Pentest Tools

---
name: pentest-tools
description: |
  Active penetration testing toolchain. Covers reconnaissance, port scanning, vulnerability scanning, web exploitation, SQL injection, directory brute-forcing, password cracking, and more.
  Exposes 20+ security tools to the AI agent via MCP servers (pentestMCP / mcp-security-hub).
  Trigger keywords: penetration testing, port scan, Nmap, vulnerability scan, Nuclei, SQL injection, SQLMap, directory brute-force, FFUF, password cracking, Hashcat, reconnaissance, subdomain, web exploitation, ZAP, Burp.
---

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: Read `../field-journal/precedent-pentest.md` — confirm this skill's operations are authorized, routine operations
2. `NOW`: Confirm **scope.md** exists with `auth.status=granted` and a valid `network_profile` (`../ops/scope-contract.md`); otherwise run `case-init.ps1 -AuthGranted -TargetUrl <url> -NetworkProfile authorized_target_only`
3. `NOW`: Confirm whether the current task falls within this skill's scope
4. `NEXT`: Read `../tool-index.md`, verify tool availability and real paths
5. `NEXT`: If a tool is missing, call bootstrap — do not guess paths
6. `ACT`: During recon, prefer `references/recon-pipeline.md` (CF browser headers / Windows nmap / curl `--globoff`); append each batch of results to `timeline.md`; record candidates into Evidence with `../scripts/append-evidence.ps1` (a hit is not a verified finding)
7. `ACT`: Modern web / lab client-side surface (DOM XSS / prototype pollution / agent-browser) → `references/client-side-lab-playbook.md`; even when exploitation fails, write observed Evidence plus the failure gate

# Pentest Tools

## Scope

Use this skill when the task involves:

- Target reconnaissance (port scanning, subdomain enumeration, service fingerprinting)
- Vulnerability scanning (web vulnerabilities, CVE detection, misconfigurations)
- Web exploitation (SQL injection, XSS, SSRF, directory brute-forcing)
- Password cracking (hash cracking, dictionary attacks)
- Network penetration (service exploitation, lateral-movement assistance)

### Division of labor with other skills

| Scenario | Use |
|----------|-----|
| Active scanning/attacking (Nmap/Nuclei/SQLMap) | **This skill** |
| Binary reverse engineering | `ida-reverse/` or `radare2/` |
| Front-end JS signature reversing | `js-reverse/` |
| Browser/desktop automation | `browser-automation/` |
| CTF competitions (general) | `CTF-Sandbox/` |

Quick rule of thumb:
- Need to "scan a target, find vulnerabilities, exploit them" → this skill
- Need to "analyze a program's internal logic" → a reverse-engineering skill
- Need to "drive a browser/desktop" → browser-automation

---

## Tool Matrix

### Reconnaissance

| Tool | Purpose | Typical command |
|------|---------|-----------------|
| **Nmap** | Port scanning, service fingerprinting, OS detection | `nmap -sV -sC -O target` |
| **Masscan** | Large-scale fast port scanning | `masscan -p1-65535 target --rate=1000` |
| **Subfinder** | Subdomain enumeration | `subfinder -d target.com` |
| **httpx** | HTTP probing, liveness detection | `httpx -l urls.txt -status-code` |

### Vulnerability Scanning

| Tool | Purpose | Typical command |
|------|---------|-----------------|
| **Nuclei** | Template-based vulnerability scanning (CVEs/misconfigurations/exposures) | `nuclei -u target -t cves/` |
| **ZAP** | Web application security scanning | via API or MCP |
| **Nikto** | Web server vulnerability scanning | `nikto -h target` |

### Web Exploitation

| Tool | Purpose | Typical command |
|------|---------|-----------------|
| **SQLMap** | Automated SQL injection | `sqlmap -u "url?id=1" --batch --dbs` |
| **FFUF** | Directory/parameter fuzzing | `ffuf -u target/FUZZ -w wordlist.txt` |
| **Gobuster** | Directory/subdomain brute-forcing | `gobuster dir -u target -w wordlist` |
| **XSStrike** | XSS detection | `xsstrike -u "url?param=test"` |

### Password Cracking

| Tool | Purpose | Typical command |
|------|---------|-----------------|
| **Hashcat** | GPU hash cracking | `hashcat -m 0 hash.txt wordlist.txt` |
| **John the Ripper** | CPU hash cracking | `john --wordlist=rockyou.txt hash.txt` |
| **Hydra** | Online brute force | `hydra -l admin -P pass.txt target ssh` |

### Exploitation Frameworks

| Tool | Purpose | Notes |
|------|---------|-------|
| **Metasploit** | Exploitation framework | Install separately; large footprint |
| **Impacket** | Windows protocol exploitation (SMB/WMI/Kerberos) | `pip install impacket` |

---

## MCP Backend Options

This skill supports two MCP backends — pick one:

### Option A: pentestMCP (recommended, one-shot Docker)

- **Project**: https://github.com/ramkansal/pentestmcp
- **Highlights**: 20+ tools packaged into a single Docker container exposed directly as an MCP server
- **Tools**: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
- **Install**:

```bash
# Pull and run
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# Or build locally
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp
```

- **MCP registration**:

```json
{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}
```

### Option B: mcp-security-hub (modular)

- **Project**: https://github.com/FuzzingLabs/mcp-security-hub
- **Highlights**: each tool is an independent MCP server, enabled on demand
- **Tools**: Nmap, Ghidra, Nuclei, SQLMap, Hashcat
- **Install**: follow each submodule's README

### Option C: single-tool MCPs (lightest)

If you only need one specific tool:

| Tool | MCP project | Install |
|------|-------------|---------|
| Nmap | [nmap-mcp-server](https://github.com/PhialsBasement/nmap-mcp-server) | npm |
| Nuclei | [nuclei-mcp](https://github.com/addcontent/nuclei-mcp) | npm |
| SQLMap | mcp-security-hub submodule | pip |

### Reqable MCP (local capture & API workbench)

The Reqable desktop client exposes local traffic capture, API, breakpoint, and rule capabilities through the official [Reqable MCP Server](https://github.com/reqable/reqable-mcp-server). Install and start Reqable first, then register the MCP:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability reqable-mcp
```

The registered stdio configuration:

```json
{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
    }
  }
}
```

- Uses Reqable's local API by default; configure `--host`, `--port`, or `--scope minimal|all` per official docs when needed.
- `minimal` is the recommended default scope; `all` exposes additional tools that can modify the proxy, rules, environment, or saved data.
- Capturing traffic, replaying requests, and modifying rules remain subject to the authorization and network restrictions in `scope.md`; registering the MCP must not expand the target scope.

---

## Workflow

### Standard pentest process

> **Important**: when running a pentest, you MUST follow the autonomous loop framework in `references/pentest-loop.md`.
> That framework defines the full risk gating, logging discipline, context compaction, and completion-check mechanisms.

```text
1. Reconnaissance
   - Nmap port scan → confirm open services
   - Subfinder subdomain enumeration → expand attack surface
   - httpx liveness check → filter valid targets

2. Vulnerability scanning
   - Nuclei template scan → quickly surface known vulnerabilities
   - ZAP/Nikto → deep web application scanning

3. Exploitation
   - SQLMap → SQL injection
   - FFUF → discover hidden paths/parameters
   - Manual verification → confirm exploitability

4. Post-exploitation (if within authorized scope)
   - Privilege escalation
   - Lateral movement
   - Data extraction

5. Reporting
   - Invoke the docs-generator skill to produce the pentest report
```

### Quick-scan process (results in 5 minutes)

```text
1. nmap -sV -sC target → ports + services
2. nuclei -u target -severity critical,high → high-severity vulnerabilities
3. If a web service exists → ffuf -u target/FUZZ -w common.txt → directories
4. Summarize findings → decide next step
```

---

## Cautions

- **Authorization is mandatory** — every scan/attack must stay within the authorized scope
- **Throttle scan rates** — avoid tripping WAF/IDS or crashing the target
- **Passive before active** — reconnaissance first, then vulnerability scanning, exploitation last
- **Log everything** — record every command and its result for the report
- **Don't automate blindly** — the AI should pause for confirmation at every critical step

---

## On-Demand Bootstrap

### Automation boundary

| Tool | Auto-installable | How | Notes |
|------|------------------|-----|-------|
| Nmap | ✓ | winget (`Insecure.Nmap`) | Windows build |
| Nuclei | ✓ | `go install` or GitHub Release | needs Go, or download the binary directly |
| SQLMap | ✓ | `pip install sqlmap` or git clone | Python |
| FFUF | ✓ | GitHub Release | Go binary |
| SecLists | ✓ | GitHub Release ZIP | wordlist collection (required for FFUF/Gobuster) |
| Hashcat | ✗ | manual download | requires GPU drivers |
| Metasploit | ✗ | manual install | large footprint; prefer Kali |
| pentestMCP (Docker) | ✗ | requires Docker | `docker run ramkansal/pentestmcp` |
| Impacket | ✓ | `pip install impacket` | Python |
| ProxyCat | ✓ | `pip install proxycat` | proxy-pool middleware (avoid IP bans during bulk scans) |
| BurpSuite MCP | ✗ | install from BurpSuite extension market | requires BurpSuite Pro/Community |
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | Reqable desktop client must be installed manually first |

### Bootstrap strategy

1. If the user has Docker → recommend pentestMCP (one-shot full stack)
2. If no Docker → install tools individually as needed
3. Prioritize Nmap + Nuclei + SQLMap (covers ~80% of scenarios)

### Manual-install prompt

```markdown
⚠️ **Pentest tools not installed**

**Recommended (requires Docker)**:
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**Lightweight (install one by one)**:
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: download from https://github.com/ffuf/ffuf/releases

**Tell me once installed, and I'll continue the current task.**
```

---

## References

- [awesome-pentest](https://github.com/enaqx/awesome-pentest) — 25k+ stars pentest tool collection
- [SecLists](https://github.com/danielmiessler/SecLists) — wordlist/payload collection (required for FFUF/Gobuster)
- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) — payloads for every vulnerability class
- [HackTricks](https://book.hacktricks.wiki/) — pentest technique encyclopedia
- [pentest-ai-agents](https://github.com/0xSteph/pentest-ai-agents) — 35 Claude Code pentest sub-agents (reference their prompt patterns)
- [Pentest Swarm AI](https://github.com/Armur-Ai/Pentest-Swarm-AI) — swarm-intelligence autonomous pentest framework (multi-agent collaboration, MCP server support)
- [ProxyCat](https://github.com/honmashironeko/ProxyCat) — proxy-pool middleware (avoid IP bans during bulk scans)
- [planning-with-files](https://github.com/othmanadi/planning-with-files) — planning-task skill (for loop testing)

### In-skill reference docs

- `references/pentest-loop.md` — **core loop framework** (risk gating + logging discipline + context compaction)
- `references/recon-pipeline.md` — **authorized recon pipeline** (CF headers / nmap / Evidence)
- `references/client-side-lab-playbook.md` — **DOM XSS / prototype pollution / agent-browser** (lab client-side surface)
- `references/burpsuite-mcp-guide.md` — **complete BurpSuite MCP guide** (63 tools + 7 usage scenarios + AI prompt templates)
- `references/automation-loop-pattern.md` — automated loop-testing pattern (lightweight)
- `references/awesome-pentest-digest.md` — pentest tool essentials cheat sheet
- `references/pentest-ai-agents-matrix.md` — 35-agent coverage matrix
- `payloads/` — custom payload directory (AI uses these first)
- `templates/` — required pentest file templates (scope/rules/plan/findings/progress)

### src-hunter vulnerability research knowledge base

The `src-hunter/` directory contains a complete SRC/Bug Bounty vulnerability-hunting methodology:

- **19 attack playbooks** (IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
- **305 structured payloads** + 263 WAF/EDR bypass steps
- **2,887 disclosed HackerOne High/Critical reports**
- **88,636 historical WooYun case statistics**
- **Chinese software fingerprints and default credentials**
- **CVSS 4.0 report templates**

Usage: during the hunt phase the AI automatically reads the matching playbook and tests per its procedures.

See `src-hunter/SKILL.md` and `src-hunter/references/`.

---

## Routing Context

**Upstream entries**: `skills/SKILL.md` (master), `routing.md`
**Trigger conditions**: a target needs active scanning/attacking (port scanning, vulnerability detection, injection testing, etc.)
**Downstream exits**:
- Web vulnerability needs deeper analysis → `js-reverse/`
- Binary vulnerability needs reversing → `ida-reverse/` or `radare2/`
- Browser needed to verify a vulnerability → `browser-automation/`
- Generate a report when done → `docs-generator/`

**Peer modules**: `CTF-Sandbox/` (CTF Web/Pwn challenges use these tools)


## Task Completion Self-check (MUST pass before claiming completion)

- [ ] Did I execute every step of the workflow (rather than just reading about it)?
- [ ] Did I use real tool paths from the `tool-index`?
- [ ] Did I produce reproducible evidence (commands/scripts/screenshots/report)?
- [ ] Did I complete and write back the Checklist items required by RULES?