Pentest

Activate When

• /godmode:pentest, "penetration test", "security test"
• "find exploits", "hack test", "red team exercise"
• Preparing for security assessment or compliance audit

Workflow

0. Authorization (MANDATORY)

NEVER test without explicit authorization.
Scope: <in-scope targets, out-of-scope exclusions>
IF NOT authorized: stop immediately.

1. Reconnaissance

# Endpoint discovery
curl -s <target>/robots.txt
curl -s <target>/sitemap.xml
# Technology detection
curl -sI <target> | grep -iE "server|x-powered"

Passive: DNS, WHOIS, public repos, tech stack. Active: endpoint enumeration, API discovery.

2. OWASP Top 10 Testing

A01 Broken Access Control:
  [ ] Horizontal escalation (change user ID)
  [ ] Vertical escalation (user -> admin)
  [ ] IDOR (direct object references)
A02 Cryptographic Failures:
  [ ] HTTP (not HTTPS) data transmission
  [ ] Weak algorithms (MD5, SHA1 for passwords)
A03 Injection:
  [ ] SQL injection (parameterized? or string concat)
  [ ] XSS (stored, reflected, DOM-based)
  [ ] Command injection (user input in exec/system)
A05 Security Misconfiguration:
  [ ] Default credentials
  [ ] Debug mode in production
  [ ] Directory listing enabled
  [ ] Stack traces in error responses
A07 Authentication Failures:
  [ ] Brute force (no rate limiting/lockout)
  [ ] Weak password policy (< 8 chars allowed)
  [ ] Session fixation

IF finding severity >= HIGH: create PoC immediately. IF > 3 CRITICAL findings: stop testing, report.

3. API Security Testing

Auth: API accessible without auth?
  Token leakage in logs/URLs?
  Token valid after password change?
AuthZ: BOLA (change object IDs)
  BFLA (admin endpoints as regular user)
  Mass assignment (extra fields in body)
Input: oversized payloads (> 1MB JSON)
  Deeply nested JSON (> 100 levels)
  Rate limiting absent

4. Proof of Concept Format

FINDING <N>:
  Vulnerability: <title>
  Category: <OWASP ID>
  Severity: CRITICAL|HIGH|MEDIUM|LOW
  CVSS: <0.0-10.0>
  Steps to reproduce:
    1. <exact request/action>
    2. <observed response>
  Impact: confidentiality/integrity/availability
  Exploitability: trivial|moderate|complex

IF cannot reproduce after 2 attempts: discard finding. IF requires unrealistic preconditions: downgrade severity.

5. Remediation

FINDING <N> REMEDIATION:
  File: <file:line>
  Current (vulnerable): <code>
  Fixed: <code>
  Why: <security control added>
  Verify: <test confirming fix works>

ALWAYS provide concrete code fix, not "sanitize input".

6. Penetration Test Report

Target: <app/system>
Risk Rating: CRITICAL|HIGH|MODERATE|LOW|MINIMAL
Findings: <N>C <N>H <N>M <N>L <N>I
Coverage: 12 OWASP categories tested
Remediation priority:
  IMMEDIATE (24h): critical findings
  SHORT-TERM (1wk): high findings
  MEDIUM-TERM (1mo): medium findings
Verdict: PASS|CONDITIONAL PASS|FAIL

PASS: 0 critical/high, all medium have remediation. CONDITIONAL: 0 critical, high has remediation in progress. FAIL: any critical exists or < 8 categories tested.

Quality Targets

• Target: 0 critical/high severity findings in production
• OWASP Top 10: 100% coverage in security scan
• SQL injection test: 0 vulnerable endpoints

Hard Rules

1. NEVER test without explicit authorization.
2. NEVER use destructive payloads (DROP TABLE, rm -rf).
3. NEVER exfiltrate real user data.
4. NEVER inflate severity ratings.
5. NEVER skip the formal report.
6. ALWAYS reproducible steps for every finding.
7. ALWAYS concrete remediation code.
8. ALWAYS retest after remediation.

TSV Logging

Append .godmode/pentest-results.tsv:

timestamp	target	categories_tested	critical	high	medium	verdict

Keep/Discard

KEEP if: exploit produces observable evidence AND
  reproducible AND severity justified by impact.
DISCARD if: cannot reproduce after 2 attempts OR
  unrealistic preconditions OR duplicate root cause.

Stop Conditions

STOP when FIRST of:
  - All 12 OWASP categories evaluated
  - Every finding has PoC + remediation code
  - Formal report generated

Autonomous Operation

On failure: git reset --hard HEAD~1. Never pause.

Error Recovery