Pentesting Checklist Usage

PentestingChecklist Skill

Skill by ara.so — Security Skills collection.

PentestingChecklist is a comprehensive, client-side security assessment tool providing structured checklists across 23 platforms including Web, API, Mobile, Cloud, Active Directory, Kubernetes, LLM, and more. It runs entirely in-browser with no backend—all progress, notes, and findings are stored locally in localStorage.

What It Does

• Hierarchical assessment framework: Platform → Category → Technology → Check (4-level structure)
• 1000+ security checks across 23 assessment platforms
• Progress tracking: Mark checks as Open/Closed/N/A, add notes per check
• Global search: Search across all platforms, checks, descriptions, tags, and references
• Export capabilities: Markdown, CSV, Excel (.xlsx), JSON formats
• Severity filtering: Critical, High, Medium, Low, Info badges
• Private by design: No login, no backend, no telemetry—everything stays local

Installation & Setup

Using the Hosted Version

Access directly at: https://checklist.m14r41.in/

No installation required—runs entirely in your browser.

Self-Hosting

# Clone the repository
git clone https://github.com/m14r41/PentestingChecklist.git
cd PentestingChecklist

# Install dependencies
npm install
# or
pnpm install

# Start development server
npm run dev
# or
pnpm dev

# Build for production
npm run build
# or
pnpm build

# Preview production build
npm run preview

The application will be available at http://localhost:5173 (dev) or as static files in dist/ (production).

Project Structure

PentestingChecklist is built with TypeScript, React, and Vite. Key directories:

PentestingChecklist/
├── src/
│   ├── components/     # React components
│   ├── data/          # Checklist data (JSON/TS)
│   ├── hooks/         # Custom React hooks
│   ├── utils/         # Utility functions
│   └── types/         # TypeScript type definitions
├── public/            # Static assets
└── dist/             # Production build output

Understanding the Data Model

The checklist uses a 4-level hierarchy:

// Core data structure
interface Platform {
  id: string;
  name: string;
  description: string;
  categories: Category[];
}

interface Category {
  id: string;
  name: string;
  technologies: Technology[];
}

interface Technology {
  id: string;
  name: string;
  checks: Check[];
}

interface Check {
  id: string;
  title: string;
  description: string;
  severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
  tags: string[];
  tools?: string[];
  references?: string[];
  status?: 'open' | 'closed' | 'na';
  notes?: string;
}

Key Features & Usage

1. Navigation

// Platform pages are accessed via:
// /platform/web-application
// /platform/api
// /platform/mobile
// /platform/active-directory
// etc.

// All platforms view:
// /checklist

2. Global Search (⌘K / Ctrl+K)

Press the keyboard shortcut from any page to open search:

• Searches across platforms, categories, technologies, checks
• Searches descriptions, tags, tools, and references
• Auto-expands and highlights selected results

3. Progress Tracking

Each check can be marked with a status:

• Open: Finding identified, needs remediation
• Closed: Check completed/passed or finding resolved
• N/A: Not applicable to current assessment

Progress is calculated automatically per category, platform, and globally.

4. Adding Notes

Click any check to expand it and add notes:

• Record payloads, request IDs, screenshots references
• Document evidence and reproduction steps
• Notes persist in browser localStorage
• Notes are included in exports

5. Exporting Assessment Data

// Export formats available:
// - Markdown (.md): Human-readable report
// - CSV (.csv): Spreadsheet import
// - Excel (.xlsx): Formatted spreadsheet with multiple sheets
// - JSON (.json): Complete state for re-import

// Export includes:
// - Platform/category/technology/check hierarchy
// - Check statuses (open/closed/na)
// - Notes for each check
// - Severity levels
// - Tags and references

6. Importing Previous Assessments

Upload a previously exported JSON file to restore:

• All check statuses
• All notes
• Progress tracking state

Common Workflows

Starting a New Assessment

// 1. Navigate to the relevant platform
//    Example: /platform/web-application

// 2. Use filters to focus on priority areas
//    - Filter by severity: critical, high
//    - Expand relevant categories

// 3. Work through checks systematically
//    - Mark checks as you complete them
//    - Add notes for findings
//    - Reference tools and techniques

// 4. Export findings periodically
//    - JSON export for backup
//    - Markdown/Excel for reporting

Bug Bounty Workflow

// 1. Start with OSINT platform checks
//    /platform/osint
//    - Domain enumeration
//    - Exposed credentials
//    - Code leakage

// 2. Move to Web Application checks
//    /platform/web-application
//    - Authentication bypass
//    - Authorization flaws
//    - Injection vulnerabilities

// 3. API testing (if applicable)
//    /platform/api
//    - OWASP API Security Top 10
//    - Object-level authorization
//    - Mass assignment

// 4. Track all findings with notes
//    - Reproduction steps
//    - Affected endpoints
//    - Impact assessment

// 5. Export findings for submission
//    - Markdown for bug reports
//    - CSV for tracking multiple findings

Red Team Engagement

// Multi-platform assessment approach:

// Phase 1: Reconnaissance
// /platform/osint
// /platform/network

// Phase 2: Initial Access
// /platform/phishing
// /platform/web-application

// Phase 3: Lateral Movement
// /platform/active-directory
// /platform/infrastructure

// Phase 4: Privilege Escalation
// /platform/active-directory
// /platform/cloud

// Phase 5: Persistence & Exfiltration
// /platform/infrastructure
// /platform/cloud

// Track progress across all platforms
// Use global search to find relevant checks
// Export comprehensive report at end

Cloud Security Assessment

// Navigate to cloud platform:
// /platform/cloud

// Key categories to review:
// 1. IAM (Identity & Access Management)
//    - Overly permissive roles
//    - Root account usage
//    - MFA enforcement

// 2. Storage Security
//    - Public S3 buckets
//    - Unencrypted storage
//    - Access logging

// 3. Compute Security
//    - Instance metadata SSRF
//    - Security group misconfigs
//    - Unpatched instances

// 4. Network Security
//    - VPC misconfigurations
//    - Exposed services
//    - Network segmentation

// Also check:
// /platform/containers-kubernetes (for EKS/AKS/GKE)
// /platform/devops (for CI/CD pipelines)

Active Directory Assessment

// Navigate to AD platform:
// /platform/active-directory

// Systematic enumeration approach:
// 1. Domain Enumeration
//    - User/group enumeration
//    - Trust relationships
//    - GPO analysis

// 2. Kerberos Attacks
//    - Kerberoasting
//    - AS-REP Roasting
//    - Unconstrained delegation

// 3. ACL Analysis
//    - GenericAll/GenericWrite abuse
//    - DCSync rights
//    - Ownership chains

// 4. Lateral Movement
//    - Pass-the-hash
//    - Pass-the-ticket
//    - WMI/DCOM abuse

// 5. Privilege Escalation
//    - Path to domain admin
//    - Golden/Silver tickets
//    - Credential dumping

// Document attack paths in notes
// Mark findings with appropriate severity

LocalStorage Structure

Understanding data persistence for troubleshooting:

// Key structure in localStorage:

// Check statuses:
localStorage.setItem('checkStatus_<checkId>', 'open|closed|na');

// Check notes:
localStorage.setItem('checkNotes_<checkId>', 'your notes here');

// To manually inspect:
// Open browser DevTools → Application/Storage → Local Storage
// Look for keys matching the patterns above

// To clear all data (reset):
// localStorage.clear(); // In browser console
// or use the "Reset" button in the UI

Extending the Checklist

To add custom checks or modify existing ones:

// 1. Locate the data files in src/data/
// Example: src/data/platforms/web-application.ts

// 2. Add a new check to a technology:
export const webApplicationPlatform: Platform = {
  id: 'web-application',
  name: 'Web Application',
  categories: [{
    id: 'authentication',
    name: 'Authentication',
    technologies: [{
      id: 'session-management',
      name: 'Session Management',
      checks: [
        {
          id: 'custom-check-001',
          title: 'Check for session fixation',
          description: 'Verify that session tokens are regenerated after login',
          severity: 'high',
          tags: ['session', 'authentication'],
          tools: ['Burp Suite', 'OWASP ZAP'],
          references: [
            'OWASP Session Management Cheat Sheet'
          ]
        }
      ]
    }]
  }]
};

// 3. Rebuild the application:
// npm run build

Integration Examples

Exporting to CI/CD

// Use the JSON export as a security gate template:

// 1. Export baseline checklist as JSON
// 2. In CI/CD pipeline, load and compare:

import fs from 'fs';

interface ChecklistState {
  platform: string;
  checks: {
    id: string;
    status: 'open' | 'closed' | 'na';
    notes?: string;
  }[];
}

function validateSecurityChecks(checklistPath: string): boolean {
  const state: ChecklistState = JSON.parse(
    fs.readFileSync(checklistPath, 'utf-8')
  );
  
  const criticalOpen = state.checks.filter(
    c => c.status === 'open' && c.severity === 'critical'
  );
  
  if (criticalOpen.length > 0) {
    console.error(`❌ ${criticalOpen.length} critical findings still open`);
    return false;
  }
  
  return true;
}

// Usage in CI:
// if (!validateSecurityChecks('./security-checklist.json')) {
//   process.exit(1);
// }

Generating Custom Reports

// Process exported JSON to create custom reports:

import fs from 'fs';

interface ExportedData {
  exportDate: string;
  platforms: {
    name: string;
    categories: {
      name: string;
      technologies: {
        name: string;
        checks: {
          title: string;
          status: string;
          severity: string;
          notes?: string;
        }[];
      }[];
    }[];
  }[];
}

function generateExecutiveSummary(jsonPath: string): string {
  const data: ExportedData = JSON.parse(
    fs.readFileSync(jsonPath, 'utf-8')
  );
  
  let summary = '# Security Assessment Executive Summary\n\n';
  summary += `Assessment Date: ${data.exportDate}\n\n`;
  
  let totalChecks = 0;
  let openFindings = 0;
  let criticalFindings = 0;
  
  data.platforms.forEach(platform => {
    platform.categories.forEach(category => {
      category.technologies.forEach(tech => {
        tech.checks.forEach(check => {
          totalChecks++;
          if (check.status === 'open') {
            openFindings++;
            if (check.severity === 'critical') {
              criticalFindings++;
            }
          }
        });
      });
    });
  });
  
  summary += `## Key Metrics\n`;
  summary += `- Total Checks Performed: ${totalChecks}\n`;
  summary += `- Open Findings: ${openFindings}\n`;
  summary += `- Critical Findings: ${criticalFindings}\n\n`;
  
  return summary;
}

// Usage:
// const report = generateExecutiveSummary('./assessment-export.json');
// fs.writeFileSync('./executive-summary.md', report);

Troubleshooting

Progress Not Saving

// Check localStorage availability:
if (typeof localStorage === 'undefined') {
  console.error('localStorage not available');
}

// Check for quota errors:
try {
  localStorage.setItem('test', 'test');
  localStorage.removeItem('test');
} catch (e) {
  console.error('localStorage quota exceeded or disabled');
}

// Clear old data if needed:
// Object.keys(localStorage)
//   .filter(key => key.startsWith('checkStatus_') || key.startsWith('checkNotes_'))
//   .forEach(key => localStorage.removeItem(key));

Export Not Working

// Check browser download permissions
// Ensure popup blockers aren't interfering

// Manually trigger download if automated fails:
function manualDownload(content: string, filename: string) {
  const blob = new Blob([content], { type: 'application/json' });
  const url = URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = url;
  a.download = filename;
  document.body.appendChild(a);
  a.click();
  document.body.removeChild(a);
  URL.revokeObjectURL(url);
}

Search Not Finding Results

// Search indexes:
// - Check titles
// - Check descriptions
// - Tags
// - Tools
// - References
// - Platform names
// - Category names
// - Technology names

// Use specific keywords from the check content
// Try partial matches (search is substring-based)
// Check for typos in search query

Platform Coverage Reference

Quick reference for what each platform covers:

• Web Application: OWASP Top 10, auth, session, injection, business logic
• API: OWASP API Top 10, REST/GraphQL, authorization, rate limiting
• Mobile: OWASP MASVS, iOS/Android, storage, transport, reverse engineering
• Thick Client: Desktop apps, DLL injection, IPC, local storage
• Secure Code Review: Source analysis, dangerous sinks, secrets in code
• Cloud: AWS/Azure/GCP, IAM, storage, compute, SSRF via metadata
• DevSecOps: SAST/DAST/SCA, secrets management, supply chain
• Network: Host discovery, service enumeration, transport security
• Wi-Fi: WPA2/WPA3, rogue APs, handshake attacks
• Firewall: Ruleset review, egress filtering, segmentation
• Active Directory: Kerberos, ACLs, delegation, lateral movement
• Infrastructure: OS hardening, patch management, exposed services
• MCP Security: Model Context Protocol, tool poisoning, prompt injection
• LLM Security: OWASP LLM Top 10, prompt injection, data leakage
• Threat Modeling: STRIDE, attack trees, abuse cases
• Configuration Review: CIS benchmarks, hardening baselines
• Containers & Kubernetes: Image security, RBAC, network policies
• CI/CD: Pipeline attacks, secrets exfiltration, dependency confusion
• IoT: Firmware analysis, hardware interfaces, insecure protocols
• Blockchain: Smart contracts, reentrancy, oracle manipulation
• Phishing: Social engineering campaigns, infrastructure setup
• OSINT: Domain footprinting, exposed credentials, code leakage
• Forensics: Evidence acquisition, disk/memory analysis, chain of custody

Best Practices

1. Start with OSINT: Always begin reconnaissance with the OSINT platform
2. Use severity filters: Focus on critical/high findings first during time-constrained assessments
3. Document thoroughly: Add detailed notes—future you will thank present you
4. Export regularly: Backup your progress with JSON exports
5. Combine platforms: Security assessments rarely fit one category—use multiple platforms
6. Customize for context: Not all checks apply to every assessment—mark N/A liberally
7. Track remediation: Use status changes to track finding lifecycle
8. Search before adding: Use global search to find existing checks before requesting new ones

License & Usage

Personal Use Only license—see LICENSE file in repository.

• ✅ Personal, non-commercial security assessments
• ✅ Educational use
• ✅ Bug bounty hunting
• ❌ Commercial/paid services
• ❌ Redistribution or resale
• ❌ Hosted/SaaS offerings

Commercial licensing: Contact via https://m14r41.in

Project: https://github.com/m14r41/PentestingChecklist
Live Tool: https://checklist.m14r41.in/
Author: m14r41