/security-pen-testing

name: "security-pen-testing"
description: "Authorized penetration testing of an app or API: vulnerability scans, OWASP Top 10 checks, dependency audits and a pentest report. Use whenever the user asks if their app is secure or hackable, wants a security scan or a pentest report."

Security Penetration Testing

Hands-on offensive security testing skill for finding vulnerabilities before attackers do. This is NOT compliance checking (see senior-secops) or security policy writing (see senior-security) — this is about systematic vulnerability discovery through authorized testing.

---

Table of Contents

• [Overview](#overview)
• [OWASP Top 10 Systematic Audit](#owasp-top-10-systematic-audit)
• [Static Analysis](#static-analysis)
• [Dependency Vulnerability Scanning](#dependency-vulnerability-scanning)
• [Secret Scanning](#secret-scanning)
• [API Security Testing](#api-security-testing)
• [Web Vulnerability Testing](#web-vulnerability-testing)
• [Infrastructure Security](#infrastructure-security)
• [Pen Test Report Generation](#pen-test-report-generation)
• [Responsible Disclosure Workflow](#responsible-disclosure-workflow)
• [Workflows](#workflows)
• [Anti-Patterns](#anti-patterns)
• [Cross-References](#cross-references)

---

Overview

What This Skill Does

This skill provides the methodology, checklists, and automation for **offensive security testing** — actively probing systems to discover exploitable vulnerabilities. It covers web applications, APIs, infrastructure, and supply chain security.

Distinction from Other Security Skills

| Skill | Focus | Approach | |-------|-------|----------| | **security-pen-testing** (this) | Finding vulnerabilities | Offensive — simulate attacker techniques | | senior-secops | Security operations | Defensive — monitoring, incident response, SIEM | | senior-security | Security policy | Governance — policies, frameworks, risk registers | | skill-security-auditor | CI/CD gates | Automated — pre-merge security checks |

Prerequisites

All testing described here assumes **written authorization** from the system owner. Unauthorized testing is illegal under the CFAA and equivalent laws worldwide. Always obtain a signed scope-of-work or rules-of-engagement document before starting.

---

OWASP Top 10 Systematic Audit

Use the vulnerability scanner tool for automated checklist generation:

# Generate OWASP checklist for a web application
python scripts/vulnerability_scanner.py --target web --scope full

# Quick API-focused scan
python scripts/vulnerability_scanner.py --target api --scope quick --json

Quick Reference (OWASP Top 10:2025)

| # | Category | Key Tests | |---|----------|-----------| | A01 | Broken Access Control | IDOR, vertical escalation, CORS, forced browsing, SSRF (internal IPs, cloud metadata, DNS rebinding) | | A02 | Security Misconfiguration | Default credentials, debug mode, security headers, directory listing | | A03 | Software Supply Chain Failures | Dependency audit (npm/pip/go), EOL checks, known CVEs, build and CI/CD provenance | | A04 | Cryptographic Failures | TLS version, password hashing, hardcoded keys, weak PRNG | | A05 | Injection | SQLi, NoSQLi, command injection, template injection, XSS | | A06 | Insecure Design | Rate limiting, business logic abuse, multi-step flow bypass | | A07 | Authentication Failures | Brute force, session cookie flags, session invalidation, MFA bypass | | A08 | Software or Data Integrity Failures | Unsafe deserialization, SRI checks, unsigned updates | | A09 | Security Logging and Alerting Failures | Auth event logging, sensitive data in logs, alerting thresholds | | A10 | Mishandling of Exceptional Conditions | Fail-open on errors, unhandled exceptions, stack-trace leakage, partial transactions |

# Audit dependencies
python scripts/dependency_auditor.py --file package.json --severity high
python scripts/dependency_auditor.py --file requirements.txt --json

See [owasp_top_10_checklist.md](references/owasp_top_10_checklist.md) for detailed test procedures, code patterns to detect, remediation steps, and CVSS scoring guidance for each category.

---

Static Analysis

**Recommended tools:** CodeQL (custom queries for project-specific patterns), Semgrep (rule-based scanning with auto-fix), ESLint security plugins (`eslint-plugin-security`, `eslint-plugin-no-unsanitized`).

Key patterns to detect: SQL injection via string concatenation, hardcoded JWT secrets, unsafe YAML/pickle deserialization, missing security middleware (e.g., Express without Helmet).

See [attack_patterns.md](references/attack_patterns.md) for code patterns and detection payloads across injection types.

---

Dependency Vulnerability Scanning

**Ecosystem commands:** `npm audit`, `pip audit`, `govulncheck ./...`, `bundle audit check`

**CVE Triage Workflow:** 1. **Collect** — Run ecosystem audit tools, aggregate findings 2. **Deduplicate** — Group by CVE ID across direct and transitive deps 3. **Prioritize** — Critical + exploitable + reachable = fix immediately 4. **Remediate** — Upgrade, patch, or mitigate with compensating controls 5. **Verify** — Rerun audit to confirm fix, update lock files

python scripts/dependency_auditor.py --file package.json --severity critical --json

---

Secret Scanning

**Tools:** TruffleHog (git history + filesystem), Gitleaks (regex-based with custom rules).

# Scan git history for verified secrets
trufflehog git file://. --only-verified --json

# Scan filesystem
trufflehog filesystem . --json

**Integration points:** Pre-commit hooks (gitleaks, trufflehog), CI/CD gates (GitHub Actions with `trufflesecurity/trufflehog@main`). Configure `.gitleaks.toml` for custom rules (AWS keys, API keys, private key headers) and allowlists for test fixtures.

---

API Security Testing

Authentication Bypass

• **JWT manipulation:** Change `alg` to `none`, RS256-to-HS256 confusion, claim modification (`role: "admin"`, `exp: