# Pentesting Checklist Usage

> Interactive security assessment checklist covering 23 platforms with 1000+ checks for penetration testing, bug bounty, and security assessments

- Skill: `aradotso-security-skills/pentesting-checklist-usage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/pentesting-checklist-usage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/pentesting-checklist-usage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aradotso-security-skills/pentesting-checklist-usage

---


# PentestingChecklist Skill

> Skill by [ara.so](https://ara.so) — Security Skills collection.

PentestingChecklist is a comprehensive, client-side security assessment tool providing structured checklists across 23 platforms including Web, API, Mobile, Cloud, Active Directory, Kubernetes, LLM, and more. It runs entirely in-browser with no backend—all progress, notes, and findings are stored locally in `localStorage`.

## What It Does

- **Hierarchical assessment framework**: Platform → Category → Technology → Check (4-level structure)
- **1000+ security checks** across 23 assessment platforms
- **Progress tracking**: Mark checks as Open/Closed/N/A, add notes per check
- **Global search**: Search across all platforms, checks, descriptions, tags, and references
- **Export capabilities**: Markdown, CSV, Excel (.xlsx), JSON formats
- **Severity filtering**: Critical, High, Medium, Low, Info badges
- **Private by design**: No login, no backend, no telemetry—everything stays local

## Installation & Setup

### Using the Hosted Version

Access directly at: **https://checklist.m14r41.in/**

No installation required—runs entirely in your browser.

### Self-Hosting

```bash
# Clone the repository
git clone https://github.com/m14r41/PentestingChecklist.git
cd PentestingChecklist

# Install dependencies
npm install
# or
pnpm install

# Start development server
npm run dev
# or
pnpm dev

# Build for production
npm run build
# or
pnpm build

# Preview production build
npm run preview
```

The application will be available at `http://localhost:5173` (dev) or as static files in `dist/` (production).

## Project Structure

PentestingChecklist is built with TypeScript, React, and Vite. Key directories:

```
PentestingChecklist/
├── src/
│   ├── components/     # React components
│   ├── data/          # Checklist data (JSON/TS)
│   ├── hooks/         # Custom React hooks
│   ├── utils/         # Utility functions
│   └── types/         # TypeScript type definitions
├── public/            # Static assets
└── dist/             # Production build output
```

## Understanding the Data Model

The checklist uses a 4-level hierarchy:

```typescript
// Core data structure
interface Platform {
  id: string;
  name: string;
  description: string;
  categories: Category[];
}

interface Category {
  id: string;
  name: string;
  technologies: Technology[];
}

interface Technology {
  id: string;
  name: string;
  checks: Check[];
}

interface Check {
  id: string;
  title: string;
  description: string;
  severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
  tags: string[];
  tools?: string[];
  references?: string[];
  status?: 'open' | 'closed' | 'na';
  notes?: string;
}
```

## Key Features & Usage

### 1. Navigation

```typescript
// Platform pages are accessed via:
// /platform/web-application
// /platform/api
// /platform/mobile
// /platform/active-directory
// etc.

// All platforms view:
// /checklist
```

### 2. Global Search (⌘K / Ctrl+K)

Press the keyboard shortcut from any page to open search:
- Searches across platforms, categories, technologies, checks
- Searches descriptions, tags, tools, and references
- Auto-expands and highlights selected results

### 3. Progress Tracking

Each check can be marked with a status:
- **Open**: Finding identified, needs remediation
- **Closed**: Check completed/passed or finding resolved
- **N/A**: Not applicable to current assessment

Progress is calculated automatically per category, platform, and globally.

### 4. Adding Notes

Click any check to expand it and add notes:
- Record payloads, request IDs, screenshots references
- Document evidence and reproduction steps
- Notes persist in browser localStorage
- Notes are included in exports

### 5. Exporting Assessment Data

```typescript
// Export formats available:
// - Markdown (.md): Human-readable report
// - CSV (.csv): Spreadsheet import
// - Excel (.xlsx): Formatted spreadsheet with multiple sheets
// - JSON (.json): Complete state for re-import

// Export includes:
// - Platform/category/technology/check hierarchy
// - Check statuses (open/closed/na)
// - Notes for each check
// - Severity levels
// - Tags and references
```

### 6. Importing Previous Assessments

Upload a previously exported JSON file to restore:
- All check statuses
- All notes
- Progress tracking state

## Common Workflows

### Starting a New Assessment

```typescript
// 1. Navigate to the relevant platform
//    Example: /platform/web-application

// 2. Use filters to focus on priority areas
//    - Filter by severity: critical, high
//    - Expand relevant categories

// 3. Work through checks systematically
//    - Mark checks as you complete them
//    - Add notes for findings
//    - Reference tools and techniques

// 4. Export findings periodically
//    - JSON export for backup
//    - Markdown/Excel for reporting
```

### Bug Bounty Workflow

```typescript
// 1. Start with OSINT platform checks
//    /platform/osint
//    - Domain enumeration
//    - Exposed credentials
//    - Code leakage

// 2. Move to Web Application checks
//    /platform/web-application
//    - Authentication bypass
//    - Authorization flaws
//    - Injection vulnerabilities

// 3. API testing (if applicable)
//    /platform/api
//    - OWASP API Security Top 10
//    - Object-level authorization
//    - Mass assignment

// 4. Track all findings with notes
//    - Reproduction steps
//    - Affected endpoints
//    - Impact assessment

// 5. Export findings for submission
//    - Markdown for bug reports
//    - CSV for tracking multiple findings
```

### Red Team Engagement

```typescript
// Multi-platform assessment approach:

// Phase 1: Reconnaissance
// /platform/osint
// /platform/network

// Phase 2: Initial Access
// /platform/phishing
// /platform/web-application

// Phase 3: Lateral Movement
// /platform/active-directory
// /platform/infrastructure

// Phase 4: Privilege Escalation
// /platform/active-directory
// /platform/cloud

// Phase 5: Persistence & Exfiltration
// /platform/infrastructure
// /platform/cloud

// Track progress across all platforms
// Use global search to find relevant checks
// Export comprehensive report at end
```

### Cloud Security Assessment

```typescript
// Navigate to cloud platform:
// /platform/cloud

// Key categories to review:
// 1. IAM (Identity & Access Management)
//    - Overly permissive roles
//    - Root account usage
//    - MFA enforcement

// 2. Storage Security
//    - Public S3 buckets
//    - Unencrypted storage
//    - Access logging

// 3. Compute Security
//    - Instance metadata SSRF
//    - Security group misconfigs
//    - Unpatched instances

// 4. Network Security
//    - VPC misconfigurations
//    - Exposed services
//    - Network segmentation

// Also check:
// /platform/containers-kubernetes (for EKS/AKS/GKE)
// /platform/devops (for CI/CD pipelines)
```

### Active Directory Assessment

```typescript
// Navigate to AD platform:
// /platform/active-directory

// Systematic enumeration approach:
// 1. Domain Enumeration
//    - User/group enumeration
//    - Trust relationships
//    - GPO analysis

// 2. Kerberos Attacks
//    - Kerberoasting
//    - AS-REP Roasting
//    - Unconstrained delegation

// 3. ACL Analysis
//    - GenericAll/GenericWrite abuse
//    - DCSync rights
//    - Ownership chains

// 4. Lateral Movement
//    - Pass-the-hash
//    - Pass-the-ticket
//    - WMI/DCOM abuse

// 5. Privilege Escalation
//    - Path to domain admin
//    - Golden/Silver tickets
//    - Credential dumping

// Document attack paths in notes
// Mark findings with appropriate severity
```

## LocalStorage Structure

Understanding data persistence for troubleshooting:

```typescript
// Key structure in localStorage:

// Check statuses:
localStorage.setItem('checkStatus_<checkId>', 'open|closed|na');

// Check notes:
localStorage.setItem('checkNotes_<checkId>', 'your notes here');

// To manually inspect:
// Open browser DevTools → Application/Storage → Local Storage
// Look for keys matching the patterns above

// To clear all data (reset):
// localStorage.clear(); // In browser console
// or use the "Reset" button in the UI
```

## Extending the Checklist

To add custom checks or modify existing ones:

```typescript
// 1. Locate the data files in src/data/
// Example: src/data/platforms/web-application.ts

// 2. Add a new check to a technology:
export const webApplicationPlatform: Platform = {
  id: 'web-application',
  name: 'Web Application',
  categories: [{
    id: 'authentication',
    name: 'Authentication',
    technologies: [{
      id: 'session-management',
      name: 'Session Management',
      checks: [
        {
          id: 'custom-check-001',
          title: 'Check for session fixation',
          description: 'Verify that session tokens are regenerated after login',
          severity: 'high',
          tags: ['session', 'authentication'],
          tools: ['Burp Suite', 'OWASP ZAP'],
          references: [
            'OWASP Session Management Cheat Sheet'
          ]
        }
      ]
    }]
  }]
};

// 3. Rebuild the application:
// npm run build
```

## Integration Examples

### Exporting to CI/CD

```typescript
// Use the JSON export as a security gate template:

// 1. Export baseline checklist as JSON
// 2. In CI/CD pipeline, load and compare:

import fs from 'fs';

interface ChecklistState {
  platform: string;
  checks: {
    id: string;
    status: 'open' | 'closed' | 'na';
    notes?: string;
  }[];
}

function validateSecurityChecks(checklistPath: string): boolean {
  const state: ChecklistState = JSON.parse(
    fs.readFileSync(checklistPath, 'utf-8')
  );
  
  const criticalOpen = state.checks.filter(
    c => c.status === 'open' && c.severity === 'critical'
  );
  
  if (criticalOpen.length > 0) {
    console.error(`❌ ${criticalOpen.length} critical findings still open`);
    return false;
  }
  
  return true;
}

// Usage in CI:
// if (!validateSecurityChecks('./security-checklist.json')) {
//   process.exit(1);
// }
```

### Generating Custom Reports

```typescript
// Process exported JSON to create custom reports:

import fs from 'fs';

interface ExportedData {
  exportDate: string;
  platforms: {
    name: string;
    categories: {
      name: string;
      technologies: {
        name: string;
        checks: {
          title: string;
          status: string;
          severity: string;
          notes?: string;
        }[];
      }[];
    }[];
  }[];
}

function generateExecutiveSummary(jsonPath: string): string {
  const data: ExportedData = JSON.parse(
    fs.readFileSync(jsonPath, 'utf-8')
  );
  
  let summary = '# Security Assessment Executive Summary\n\n';
  summary += `Assessment Date: ${data.exportDate}\n\n`;
  
  let totalChecks = 0;
  let openFindings = 0;
  let criticalFindings = 0;
  
  data.platforms.forEach(platform => {
    platform.categories.forEach(category => {
      category.technologies.forEach(tech => {
        tech.checks.forEach(check => {
          totalChecks++;
          if (check.status === 'open') {
            openFindings++;
            if (check.severity === 'critical') {
              criticalFindings++;
            }
          }
        });
      });
    });
  });
  
  summary += `## Key Metrics\n`;
  summary += `- Total Checks Performed: ${totalChecks}\n`;
  summary += `- Open Findings: ${openFindings}\n`;
  summary += `- Critical Findings: ${criticalFindings}\n\n`;
  
  return summary;
}

// Usage:
// const report = generateExecutiveSummary('./assessment-export.json');
// fs.writeFileSync('./executive-summary.md', report);
```

## Troubleshooting

### Progress Not Saving

```typescript
// Check localStorage availability:
if (typeof localStorage === 'undefined') {
  console.error('localStorage not available');
}

// Check for quota errors:
try {
  localStorage.setItem('test', 'test');
  localStorage.removeItem('test');
} catch (e) {
  console.error('localStorage quota exceeded or disabled');
}

// Clear old data if needed:
// Object.keys(localStorage)
//   .filter(key => key.startsWith('checkStatus_') || key.startsWith('checkNotes_'))
//   .forEach(key => localStorage.removeItem(key));
```

### Export Not Working

```typescript
// Check browser download permissions
// Ensure popup blockers aren't interfering

// Manually trigger download if automated fails:
function manualDownload(content: string, filename: string) {
  const blob = new Blob([content], { type: 'application/json' });
  const url = URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = url;
  a.download = filename;
  document.body.appendChild(a);
  a.click();
  document.body.removeChild(a);
  URL.revokeObjectURL(url);
}
```

### Search Not Finding Results

```typescript
// Search indexes:
// - Check titles
// - Check descriptions
// - Tags
// - Tools
// - References
// - Platform names
// - Category names
// - Technology names

// Use specific keywords from the check content
// Try partial matches (search is substring-based)
// Check for typos in search query
```

## Platform Coverage Reference

Quick reference for what each platform covers:

- **Web Application**: OWASP Top 10, auth, session, injection, business logic
- **API**: OWASP API Top 10, REST/GraphQL, authorization, rate limiting
- **Mobile**: OWASP MASVS, iOS/Android, storage, transport, reverse engineering
- **Thick Client**: Desktop apps, DLL injection, IPC, local storage
- **Secure Code Review**: Source analysis, dangerous sinks, secrets in code
- **Cloud**: AWS/Azure/GCP, IAM, storage, compute, SSRF via metadata
- **DevSecOps**: SAST/DAST/SCA, secrets management, supply chain
- **Network**: Host discovery, service enumeration, transport security
- **Wi-Fi**: WPA2/WPA3, rogue APs, handshake attacks
- **Firewall**: Ruleset review, egress filtering, segmentation
- **Active Directory**: Kerberos, ACLs, delegation, lateral movement
- **Infrastructure**: OS hardening, patch management, exposed services
- **MCP Security**: Model Context Protocol, tool poisoning, prompt injection
- **LLM Security**: OWASP LLM Top 10, prompt injection, data leakage
- **Threat Modeling**: STRIDE, attack trees, abuse cases
- **Configuration Review**: CIS benchmarks, hardening baselines
- **Containers & Kubernetes**: Image security, RBAC, network policies
- **CI/CD**: Pipeline attacks, secrets exfiltration, dependency confusion
- **IoT**: Firmware analysis, hardware interfaces, insecure protocols
- **Blockchain**: Smart contracts, reentrancy, oracle manipulation
- **Phishing**: Social engineering campaigns, infrastructure setup
- **OSINT**: Domain footprinting, exposed credentials, code leakage
- **Forensics**: Evidence acquisition, disk/memory analysis, chain of custody

## Best Practices

1. **Start with OSINT**: Always begin reconnaissance with the OSINT platform
2. **Use severity filters**: Focus on critical/high findings first during time-constrained assessments
3. **Document thoroughly**: Add detailed notes—future you will thank present you
4. **Export regularly**: Backup your progress with JSON exports
5. **Combine platforms**: Security assessments rarely fit one category—use multiple platforms
6. **Customize for context**: Not all checks apply to every assessment—mark N/A liberally
7. **Track remediation**: Use status changes to track finding lifecycle
8. **Search before adding**: Use global search to find existing checks before requesting new ones

## License & Usage

**Personal Use Only** license—see LICENSE file in repository.

- ✅ Personal, non-commercial security assessments
- ✅ Educational use
- ✅ Bug bounty hunting
- ❌ Commercial/paid services
- ❌ Redistribution or resale
- ❌ Hosted/SaaS offerings

Commercial licensing: Contact via https://m14r41.in

---

**Project**: https://github.com/m14r41/PentestingChecklist  
**Live Tool**: https://checklist.m14r41.in/  
**Author**: [m14r41](https://github.com/m14r41)