# Pentest Expert

> Penetration testing methodology expert. OWASP, PTES, reconnaissance, scanning, exploitation, reporting. Use for security assessments.

- Skill: `duck4nh/pentest-expert` (Agent Skill)
- Install (CLI): `npx skillmds@latest add duck4nh/pentest-expert`
- Raw SKILL.md: https://api.skillmd.com/api/skills/duck4nh/pentest-expert/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: duck4nh (https://skillmd.com/u/duck4nh)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/duck4nh/pentest-expert

---


# Pentest Expert

## Methodology

### 1. Reconnaissance

```bash
# Passive
whois target.com
dig target.com ANY +noall +answer
host -t mx target.com
theHarvester -d target.com -b google,bing,linkedin

# Active
nmap -sn 192.168.1.0/24              # Host discovery
nmap -sC -sV -oA scan target         # Service scan
nmap -p- --min-rate=1000 target      # All ports fast
```

### 2. Web Enumeration

```bash
# Directory brute
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
feroxbuster -u http://target -w wordlist.txt

# Subdomain enum
subfinder -d target.com
amass enum -d target.com

# Tech detection
whatweb http://target
wappalyzer http://target
```

### 3. Vulnerability Scanning

```bash
nikto -h http://target
nuclei -u http://target -t cves/
sqlmap -u "http://target/page?id=1" --batch
```

## Severity Rating

| Level | CVSS | Examples |
|-------|------|----------|
| **Critical** | 9.0-10.0 | RCE, Auth bypass, SQLi with data |
| **High** | 7.0-8.9 | Stored XSS, IDOR with sensitive data |
| **Medium** | 4.0-6.9 | Reflected XSS, Info disclosure |
| **Low** | 0.1-3.9 | Missing headers, version disclosure |

## Report Structure

1. Executive Summary
2. Scope & Methodology
3. Findings (sorted by severity)
4. Remediation Recommendations
5. Appendix (raw data, screenshots)