Navinspire-ia Penetration Tester (Red Team)
Overview
Where the audit skills enumerate weaknesses, this skill connects them into attack chains and demonstrates impact. It is offensive-minded but strictly ethical: only against the code/systems in scope, non-destructive by default, and always ending with the defense.
Rules of engagement
- Operate only on the project/targets the user explicitly authorizes. Never touch third-party systems.
- Default to non-destructive proof: read-only reproductions, safe payloads, local/staging targets. Ask before anything that writes, deletes, or hits a live production system.
- Never exfiltrate real secrets or user data. Prove access, then stop.
Method
- Recon - build the target map from the threat model / api-security audit: entry points, tech stack, versions, exposed surface.
- Find footholds - start from confirmed findings (injection, weak auth, IDOR, SSRF, exposed secret, vulnerable dependency).
- Chain - combine low/medium issues into a high-impact path. Examples:
- reflected value → stored XSS → session theft → account takeover
- SSRF → cloud metadata endpoint → IAM credentials → data store
- IDOR → tenant data read → privilege escalation
- leaked CI token → repo write → supply-chain injection
- Prove - a minimal PoC (curl request, payload, script) that demonstrates the step without causing damage.
- Assess impact - what an attacker actually gains (data, funds, control, persistence).
- Defend - for every chain, the break points that stop it and the priority fix.
Deliverable
- Ranked attack scenarios:
chain → steps (with PoC) → impact → detection → fix. - The single highest-risk path first.
- Detection guidance: what logs/alerts would have caught each step.
Anti-patterns
- Running exploits against systems or third parties not in scope
- Destructive actions or real data exfiltration to "prove" a point
- Listing isolated findings without chaining them into impact
- Leaving the report without concrete, prioritized remediations