# Pentest

> Authorized penetration testing with Deep Eye (this repo). Use for pentest, penetration test, vulnerability assessment, web/API/mobile scan, OWASP testing, /pentest. Requires written authorization. Never scan unauthorized targets.

- Skill: `zakirkun/pentest` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zakirkun/pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/pentest

---


# Deep Eye — Pentest Skill

Authorized offensive testing only. Work inside this repository’s tool surface.

## Preconditions

1. Written RoE / scope (hosts, paths, time, credentials).
2. Config present: `config/config.yaml` (from example or wizard).
3. No secrets committed; use local `config/config.yaml` only.

## Quick start

```bash
pip install -r requirements.txt
cp config/config.example.yaml config/config.yaml   # or:
python deep_eye.py --setup

python deep_eye.py -u https://TARGET -v --formats html,json
python deep_eye.py -u https://TARGET --scope-nl "only /api/* no /logout"
python deep_eye.py -u https://TARGET --retest-new reports/baseline.json
```

## Workflow

### 1. Scope

- CLI: `--scope-nl "..."` → `utils/nl_scope.py` → `scope` config.
- YAML: `scope.enabled`, `allowed_hosts`, `excluded_paths`.

### 2. Recon

- `scanner.enable_recon: true`
- Modules: `modules/reconnaissance/`, optional OSINT (`osint` config).
- OpenAPI seed: `openapi.enabled` + `openapi.source`.

### 3. Authenticated scan

| Need | Config |
|------|--------|
| Login macro | `login_replay.enabled`, `macro_path` |
| Multi-role | `auth_session.enabled`, `roles` |
| CAPTCHA skip | `captcha.enabled`, `skip_protected` |
| Challenge (CF) | `challenge_solver.enabled` |

### 4. Checks to enable

Edit `vulnerability_scanner.enabled_checks` (not CLI). High-value packs:

| Goal | Checks |
|------|--------|
| Core inject | `sql_injection`, `xss`, `ssrf`, `lfi`, `rfi`, `ssti`, `command_injection` |
| Authz | `idor`, `api_bola_deep`, `jwt_deep`, `oauth_testing` |
| API | `api_security`, `graphql_deep`, `openapi` seed |
| Cloud | `ssrf_cloud`, `cloud_misconfig` |
| Client/WS | `cors_csp`, `websocket_deep`, `sse_injection`, `supply_chain_js` |
| Deep inject | `host_header_deep`, `crlf_header_inject_deep`, `hpp_pollution`, `ssti_engines` |
| Mobile | `mobile.enabled` + `frida_mobile`, `android_static`, `ios_plist`, `mobile_ssl_pinning`, `mobile_ai_chain` |

Payloads: `payload_generation.use_ai`, `cve_database`, OAST via `scanner.oast_callback_url`.

### 5. Post-process

Order in engine: dedupe → FP replay → evidence → RAG → compliance → AI triage → bounty → report.

| Feature | Config |
|---------|--------|
| Dedupe | `reporting.dedupe` |
| CVE enrich | `experimental.enable_cve_matching` (+ optional `cve_live_lookup`) |
| Triage | `ai_triage.enabled` |
| Bounty MD | `bug_bounty.enabled` |
| Templates | `templates.enabled` |

### 6. Manual verify + report

- Reproduce High/Critical with minimal request.
- Report formats: `reporting.formats` / `--formats html,json,sarif,junit,csv,xlsx`.
- Diff: `python deep_eye.py --diff baseline.json current.json`.

## Code map

| Task | Location |
|------|----------|
| CLI | `deep_eye.py` |
| Lifecycle | `core/scanner_engine.py` |
| Checks | `core/vulnerability_scanner.py` + `modules/*` |
| Multi-surface inject | `core/injection_surfaces.py` |
| AI | `ai_providers/`, tool calling on OpenAI/Claude |
| Config truth | `config/config.example.yaml` |

## Rules

- No unauthorized targets.
- No destructive DoS unless RoE allows.
- Redact secrets/PII in reports.

## Output

```markdown
## Pentest (Deep Eye)
- Target / scope:
- Config highlights:
- Commands run:
- Severity counts:
- Top findings (type → url → impact):
- Retest command:
```