Pentesting

Pentesting Skill — Pipeline Shannon

§1 — Arsenal (detalle en checklists.md)

Recon: nmap, dig, whois, subfinder, amass, gobuster, ffuf, whatweb, crt.sh, testssl.sh Web: SQLi (error/blind/time/UNION), XSS (reflected/stored/DOM), SSTI, XXE, SSRF, CSRF, CMDi, path traversal, file upload, deserialization, business logic Auth: brute force, JWT (none/key-confusion/claim-tamper), OAuth abuse, SAML, session fixation AuthZ: IDOR, BOLA/BFLA, priv escalation (H/V), forced browsing, mass assignment API: REST param pollution, GraphQL introspection/DoS, gRPC reflection, WebSocket, rate limit bypass Infra: nmap NSE, mitmproxy, scapy, Redis/Mongo/ES/MySQL, TLS audit Container: Docker socket escape, privileged mode, K8s RBAC/etcd/pod escape, Helm injection Cloud: AWS IMDS/S3/IAM, Azure MI/SAS/RBAC, GCP metadata/SA keys Crypto: MD5/SHA1/ECB detection, padding oracle, hardcoded keys, PRNG prediction

§2 — Herramientas

# apt: nmap dnsutils whois nikto dirb tcpdump netcat socat openssl jq
# pip: sqlmap wfuzz mitmproxy scapy requests beautifulsoup4 pyjwt pycryptodome httpx

§3 — Informe final (Fase 5)

# Pentest Report — {sistema}
**Fecha:** {fecha} | **Entorno:** {env} | **Scope:** {desc}
## Executive Summary
Riesgo: {level} | Hallazgos probados: C:{n} H:{n} M:{n} L:{n}
Descartados (sin prueba L3): {n}
## Proven Findings (solo L3 — con evidencia)
## Attack Chains (diagramas de cadenas exitosas)
## Failed Attempts (L1/L2 — transparencia, sin contar como hallazgos)
## Remediation Roadmap (P0-P3)
## Positive Findings (controles que funcionaron)

§4 — Reglas por entorno

DEV: ✅ todo. Fuzzing agresivo, exploits, brute force, DoS controlado. ⚠️ No destruir datos sin backup. PRE: ✅ OWASP, fuzzing moderado. ❌ No brute force, no DoS, no datos ajenos. PROD: ✅ Solo pasivo (headers, TLS, DNS, auth test). ❌ No exploits, no fuzzing. Todo reversible.

§5 — Checklists (detalle en checklists.md)

Web: headers, TLS, cookies, CORS, auth, authz, input validation, upload, errors, rate limit, business logic API: auth, authz/endpoint, validation, mass assignment, rate limit, pagination, content-type, versioning, docs Infra: ports, versions, creds, SSH, firewall, DNS, email security, certs Cloud: non-root, no privileged, pinned images, RBAC, network policies, secrets, IAM, storage

§6 — MITRE ATT&CK

§7 — CVSS v3.1 simplificado

§8 — STRIDE quick-ref

§9 — Vulnerability Queue Format (Fase 3 → Fase 4)

Cada archivo 03-vuln-{clase}.json contiene:

{"vulnerabilities": [
  {"id": "INJ-001", "endpoint": "/api/search", "parameter": "q",
   "type": "sqli_error", "sink": "SQL query string interpolation",
   "source_file": "app.py:42", "confidence": "high",
   "suggested_payload": "' OR '1'='1", "notes": "No parameterized query"}
]}

Campos requeridos: id, endpoint, parameter, type, confidence. Si confidence < medium, no se intenta exploitation.

§10 — Verificación binaria (SE-351, gate de EXPLOITED)

Un hallazgo solo se marca EXPLOITED (y pasa a L3) si scripts/poc-verify.sh devuelve VERIFIED contra el oráculo del target. La evidencia la produce el programa (exit code / regex), NO el juicio del agente. "Facts, not claims".

bash scripts/poc-verify.sh verify --oracle rules/poc-verify/{target}.json \
  --poc {path_al_poc} --name PT-{NNN}
# VERDICT: VERIFIED   → EXPLOITED / L3
# VERDICT: NOT_VERIFIED → ATTEMPTED_FAILED (no reportar)
# VERDICT: TIMEOUT    → ATTEMPTED_FAILED (timeout)

• El recibo JSON generado (output/security/poc-verify-*.json) se adjunta al hallazgo como evidencia reproducible.
• security-auditor puede re-ejecutar el verificador para confirmar/desmentir.
• Oráculos por target en rules/poc-verify/. CRIT-001: PoCs solo en entornos controlados (Docker local network=none o comando local time-boxed), NUNCA contra producción sin autorización escrita. Sin red a proveedor.