Router Reverse Skill Router Pentest Tools

ACTION REQUIRED (execute immediately after reading)

1. NOW: read ../field-journal/precedent-pentest.md — confirm this skill's operations are pre-authorized routine operations
2. NOW: confirm scope.md exists with auth.status=granted and a valid network_profile (../ops/scope-contract.md). If scope is missing, run case-init.ps1 and stop until the user grants authorization; automatically adding -AuthGranted is forbidden
3. NOW: confirm whether the current task falls within this skill's scope
4. NEXT: read ../tool-index.md, verify tool availability and actual paths
5. NEXT: when tools are missing, invoke bootstrap — do not guess paths
6. ACT: in the reconnaissance phase prefer references/recon-pipeline.md (CF browser headers / Windows nmap / curl --globoff); append each batch of results to timeline.md; write candidates into Evidence with ../scripts/append-evidence.ps1 (a hit ≠ verified)
7. ACT: modern web/cyber-range client-side surfaces (DOM XSS / prototype pollution / agent-browser) → references/client-side-lab-playbook.md; even without a breach, write observed Evidence + the failure gate

Penetration Testing Toolchain (Pentest Tools)

Scope

Use this skill when the task falls under these scenarios:

• Target reconnaissance (port scanning, subdomain enumeration, service identification)
• Vulnerability scanning (web vulnerabilities, CVE detection, misconfigurations)
• Web penetration (SQL injection, XSS, SSRF, directory brute forcing)
• Password cracking (hash cracking, dictionary attacks)
• Network penetration (service exploitation, lateral movement support)

Division of Labor with Other Skills

Quick rules of thumb:

• Need to "scan targets, find vulnerabilities, exploit vulnerabilities" → this skill
• Need to "analyze a program's internal logic" → a reversing skill
• Need to "operate a browser/desktop" → browser-automation

Tool Matrix

Reconnaissance

Vulnerability Scanning

Web Penetration

Password Cracking

Exploitation Frameworks

MCP Backend Selection

This skill supports two MCP backends; pick one:

Option A: pentestMCP (recommended, one-command Docker)

• Project: https://github.com/ramkansal/pentestmcp
• Characteristics: 20+ tools packed into a single Docker container, exposed directly as an MCP server
• Tools: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
• Installation:

# Pull and run
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

# Or build locally
git clone https://github.com/ramkansal/pentestmcp.git
cd pentestmcp
docker build -t pentestmcp .
docker run -d -p 8080:8080 pentestmcp

• MCP registration:

{
  "mcpServers": {
    "pentest": {
      "url": "http://localhost:8080/mcp"
    }
  }
}

Option B: mcp-security-hub (modular)

• Project: https://github.com/FuzzingLabs/mcp-security-hub
• Characteristics: each tool is its own MCP server, enable as needed
• Tools: Nmap, Ghidra, Nuclei, SQLMap, Hashcat
• Installation: follow each submodule's README

Option C: single-tool MCP (lightest)

If you only need one tool:

Reqable MCP (local traffic capture and API workbench)

The Reqable desktop client can expose local capture, API, breakpoint, and rule capabilities through the official Reqable MCP Server. Install and start Reqable separately first, then register the MCP:

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability reqable-mcp -McpHostTarget Codex

Replace Codex with Claude or Both to target a specific client; omitting -McpHostTarget writes no global client configuration.

The registered stdio configuration is:

{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
    }
  }
}

• Uses Reqable's local API by default; configure --host, --port, or --scope minimal|all per the official docs if needed.
• minimal is the recommended default scope; all exposes more tools that alter the proxy, rules, environment, or saved data.
• Captured traffic, request replay, and rule modification must still satisfy scope.md authorization and network restrictions; registering the MCP does not widen the target scope.

Workflow

Standard Penetration Flow

Important: when running a penetration test, you MUST follow the autonomous loop framework in references/pentest-loop.md. That framework defines the full risk gating, logging conventions, context compression, and completion checks.

1. Reconnaissance
   - Nmap port scan → confirm open services
   - Subfinder subdomain enumeration → widen the attack surface
   - httpx liveness checks → filter valid targets

2. Vulnerability scanning
   - Nuclei template scan → quickly find known vulnerabilities
   - ZAP/Nikto → deep web application scanning

3. Exploitation
   - SQLMap → SQL injection
   - FFUF → discover hidden paths/parameters
   - Manual verification → confirm exploitability

4. Post-exploitation (if within authorized scope)
   - Privilege escalation
   - Lateral movement
   - Data extraction

5. Reporting
   - Invoke the docs-generator skill to produce the penetration test report

Quick Scan Flow (results in 5 minutes)

1. nmap -sV -sC target → ports + services
2. nuclei -u target -severity critical,high → high-risk vulnerabilities
3. Web service present → ffuf -u target/FUZZ -w common.txt → directories
4. Summarize findings → decide next step

Caveats

• Authorization is mandatory — all scanning/attack operations must stay within the authorized scope
• Control scan rates — avoid tripping WAF/IDS or knocking over the target
• Passive before active — reconnaissance first, then vulnerability scanning, exploitation last
• Log every operation — every command and result must be recorded for the report
• Don't automate blindly — the AI should pause for confirmation at each key step

On-Demand Bootstrap

Automation Capability Boundary

Bootstrap Strategy

1. If the user has Docker → recommend pentestMCP (one-command bundle)
2. Without Docker → install individual tools as needed
3. Prioritize Nmap + Nuclei + SQLMap (covers 80% of scenarios)

Manual Installation Prompt

⚠️ **Pentest tools not installed**

**Recommended option (requires Docker)**:
docker pull ramkansal/pentestmcp
docker run -d -p 8080:8080 ramkansal/pentestmcp

**Lightweight option (install one by one)**:
- Nmap: winget install Insecure.Nmap
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- SQLMap: pip install sqlmap
- FFUF: download from https://github.com/ffuf/ffuf/releases

**Tell me once installed, and I'll continue the current task.**

Reference Resources

• awesome-pentest — 25k+ star pentest tool collection
• SecLists — wordlist/payload collection (essential for FFUF/Gobuster)
• PayloadsAllTheThings — payloads for every vulnerability class
• HackTricks — pentest techniques encyclopedia
• pentest-ai-agents — 35 Claude Code pentest sub-agents (reference their prompt patterns)
• Pentest Swarm AI — swarm-intelligence autonomous penetration framework (multi-agent collaboration, supports MCP server)
• ProxyCat — proxy pool middleware (avoids IP bans during mass scanning)
• planning-with-files — task planning skill (for loop testing)

Reference Documents in This Skill

• references/pentest-loop.md — core loop framework (risk gating + logging conventions + context compression)
• references/recon-pipeline.md — authorized reconnaissance pipeline (CF headers / nmap / Evidence)
• references/client-side-lab-playbook.md — DOM XSS / prototype pollution / agent-browser (cyber-range client-side surface)
• references/burpsuite-mcp-guide.md — complete BurpSuite MCP guide (63 tools + 7 major use scenarios + AI prompt templates)
• references/automation-loop-pattern.md — automated loop testing pattern (lightweight version)
• references/awesome-pentest-digest.md — pentest tool digest quick reference
• references/pentest-ai-agents-matrix.md — 35-agent coverage matrix
• payloads/ — custom payload directory (AI uses it first)
• templates/ — required file templates for penetration tests (scope/rules/plan/findings/progress)

src-hunter Vulnerability Hunting Knowledge Base

The src-hunter/ directory contains the complete SRC/Bug Bounty vulnerability hunting methodology:

• 19 attack playbooks (IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
• 305 structured payloads + 263 WAF/EDR bypass steps
• 2,887 disclosed HackerOne High/Critical reports
• 88,636 historical WooYun case statistics
• Chinese-component fingerprints and default credentials
• CVSS 4.0 report template

Usage: during the hunt phase the AI automatically reads the matching playbook and tests per its workflow.

See src-hunter/SKILL.md and src-hunter/references/ for details.

Routing Context

Upstream entry: skills/SKILL.md (master control), routing.md Trigger conditions: active scanning/attacking of targets needed (port scanning, vulnerability detection, injection testing, etc.) Downstream exits:

• Web vulnerability found needing deeper analysis → js-reverse/
• Binary vulnerability found needing reversing → ida-reverse/ or radare2/
• Browser operation needed to verify a vulnerability → browser-automation/
• Report generation after completion → docs-generator/

Peer related modules: CTF-Sandbox-Orchestrator/ (Web/Pwn challenges in CTFs use these tools)

Task Completion Self-Check (MUST pass before claiming completion)

• Did I execute every step of the workflow (not just read it)?
• Did I use real tool paths based on tool-index?
• Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
• Did I complete and write back the Checklist items required by RULES?