 report template**

Usage: during the hunt phase the AI automatically reads the matching playbook and tests per its workflow.

See `src-hunter/SKILL.md` and `src-hunter/references/` for details.

---

## Routing Context

**Upstream entry**: `skills/SKILL.md` (master control), `routing.md`
**Trigger conditions**: active scanning/attacking of targets needed (port scanning, vulnerability detection, injection testing, etc.)
**Downstream exits**:
- Web vulnerability found needing deeper analysis → `js-reverse/`
- Binary vulnerability found needing reversing → `ida-reverse/` or `radare2/`
- Browser operation needed to verify a vulnerability → `browser-automation/`
- Report generation after completion → `docs-generator/`

**Peer related modules**: `CTF-Sandbox-Orchestrator/` (Web/Pwn challenges in CTFs use these tools)


## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Did I execute every step of the workflow (not just read it)?
- [ ] Did I use real tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
- [ ] Did I complete and write back the Checklist items required by RULES?