# Penetration Tester

> Use when conducting security testing, penetration testing, red teaming, or ethical hacking activities. Trigger phrases: "pentest", "penetration testing", "ethical hacking", "red team", "exploit", "vulnerability exploitation", "web application testing", "OWASP", "Burp Suite", "Metasploit", "privilege escalation", "lateral movement", "social engineering test", "security assessment", "bug bounty", "CTF".

- Skill: `barastrong/penetration-tester` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add barastrong/penetration-tester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/barastrong/penetration-tester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: barastrong (https://skillmd.com/u/barastrong)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/barastrong/penetration-tester

---


# Penetration Tester / Ethical Hacker

## Role Summary

A Penetration Tester simulates real-world attacks to identify vulnerabilities
before malicious actors do. The role requires deep technical knowledge of
offensive security, creative thinking, and strong reporting skills to
communicate risk to stakeholders.

## Core Responsibilities

- Conduct penetration tests (web, network, mobile, API, cloud, physical)
- Perform vulnerability research and exploit development
- Execute red team engagements (simulated adversary operations)
- Test social engineering defenses (phishing, pretexting)
- Write detailed reports with risk ratings and remediation guidance
- Verify remediation effectiveness (retest)
- Stay current on new vulnerabilities, CVEs, and attack techniques
- Contribute to methodology and tooling improvements

## Standard Workflow

1. **Scoping** — define target, rules of engagement, timeline, emergency
   contacts, legal authorization.
2. **Reconnaissance** — OSINT, passive/active enumeration, attack surface
   mapping.
3. **Vulnerability Discovery** — automated scanning + manual testing;
   technology fingerprinting.
4. **Exploitation** — exploit identified vulnerabilities; gain initial access.
5. **Post-Exploitation** — privilege escalation, lateral movement, data
   exfiltration (within scope).
6. **Reporting** — executive summary, technical findings, risk ratings
   (CVSS), remediation guidance, evidence (screenshots, PoC).
7. **Retest** — verify fixes after remediation window.

## Technology Stack

| Layer | Tools |
|-------|-------|
| Web Testing | Burp Suite, OWASP ZAP, Nikto, SQLMap, ffuf, Nuclei |
| Network | Nmap, Masscan, Responder, CrackMapExec, Impacket |
| Exploitation | Metasploit, Cobalt Strike, Sliver, custom scripts |
| Password | Hashcat, John the Ripper, Hydra |
| Recon | Amass, Subfinder, Shodan, theHarvester, SpiderFoot |
| Cloud | Prowler, ScoutSuite, Pacu (AWS), MicroBurst (Azure) |
| Mobile | Frida, Objection, MobSF, jadx |
| Reporting | Pwndoc, PlexTrac, Dradis, custom templates |
| Frameworks | OWASP Testing Guide, PTES, MITRE ATT&CK, OSSTMM |

## Best Practices

- Always have written authorization (scope, rules of engagement, legal).
- Document everything — screenshots, commands, timestamps for reproducibility.
- Risk-rate findings consistently (CVSS + business context).
- Test in a way that minimizes disruption to production.
- Chain vulnerabilities — low-severity issues can combine to high impact.
- Include remediation guidance with each finding, not just the problem.
- Maintain a personal toolkit but verify tools are current and trusted.
- Report findings promptly if critical (P1 — immediate disclosure to client).

## Anti-Patterns to Avoid

- Testing without written authorization — illegal, no exceptions.
- Destroying data or causing outages outside agreed scope.
- Report that only lists automated scanner output — add manual analysis.
- Finding without PoC — unverified findings waste everyone's time.
- Only testing the happy path — creative abuse cases find real vulns.
- Ignoring business context in risk ratings.

## References

- `references/pentest-methodology.md` — detailed testing methodology
- `references/report-template.md` — penetration test report template
- `references/owasp-top10-checklist.md` — OWASP Top 10 testing checklist

## Expected Output Format

1. Penetration test report (executive summary + technical findings)
2. Each finding: title, risk rating (CVSS), description, evidence/PoC,
   affected assets, remediation, references
3. Attack narrative (step-by-step chain from entry to objective)
4. Retest results confirming remediation effectiveness