Pentest

---
name: pentest
description: >
  Spring Boot security scanner — OWASP Top 10, SpEL injection, Actuator exploitation,
  Jackson deserialization, mass assignment, and Spring Security misconfiguration detection.
  Includes 6 automated scanning scripts and real CVE patterns. Use when performing security
  reviews, penetration testing, vulnerability assessments, security audits, or checking for
  known CVEs in Spring Boot projects. Run /pentest-scan for automated full-project scan.
triggers:
  natural: ["security scan", "pentest", "owasp", "vulnerability", "security review", "security audit", "cve check"]
  code: ["SecurityConfig", "@PreAuthorize", "CSRF", "XSS", "SQL injection", "SpEL", "Actuator"]
applicability:
  always: false
  triggers:
    auto_fire: ["/pentest-scan invocation", "high-stakes lane security review"]
    command: ["/pentest-scan", "/threat-model"]
    task_keywords: ["security", "OWASP", "pentest", "vulnerability", "CVE", "threat model", "SSRF", "injection", "auth bypass"]
    related_rules:
      - rules/common/security.md
      - rules/java/security.md
relevance_assessment: |
  HIGH 100%: /pentest-scan or /threat-model invoked OR security audit task
  HIGH 80%+: high-stakes lane Review S2 stage
  MEDIUM 40-79%: auth / crypto / input-validation code change
  LOW 1-39%: tangential security touch (e.g., logging level for security event)
  ZERO: pure refactor, no security boundary
---

# Spring Boot Security Scanner

**Authorization required.** Confirm context: pentest engagement, defensive review, CTF, or research.

## Automated Scripts

```bash
SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/skills/pentest"

# Full scan (runs all scanners, outputs JSON + markdown report)
bash "$SKILL_DIR/scripts/scan-runner.sh" src/main

# Individual scanners
bash "$SKILL_DIR/scripts/endpoint-mapper.sh" src/main
bash "$SKILL_DIR/scripts/secrets-scanner.sh" .
bash "$SKILL_DIR/scripts/injection-scanner.sh" src/main
bash "$SKILL_DIR/scripts/security-config-audit.sh" .
bash "$SKILL_DIR/scripts/dependency-checker.sh" .
```

## 4-Phase Scan Methodology

**Phase 1 — Reconnaissance:** `endpoint-mapper.sh` + `security-config-audit.sh`. Read `project-profile.json`. Identify auth mechanism (JWT, session, OAuth2).

**Phase 2 — OWASP Top 10 + Spring-Specific:** A01–A10 with Spring risks (SpEL injection, Actuator exposure, Jackson deser). See **[references/scan-methodology.md](references/scan-methodology.md)** for mapping table + vulnerability matrix.

**Phase 3 — Spring-Critical Deep-Dive:** RCE vectors: SpEL injection, Actuator chains, Jackson `enableDefaultTyping()`, mass assignment, SecurityFilterChain ordering. See **[references/attack-patterns.md](references/attack-patterns.md)**.

**Phase 4 — Report:** Save to `.claude/docs/security/pentest-report-{date}.md` with severity counts, findings (file, evidence, attack vector, fix), tool recommendations.

## Severity Classification

| Severity | Criteria | Examples |
|----------|----------|---------|
| CRITICAL | RCE, auth bypass, data breach | SpEL injection, exposed actuator/heapdump, `enableDefaultTyping()` |
| HIGH | Privilege escalation, data exposure | Missing @PreAuthorize, IDOR, hardcoded secrets |
| MEDIUM | Defense-in-depth gap | CSRF disabled, missing @Valid, weak hashing |
| LOW | Best practice violation | Missing security headers, unscoped @RequestMapping |

## References

- **[Scan methodology](references/scan-methodology.md)** — OWASP Top 10 mapping table, Spring-critical vulnerability matrix, report template
- **[Attack patterns](references/attack-patterns.md)** — SpEL injection, Jackson deser, mass assignment, SecurityFilterChain, actuator chains
- **[Actuator exploitation](references/actuator-exploitation.md)** — RCE chains, data leak endpoints, secure configuration
- **[OWASP Top 10](references/owasp-top10.md)** — Detection commands, vulnerable vs secure code per category
- **[Spring CVEs](references/spring-cves.md)** — Real CVEs (2022-2026) with detection and mitigation

## Related Skills

- **spring-security** — SecurityFilterChain configuration, JWT validation, CORS
- **observability-patterns** — PII logging detection (A09), audit trail
- **testing-workflow** — Security test phase in verification pipeline