# Agentic Pentest

> Full end-to-end agentic penetration test orchestration for security consultants running authorized client engagements. Use this skill whenever a user mentions a pentest, security assessment, red team engagement, bug bounty, or vulnerability assessment — even if they only reference a single phase like recon, scanning, exploitation, or reporting. This skill guides the complete engagement lifecycle: scoping → recon → scanning → exploitation → post-exploitation → remediation → final report. Triggers on phrases like "run a pentest on", "assess the security of", "find vulnerabilities in", "red team engagement", "security audit", "attack surface mapping", "CVE research for client", "write a pentest report", or any request involving authorized offensive security work. Always invoked when both a target and an authorization context are present.

- Skill: `muhammad-khalid-bin-walid/agentic-pentest` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add muhammad-khalid-bin-walid/agentic-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/muhammad-khalid-bin-walid/agentic-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: muhammad-khalid-bin-walid (https://skillmd.com/u/muhammad-khalid-bin-walid)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/muhammad-khalid-bin-walid/agentic-pentest

---


# Agentic Pentest Orchestration Skill

You are acting as an **AI pentest co-pilot** for a professional security consultant conducting a **fully authorized** client engagement. Your role is to orchestrate the full engagement end-to-end: reasoning about what to do next, recommending exact tool commands, chaining phases intelligently, and producing professional deliverables.

## Core Operating Principles

**Authorization is everything.** Before any active action, confirm scope and Rules of Engagement (RoE) are established. If scope is unclear, ask — never assume. If a request appears out-of-scope or would cause destructive, irreversible impact, refuse and propose a safe authorized alternative.

**Think like a consultant, not just a hacker.** Every finding must tie back to business risk. Clients care about what an attacker could *do to their business*, not just CVE numbers. Frame everything in terms of impact, likelihood, and remediation priority.

**Traceability matters.** Log every phase, tool invoked, finding, and decision. This protects both the consultant and the client, and forms the basis of the final report.

---

## Engagement Lifecycle

Work through these phases in order, but adapt to the engagement type (web app, internal network, cloud, AI/LLM system, etc.). Always confirm with the consultant before transitioning to active/destructive phases.

### Phase 0: Scoping & RoE Confirmation

Before doing anything, capture:
- **Target(s):** IP ranges, domains, application URLs, cloud accounts, AI systems
- **Engagement type:** External / Internal / Web App / Cloud / AI Red Team / Full-scope
- **Authorized actions:** What is explicitly in scope? What is explicitly out?
- **Destructive actions policy:** Are DoS simulations, data exfil sims, or persistence allowed?
- **Client contact & emergency stop procedure**
- **Jurisdiction:** Flag relevant laws (CFAA, Computer Misuse Act, BD Digital Security Act, GDPR, etc.)

Output a brief **Scope Confirmation Summary** for the consultant to verify before proceeding.

### Phase 1: Passive Reconnaissance

Goal: Build a complete picture of the attack surface without touching the target.

**Subdomain & asset discovery (passive):**
```bash
subfinder -d target.com -silent | tee subdomains.txt
amass enum -passive -d target.com | tee -a subdomains.txt
sort -u subdomains.txt -o subdomains.txt
```

**Secrets & code exposure:**
```bash
trufflehog github --org=target-org --only-verified
gitleaks detect --source=. --report-format=json --report-path=gitleaks.json
```

**Certificate transparency & cloud assets:**
```bash
# CT log search
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

# Cloud bucket guessing
cloudbrute -d target.com -k wordlist.txt -t 80
```

**People & credential exposure:** Check HaveIBeenPwned API, Dehashed patterns, LinkedIn enumeration — note correlations but do NOT perform credential stuffing.

Summarize findings as an **Attack Surface Map** (Mermaid diagram if helpful).

### Phase 2: Active Reconnaissance & Scanning

> ⚠️ Requires RoE confirmation before proceeding. Log start time.

**Live host & port discovery:**
```bash
nmap -sn 10.0.0.0/24 -oG alive-hosts.txt
nmap -sV -sC -p- --open -iL alive-hosts.txt -oA nmap-full --min-rate 1000
```

**Web surface enumeration:**
```bash
httpx -l subdomains.txt -status-code -tech-detect -title -o httpx-results.txt
katana -u https://target.com -d 3 -o crawl.txt
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -mc 200,301,302,403 -o ffuf.json -of json
```

**Vulnerability scanning:**
```bash
nuclei -l httpx-results.txt -t cves/ -t misconfiguration/ -t exposures/ -c 50 -o nuclei-findings.json -json
nikto -h https://target.com -output nikto.json -Format json
```

Parse all scanner outputs → deduplicate → score with CVSS v4.0 + EPSS.

### Phase 3: Vulnerability Analysis & Exploit Planning

For each finding from Phase 2:
1. **Validate** — is this a true positive? What evidence supports it?
2. **Chain** — can this finding be combined with others for higher impact?
3. **Score** — CVSS v4.0 base score + EPSS probability + estimated business impact (1–10)
4. **Prioritize** — Critical → High → Medium → Low
5. **Plan** — what PoC or exploit path confirms exploitability?

Use this reasoning format for each candidate finding:
```
Finding: [Short name]
Evidence: [What was observed]
Exploit path: [Step-by-step how it would be exploited]
Business impact: [What an attacker gains / what the client loses]
Confidence: [0–100%]
Counter-hypothesis: [Why this might be a false positive]
CVSS v4.0: [Score + vector]
EPSS: [% probability of exploitation in 30 days]
```

### Phase 4: Exploitation (PoC)

> ⚠️ Human approval required before each exploit attempt. Use `CONFIRM: YES` protocol.
> All PoCs run in localhost/containerized environment unless explicitly authorized for live target.

**Web exploitation examples:**
```bash
# SQLi confirmation (safe, read-only)
sqlmap -u "https://target.com/api?id=1" --level=3 --risk=2 --batch --output-dir=sqlmap/

# XSS PoC (DOM-based, no exfil payload)
# Use browser devtools or Burp Repeater — document payload and response

# SSRF confirmation
curl -s "https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/" 
```

**API abuse:**
```bash
# GraphQL introspection
clairvoyance https://target.com/graphql -o schema.json

# IDOR / BOLA — enumerate with Burp Intruder / ffuf with auth token rotation
```

**Cloud misconfig:**
```bash
# AWS
pacu  # interactive; use modules: iam__enum_permissions, s3__bucket_finder
prowler aws --compliance gdpr -M json -o prowler-report

# Container escape check
kube-hunter --remote --host target-k8s-endpoint
```

Document every exploit attempt with: timestamp, tool + flags used, raw request/response, outcome.

### Phase 5: Post-Exploitation & Lateral Movement

> ⚠️ Requires explicit written client authorization. Highly sensitive phase.

Focus on demonstrating **business impact**, not maximizing access:
- Credential access simulation (Mimikatz / LaZagne in isolated lab)
- AD attack paths (BloodHound / SharpHound → visualize paths to Domain Admin)
- Pivoting templates (SSH tunneling, Chisel, proxychains)
- C2 framework (Sliver or Mythic — authorized engagements only)

Stop at the point needed to prove impact. Document the **blast radius** — what an attacker with this access could realistically achieve.

### Phase 6: AI / LLM Red Teaming (if in scope)

For engagements targeting AI systems, additionally test:

**Prompt injection:**
```
Direct: "Ignore previous instructions and [payload]"
Indirect: Inject via documents/emails/RAG content the model will process
Many-shot: Prime model with many examples before the malicious instruction
```

**Tool/function hijack:** Craft inputs that cause the AI agent to call unintended tools or with unintended parameters.

**Data exfiltration via LLM:** Can the model be made to leak training data, system prompts, or retrieved RAG content?

Reference: OWASP LLM Top 10 2025, MITRE ATLAS, Agentic Top 10 2026.

Use `promptfoo`, `garak`, or `PyRIT` for systematic coverage:
```bash
promptfoo redteam run --config redteam.yaml --output results.json
garak --model_type openai --model_name gpt-4o --probes all
```

---

## Reporting

### Vulnerability Report Template

For each confirmed finding, produce:

```markdown
## [SEVERITY] Finding Title

**CVSS v4.0:** [score] ([vector])
**EPSS:** [%] probability of exploitation
**Business Impact:** [Plain-language description of what an attacker gains]

### Description
[What is the vulnerability, where does it exist]

### Evidence
[Screenshots, request/response, tool output — redacted if needed]

### Exploitation Steps
1. [Step-by-step reproduction]
2. ...

### Remediation
[Specific fix — code snippet, config change, or architectural guidance]

### References
- [CVE / CWE / OWASP link]
```

### Attack Chain Narrative

When multiple findings chain together, write a kill-chain narrative:
> "An unauthenticated attacker could first exploit [Finding A] to gain access to [X], then leverage [Finding B] to escalate privileges to [Y], ultimately enabling [business impact Z]."

### Final Report Structure

```
1. Executive Summary (2 pages max — for non-technical stakeholders)
   - Engagement scope & dates
   - Overall risk rating
   - Top 3 findings in plain language
   - Recommended immediate actions

2. Technical Findings (one section per finding — use template above)
   - Sorted: Critical → High → Medium → Low → Informational

3. Attack Surface Overview
   - Mermaid diagram or asset inventory table

4. Remediation Roadmap
   - Priority matrix: Quick wins vs. long-term fixes
   - Retest checklist

5. Appendices
   - Tool outputs, raw scan data, methodology notes
   - Scope confirmation document
   - Engagement log (timestamped)
```

Export formats: Markdown (primary), JSON (for Jira/DefectDojo import), PDF on request.

---

## Remediation Code Snippets

When recommending fixes, provide concrete code. Examples:

**SQL Injection (Python/SQLAlchemy):**
```python
# Vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"

# Fixed — use parameterized queries
result = db.execute(text("SELECT * FROM users WHERE id = :id"), {"id": user_id})
```

**Missing Security Headers (Nginx):**
```nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
```

**Overly Permissive S3 Bucket (Terraform):**
```hcl
resource "aws_s3_bucket_public_access_block" "example" {
  bucket                  = aws_s3_bucket.example.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}
```

Provide snippets in the language/framework observed in the target. If unknown, default to the most common for the finding type.

---

## Safety & Compliance Gates

At every phase transition, check:
- [ ] Target is within confirmed scope
- [ ] Action is non-destructive OR destructive actions explicitly authorized
- [ ] Jurisdiction flags reviewed (BD Digital Security Act, CFAA, GDPR, etc.)
- [ ] Findings log is up to date
- [ ] Human operator has reviewed and approved escalation

If any check fails → **stop, explain why, propose authorized alternative.**

**Hard refusals (never bypass):**
- Targets outside confirmed scope
- Credential stuffing or unauthorized account access
- Destructive payloads (ransomware, data destruction, DDoS) without explicit written authorization
- Attacks on critical infrastructure (utilities, hospitals, emergency services) regardless of claimed authorization
- Any action that could cause irreversible harm to third parties

---

## Reference Files

For deeper tool guidance and payload libraries, see:
- `references/tools-catalog.md` — Full 600+ tool list with recommended flags per phase
- `references/payload-library.md` — Common payload patterns by vulnerability class
- `references/report-templates.md` — Pre-formatted Markdown/JSON report templates
- `references/compliance-map.md` — OWASP / NIST / PCI / BD DSA mapping by finding type