Full Security Pentest

Full Security Penetration Testing Skill

Comprehensive, no-blind-spot security attack and assessment covering all attack vectors.

When to Activate

• Running a full security penetration test on a project
• Auditing an application for all known vulnerability classes
• Pre-release security assessment
• Authorized red team engagement

Attack Execution Order

Execute all phases sequentially. Each phase produces findings recorded in the report.

Phase 1: Information Gathering

Reconnaissance and service fingerprinting.

1A. Port Scanning (nmap)

# Quick scan - top 1000 ports
nmap -sV -sC -oN nmap-quick.txt <TARGET>

# Full port scan
nmap -p- -sV -oN nmap-full.txt <TARGET>

# Service version + OS detection
nmap -sV -O -A -oN nmap-detailed.txt <TARGET>

# Script scan for known vulns
nmap --script=vuln -oN nmap-vuln.txt <TARGET>

1B. Service Fingerprinting

# HTTP headers and tech stack
curl -I <TARGET_URL>

# Identify web technologies
httpx -u <TARGET_URL> -tech-detect -status-code -title -server 2>/dev/null || curl -sI <TARGET_URL>

1C. Subdomain & DNS Enumeration

# Subfinder (if installed)
subfinder -d <DOMAIN> -o subdomains.txt 2>/dev/null

# DNS records
nmap --script=dns-brute <DOMAIN>

Phase 2: Web Vulnerability Scanning

Automated scanning for known web vulnerabilities.

2A. Nuclei (Template-Based Scanner)

# Full scan with all templates
nuclei -u <TARGET_URL> -o nuclei-report.txt -severity critical,high,medium

# Specific template categories
nuclei -u <TARGET_URL> -tags cve,misconfig,exposure -o nuclei-cve.txt

# API-focused scan
nuclei -u <TARGET_URL> -tags api,token -o nuclei-api.txt

2B. Nikto (Web Server Scanner)

# Standard scan
nikto -h <TARGET_URL> -o nikto-report.txt -Format txt

# Scan with tuning for specific tests
nikto -h <TARGET_URL> -Tuning 1234567890 -o nikto-full.txt

Phase 3: SQL Injection Testing

3A. Automated Detection (sqlmap)

# Test a URL with GET parameter
sqlmap -u "<TARGET_URL>?param=value" --batch --banner --level=3 --risk=2

# Test POST form
sqlmap -u "<TARGET_URL>" --data="param1=value1&param2=value2" --batch --banner

# Test with specific cookie/header
sqlmap -u "<TARGET_URL>" --cookie="session=xxx" --batch --banner

# Dump database info (only if authorized)
sqlmap -u "<TARGET_URL>?param=value" --batch --dbs

3B. Manual SQL Injection Checks

Test these payloads manually on all input fields:

' OR '1'='1
" OR "1"="1
' OR '1'='1' --
' UNION SELECT NULL--
' AND 1=CONVERT(int,@@version)--
1; WAITFOR DELAY '0:0:5'--

Record which inputs are vulnerable and which are properly sanitized.

Phase 4: XSS Testing

4A. Reflected XSS

Test all URL parameters and form inputs:

<script>alert('XSS')</script>
"><script>alert('XSS')</script>
<img src=x
javascript:alert('XSS')
<svg/onload=alert('XSS')>

4B. Stored XSS

Test all user-input fields that persist data:

• Profile fields (name, bio, etc.)
• Comments / reviews
• Product descriptions (seller side)
• Messages / chat

4C. DOM-Based XSS

# Search for dangerous sinks in code
grep -rn "innerHTML\|outerHTML\|document\.write\|eval(" <REPO_PATH> --include="*.js" --include="*.ts" --include="*.html"

# Search for unsanitized template usage
grep -rn "dangerouslySetInnerHTML\|v-html\|\|safe\|mark_safe\|Markup(" <REPO_PATH> --include="*.py" --include="*.js" --include="*.html"

Phase 5: Directory Brute Force

5A. ffuf

# Directory discovery
ffuf -w /opt/homebrew/share/wordlists/dirb/common.txt -u <TARGET_URL>/FUZZ -mc 200,301,302,403 -o ffuf-dirs.json

# File discovery
ffuf -w /opt/homebrew/share/wordlists/dirb/common.txt -u <TARGET_URL>/FUZZ -e .php,.py,.js,.env,.bak,.sql,.conf,.yml,.json -mc 200,301,302,403

# Virtual host discovery
ffuf -w <WORDLIST> -u <TARGET_URL> -H "Host: FUZZ.<DOMAIN>" -mc 200

5B. Sensitive File Discovery

# Check for common exposed files
for f in .env .env.local .env.production .git/config .git/HEAD robots.txt sitemap.xml .htaccess web.config package.json composer.json debug.log error.log; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "<TARGET_URL>/$f")
  echo "$f -> $code"
done

Phase 6: Python Code Security Audit

6A. Bandit (Static Analysis)

# Full scan
bandit -r <REPO_PATH> -f json -o bandit-report.json

# High severity only
bandit -r <REPO_PATH> -ll -f json -o bandit-high.json

# Specific checks
bandit -r <REPO_PATH> -t B101,B102,B103,B104,B105,B106,B107,B108,B110

6B. Manual Code Audit Checklist

# Hardcoded credentials
grep -rn "password\s*=\s*['\"]" <REPO_PATH> --include="*.py"

# Dangerous eval/exec
grep -rn "eval(\|exec(\|__import__\|subprocess\.call\|os\.system\|os\.popen" <REPO_PATH> --include="*.py"

# Insecure deserialization
grep -rn "pickle\.load\|yaml\.load\|marshal\.load" <REPO_PATH> --include="*.py"

# SQL string concatenation (injection risk)
grep -rn "execute.*%s\|execute.*format\|execute.*f'" <REPO_PATH> --include="*.py"

# Debug mode in production
grep -rn "DEBUG\s*=\s*True\|debug=True\|FLASK_DEBUG\|DJANGO_DEBUG" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml"

Phase 7: Git History Secret Scanning

# Gitleaks full history scan
gitleaks detect --source=<REPO_PATH> --report-format=json --report-path=gitleaks-report.json -v

# TruffleHog deep scan
trufflehog filesystem <REPO_PATH> --json > trufflehog-report.json

# Check for large files that shouldn't be in git
find <REPO_PATH> -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.pfx" -o -name "*.jks" -o -name "id_rsa*" -o -name "*.sqlite" -o -name "*.db" 2>/dev/null

# Check .gitignore coverage
cat <REPO_PATH>/.gitignore 2>/dev/null
# Verify .env, secrets, keys are listed

Phase 8: Authentication & Authorization Bypass

8A. Authentication Testing

# Test endpoints without auth
curl -v <TARGET_URL>/api/protected-endpoint

# Test with invalid token
curl -H "Authorization: Bearer invalid" <TARGET_URL>/api/protected-endpoint

# Test with empty auth
curl -H "Authorization: " <TARGET_URL>/api/protected-endpoint

# JWT manipulation (if applicable)
# Decode JWT, modify claims, re-encode with none algorithm

8B. Authorization Testing (IDOR)

# Test accessing other users' resources by ID manipulation
# /api/users/1/profile → try /api/users/2/profile
# /api/orders/100 → try /api/orders/101

# Test role escalation
# User role accessing admin endpoints
# Buyer accessing seller endpoints
# Seller accessing admin endpoints

8C. Code Audit for Auth Issues

# Missing auth decorators
grep -rn "def \w\+.*request" <REPO_PATH> --include="*.py" | head -30
grep -rn "@login_required\|@authenticated\|@requires_auth\|@permission" <REPO_PATH> --include="*.py"

# Compare: endpoints defined vs endpoints protected
grep -rn "@app\.route\|@router\.\|path(" <REPO_PATH> --include="*.py" -l

Phase 9: CSRF / SSRF Detection

9A. CSRF Testing

# Check for CSRF token in forms
grep -rn "csrf\|csrftoken\|_token\|authenticity_token" <REPO_PATH> --include="*.py" --include="*.html" --include="*.js"

# Check CSRF middleware
grep -rn "CsrfViewMiddleware\|csrf_protect\|csrf_exempt\|@csrf_exempt" <REPO_PATH> --include="*.py"

# State-changing endpoints without CSRF protection
grep -rn "methods.*POST\|methods.*PUT\|methods.*DELETE\|@csrf_exempt" <REPO_PATH> --include="*.py"

9B. SSRF Testing

# Find URL fetching code
grep -rn "requests\.get\|requests\.post\|urllib\|urlopen\|fetch\|http\.client\|aiohttp" <REPO_PATH> --include="*.py"

# Check if user input feeds into URL fetching
grep -rn "request\.\(args\|form\|json\|data\).*requests\.\|request\.\(args\|form\|json\|data\).*url" <REPO_PATH> --include="*.py"

Phase 10: Configuration Audit

# .env exposure
find <REPO_PATH> -name ".env" -o -name ".env.*" ! -name ".env.example" 2>/dev/null

# Debug mode
grep -rn "DEBUG\s*=\s*True\|debug\s*=\s*True\|FLASK_ENV.*development" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml" --include="*.yml"

# Default/weak credentials
grep -rn "admin.*password\|root.*password\|test.*password\|password.*123\|default.*key" <REPO_PATH> --include="*.py" --include="*.yaml" --include="*.env*" --include="*.json"

# Insecure HTTP
grep -rn "http://" <REPO_PATH> --include="*.py" --include="*.js" --include="*.env*" | grep -v "localhost\|127\.0\.0\.1\|http://schemas"

# Verbose error messages
grep -rn "traceback\|stack_trace\|full_traceback\|DEBUG.*True" <REPO_PATH> --include="*.py"

# Open CORS
grep -rn "Access-Control-Allow-Origin.*\*\|CORS_ALLOW_ALL\|allow_all_origins\|CORS.*True" <REPO_PATH> --include="*.py" --include="*.js"

# Security headers check
curl -sI <TARGET_URL> | grep -i "strict-transport\|x-content-type\|x-frame\|content-security-policy\|referrer-policy\|permissions-policy"

Finding Report Template

# Security Penetration Test Report

**Target**: [project name / URL]
**Date**: [YYYY-MM-DD]
**Tester**: Claude (Authorized Pentest)

## Executive Summary
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X

## Findings

### [FINDING-001] [SEVERITY] Title

- **Phase**: (which phase discovered this)
- **Category**: Secret Leak / SQLi / XSS / Auth Bypass / IDOR / CSRF / SSRF / Config / etc.
- **Severity**: CRITICAL / HIGH / MEDIUM / LOW
- **Location**: file:line or endpoint
- **Description**: What was found
- **Evidence**: Command output or code snippet
- **Impact**: What an attacker could exploit
- **Recommendation**: How to fix
- **CVSS (optional)**: Base score estimate

---

(repeat for each finding)

## Tools Used
- nmap, nikto, nuclei, sqlmap, ffuf, gitleaks, trufflehog, bandit, manual review

## Appendix
- Full scan outputs attached as separate files

Severity Classification

Output Directory

All reports saved to docs/security/:

• nmap-*.txt — network scan results
• nuclei-report.txt — vulnerability scan
• nikto-report.txt — web server scan
• sqlmap-*.txt — SQL injection results
• ffuf-dirs.json — directory brute force
• bandit-report.json — Python code audit
• gitleaks-report.json — git secret scan
• trufflehog-report.json — deep secret scan
• pentest-report.md — consolidated findings report