/pentest-validation

name: pentest-validation
description: "Use when validating security findings from SAST/DAST scans, proving exploitability of reported vulnerabilities, eliminating false positives, or running the 4-phase pentest pipeline (recon, analysis, validation, report)."
category: specialized-testing
priority: critical
tokenEstimate: 1500
agents: [qe-pentest-validator, qe-security-scanner, qe-security-reviewer, qe-security-auditor, qe-quality-gate]
implementation_status: optimized
optimization_version: 1.0
last_optimized: 2026-02-08
dependencies: [security-testing]
quick_reference_card: true
tags: [pentest, exploitation, security-validation, shannon, no-exploit-no-report, graduated-exploitation]
trust_tier: 3
validation:
  schema_path: schemas/output.json
  validator_path: scripts/validate-config.json
  eval_path: evals/pentest-validation.yaml

Pentest Validation

<default_to_action> When validating security findings: 1. REQUIRE explicit authorization for target URL 2. SCAN with qe-security-scanner (SAST + dependency + secrets) 3. ANALYZE with qe-security-reviewer + qe-security-auditor (parallel) 4. VALIDATE with qe-pentest-validator (graduated exploitation, parallel per vuln type) 5. REPORT only confirmed findings with PoC evidence ("No Exploit, No Report") 6. UPDATE exploit playbook with new patterns

**Quality Gates:**

• Authorization confirmed before ANY exploitation
• Target URL is staging/dev (NOT production)
• Budget cap enforced ($15 default)
• Time cap enforced (30 min default)
• All exploitation attempts logged

</default_to_action>

Quick Reference Card

The 4-Phase Pipeline

| Phase | Agent(s) | Purpose | Parallelism | |-------|----------|---------|-------------| | **1. Recon** | qe-security-scanner | SAST, DAST, dependency scan, secrets | Internal parallel | | **2. Analysis** | qe-security-reviewer + qe-security-auditor | Code review + compliance check | Both in parallel | | **3. Validation** | qe-pentest-validator | Graduated exploit validation | Per-vuln-type parallel | | **4. Report** | qe-quality-gate | "No Exploit, No Report" filter | Sequential |

Graduated Exploitation Tiers

| Tier | Handler | Cost | Latency | Use When | |------|---------|------|---------|----------| | **1** | Agent Booster (WASM) | $0 | <1ms | Code pattern is conclusive (eval, innerHTML, hardcoded creds) | | **2** | Haiku | $0.0002 | ~500ms | Need payload test against live target | | **3** | Sonnet/Opus | $0.003-$0.015 | 2-5s | Full exploit chain with data proof |

When to Use This Skill

| Scenario | Tier | Estimated Cost | |----------|------|----------------| | PR security review (source only) | 1 | $0 | | Pre-release validation (staging) | 1-2 | $1-5 | | Full pentest validation | 1-3 | $5-15 | | Compliance audit evidence | 1-3 | $5-15 |

---

Configuration

pentest:
  target_url: https://staging.app.com    # REQUIRED for Tier 2-3
  source_repo: ./src                      # REQUIRED for Tier 1+
  exploitation_tier: 2                    # 1=pattern-only, 2=payload-test, 3=full-exploit
  vuln_types:                             # Which pipelines to run
    - injection                           # SQL, NoSQL, command injection
    - xss                                 # Reflected, stored, DOM XSS
    - auth                                # Auth bypass, session, JWT
    - ssrf                                # URL scheme abuse, metadata
  max_cost_usd: 15                        # Budget cap per run
  timeout_minutes: 30                     # Time cap per run
  require_authorization: true             # MUST confirm target ownership
  no_production: true                     # Block production URLs
  production_patterns:                    # URL patterns to block
    - "*.prod.*"
    - "api.*"
    - "www.*"

---

Safeguards (Mandatory)

Authorization Gate

Every pentest validation run MUST: 1. Display target URL and exploitation tier to user 2. Require explicit confirmation: "I own/authorized testing of this target" 3. Log authorization with timestamp 4. Block if target URL matches production patterns

What This Skill Does NOT Do

• Full autonomous reconnaissance (Nmap, Subfinder)
• Zero-day exploit development
• Attack targets without explicit authorization
• Test production systems
• Store actual exfiltrated data (only proof of access)
• Social engineering or phishing simulation
• Port scanning or service discovery

---

Validation Pipelines

Injection Pipeline

| Attack | Tier 1 (Pattern) | Tier 2 (Payload) | Tier 3 (Full) | |--------|-------------------|-------------------|----------------| | SQL injection | String concat in query | `' OR '1'='1` response diff | UNION SELECT data extraction | | NoSQL injection | `$where`, `$gt` in query | Operator injection test | Collection enumeration | | Command injection | `exec()`, `system()` calls | Command delimiter test | Reverse shell proof | | LDAP injection | String concat in filter | Wildcard injection | Directory enumeration |

XSS Pipeline

| Attack | Tier 1 (Pattern) | Tier 2 (Payload) | Tier 3 (Full) | |--------|-------------------|-------------------|----------------| | Reflected XSS | No output encoding | `<img onerror>` reflection | Browser JS execution via qe-browser (Vibium) | | Stored XSS | `innerHTML` assignment | Payload stored + retrieved | Cookie theft PoC | | DOM XSS | `document.write(location)` | Fragment injection | DOM manipulation proof |

Auth Pipeline

| Attack | Tier 1 (Pattern) | Tier 2 (Payload) | Tier 3 (Full) | |--------|-------------------|-------------------|----------------| | JWT none | No algorithm validation | Modified JWT accepted | Admin access with forged token | | Session fixation | No session rotation | Pre-set session reused | Cross-user session hijack | | Credential stuffing | No rate limiting | 100 attempts unblocked | Valid credential discovery | | IDOR | No authorization check | Access other user data | Full CRUD on foreign resources |

SSRF Pipeline

| Attack | Tier