Pentest Methodology
Etik guvenlik testi metodolojisi. Shannon framework'unden adapte.
ONEMLI: Bu skill sadece YETKILI guvenlik testleri icin kullanilir. Bug bounty, pentest anlasmasi, veya kendi sisteminiz olmali.
5-Faz Pipeline
Phase 1: Recon ──▶ Phase 2: Vuln Analysis ──▶ Phase 3: Exploitation
│
Phase 5: Report ◀── Phase 4: Verification ◀────────────┘
Phase 1: Reconnaissance (Kesfetme)
| Adim |
Arac/Yontem |
Cikti |
| Subdomain enum |
DNS brute, certificate transparency |
Subdomain listesi |
| Port scan |
nmap, masscan |
Acik portlar |
| Tech stack |
Wappalyzer, HTTP headers |
Teknoloji listesi |
| Directory enum |
ffuf, gobuster |
Endpoint listesi |
| API discovery |
Swagger/OpenAPI, sitemap |
API endpoint'leri |
| Source review |
JS dosyalari, comments |
Hardcoded info |
Phase 2: Vulnerability Analysis
OWASP Top 10 kontrol matrisi:
| # |
Vuln |
Test Yontemi |
| A01 |
Broken Access Control |
IDOR, privilege escalation, path traversal |
| A02 |
Cryptographic Failures |
SSL config, weak ciphers, plaintext storage |
| A03 |
Injection |
SQLi, XSS, command injection, template injection |
| A04 |
Insecure Design |
Business logic flaws, race conditions |
| A05 |
Security Misconfiguration |
Default creds, verbose errors, CORS |
| A06 |
Vulnerable Components |
CVE scan, outdated dependencies |
| A07 |
Auth Failures |
Brute force, session fixation, JWT attacks |
| A08 |
Data Integrity |
Deserialization, CI/CD pipeline attacks |
| A09 |
Logging Failures |
Log injection, insufficient audit trail |
| A10 |
SSRF |
Internal service access, cloud metadata |
Phase 3: Exploitation (Dogrulama)
Her bulgu icin:
- Reproduce: Tekrarlanabilir adimlar yaz
- Proof: Etkiyi goster (ekran goruntusu, response)
- Impact: Gercek etki ne? (Data leak, RCE, account takeover)
- Scope: Etki alani ne kadar genis?
Phase 4: Verification
Bulgunun gercek oldugunu dogrula:
- False positive degil mi? Farkli kosullarda tekrarla
- Scope dogru mu? Sadece bir endpoint mi, yoksa sistemik mi?
- Severity dogru mu? Etkiyi abartma, kucumseme
Phase 5: Report
Yapilandirilmis bulgu formati (asagida)
Proof Levels
| Level |
Tanim |
Ornek |
| L1 - Theoretical |
Potansiyel risk, exploit edilmemis |
"Bu endpoint input validate etmiyor" |
| L2 - Demonstrated |
Bypass/leak gosterildi |
"SQL injection ile hata mesaji leak etti" |
| L3 - Exploited |
Tam exploit, veri erisimi |
"Admin panel'e yetkisiz erisim saglandi" |
| L4 - Chained |
Birden fazla vuln zincirlendi |
"XSS + CSRF = Account takeover" |
Structured Finding Format
## [SEVERITY] Finding Title
**ID**: FINDING-001
**Severity**: Critical / High / Medium / Low / Informational
**Proof Level**: L1 / L2 / L3 / L4
**CVSS**: X.X (hesapla: cvss.org)
**CWE**: CWE-XXX
### Description
Ne bulundu, tek paragraf.
### Impact
Exploit edilirse ne olur?
### Steps to Reproduce
1. [Adim 1]
2. [Adim 2]
3. [Adim 3]
### Proof
[Screenshot, HTTP request/response, veya kod]
### Remediation
Nasil duzeltilir?
### References
- [OWASP link]
- [CWE link]
Source-to-Sink Taint Tracing
Kullanici input'unun tehlikeli bir fonksiyona ulasip ulasamadigini kontrol et:
Source (Input) ──▶ Transform/Sanitize? ──▶ Sink (Tehlikeli fonksiyon)
req.body.username ──▶ Validation var mi? ──▶ db.query(...)
req.query.redirect ──▶ URL whitelist var mi? ──▶ res.redirect(...)
req.headers.host ──▶ Sanitize var mi? ──▶ fetch(...)
Source'lar: req.body, req.query, req.params, req.headers, cookies, file uploads
Sink'ler: SQL query, eval(), exec(), redirect(), innerHTML, dangerouslySetInnerHTML
Agent Entegrasyonu
- security-analyst: Bu pipeline'i kullanarak tam guvenlik auditi yapar
- security-reviewer: Code review sirasinda vuln pattern'lerini kontrol eder
- code-reviewer: Security-relevant code degisikliklerinde flag kaldirir
Kurallar
- Yetki olmadan test YAPMA
- Rate limiting'e uy, sistemi cokertme
- Buldugun seyi raporla, exploit etme (beyond PoC)
- Hassas verileri rapordan cikar (maskeleme)
- Remediation onerisi ZORUNLU
1---2name: pentest-methodology3description: Ethical security testing methodology - 5-phase pipeline, OWASP checklist, proof levels, structured findings4---56# Pentest Methodology78Etik guvenlik testi metodolojisi. Shannon framework'unden adapte.910**ONEMLI**: Bu skill sadece YETKILI guvenlik testleri icin kullanilir. Bug bounty, pentest anlasmasi, veya kendi sisteminiz olmali.1112## 5-Faz Pipeline1314```15Phase 1: Recon ──▶ Phase 2: Vuln Analysis ──▶ Phase 3: Exploitation16 │17Phase 5: Report ◀── Phase 4: Verification ◀────────────┘18```1920### Phase 1: Reconnaissance (Kesfetme)2122| Adim | Arac/Yontem | Cikti |23|------|-------------|-------|24| Subdomain enum | DNS brute, certificate transparency | Subdomain listesi |25| Port scan | nmap, masscan | Acik portlar |26| Tech stack | Wappalyzer, HTTP headers | Teknoloji listesi |27| Directory enum | ffuf, gobuster | Endpoint listesi |28| API discovery | Swagger/OpenAPI, sitemap | API endpoint'leri |29| Source review | JS dosyalari, comments | Hardcoded info |3031### Phase 2: Vulnerability Analysis3233OWASP Top 10 kontrol matrisi:3435| # | Vuln | Test Yontemi |36|---|------|-------------|37| A01 | Broken Access Control | IDOR, privilege escalation, path traversal |38| A02 | Cryptographic Failures | SSL config, weak ciphers, plaintext storage |39| A03 | Injection | SQLi, XSS, command injection, template injection |40| A04 | Insecure Design | Business logic flaws, race conditions |41| A05 | Security Misconfiguration | Default creds, verbose errors, CORS |42| A06 | Vulnerable Components | CVE scan, outdated dependencies |43| A07 | Auth Failures | Brute force, session fixation, JWT attacks |44| A08 | Data Integrity | Deserialization, CI/CD pipeline attacks |45| A09 | Logging Failures | Log injection, insufficient audit trail |46| A10 | SSRF | Internal service access, cloud metadata |4748### Phase 3: Exploitation (Dogrulama)4950Her bulgu icin:511. **Reproduce**: Tekrarlanabilir adimlar yaz522. **Proof**: Etkiyi goster (ekran goruntusu, response)533. **Impact**: Gercek etki ne? (Data leak, RCE, account takeover)544. **Scope**: Etki alani ne kadar genis?5556### Phase 4: Verification5758Bulgunun gercek oldugunu dogrula:59- False positive degil mi? Farkli kosullarda tekrarla60- Scope dogru mu? Sadece bir endpoint mi, yoksa sistemik mi?61- Severity dogru mu? Etkiyi abartma, kucumseme6263### Phase 5: Report6465Yapilandirilmis bulgu formati (asagida)6667## Proof Levels6869| Level | Tanim | Ornek |70|-------|-------|-------|71| L1 - Theoretical | Potansiyel risk, exploit edilmemis | "Bu endpoint input validate etmiyor" |72| L2 - Demonstrated | Bypass/leak gosterildi | "SQL injection ile hata mesaji leak etti" |73| L3 - Exploited | Tam exploit, veri erisimi | "Admin panel'e yetkisiz erisim saglandi" |74| L4 - Chained | Birden fazla vuln zincirlendi | "XSS + CSRF = Account takeover" |7576## Structured Finding Format7778```markdown79## [SEVERITY] Finding Title8081**ID**: FINDING-00182**Severity**: Critical / High / Medium / Low / Informational83**Proof Level**: L1 / L2 / L3 / L484**CVSS**: X.X (hesapla: cvss.org)85**CWE**: CWE-XXX8687### Description88Ne bulundu, tek paragraf.8990### Impact91Exploit edilirse ne olur?9293### Steps to Reproduce941. [Adim 1]952. [Adim 2]963. [Adim 3]9798### Proof99[Screenshot, HTTP request/response, veya kod]100101### Remediation102Nasil duzeltilir?103104### References105- [OWASP link]106- [CWE link]107```108109## Source-to-Sink Taint Tracing110111Kullanici input'unun tehlikeli bir fonksiyona ulasip ulasamadigini kontrol et:112113```114Source (Input) ──▶ Transform/Sanitize? ──▶ Sink (Tehlikeli fonksiyon)115req.body.username ──▶ Validation var mi? ──▶ db.query(...)116req.query.redirect ──▶ URL whitelist var mi? ──▶ res.redirect(...)117req.headers.host ──▶ Sanitize var mi? ──▶ fetch(...)118```119120**Source'lar**: req.body, req.query, req.params, req.headers, cookies, file uploads121**Sink'ler**: SQL query, eval(), exec(), redirect(), innerHTML, dangerouslySetInnerHTML122123## Agent Entegrasyonu124125- **security-analyst**: Bu pipeline'i kullanarak tam guvenlik auditi yapar126- **security-reviewer**: Code review sirasinda vuln pattern'lerini kontrol eder127- **code-reviewer**: Security-relevant code degisikliklerinde flag kaldirir128129## Kurallar130131- Yetki olmadan test YAPMA132- Rate limiting'e uy, sistemi cokertme133- Buldugun seyi raporla, exploit etme (beyond PoC)134- Hassas verileri rapordan cikar (maskeleme)135- Remediation onerisi ZORUNLU
vibeeval