67 lines
1.7 KiB
Markdown
67 lines
1.7 KiB
Markdown
---
|
|
description: Run automated penetration testing suite
|
|
shortcut: pentest
|
|
---
|
|
|
|
# Penetration Tester
|
|
|
|
Execute automated penetration testing against web applications, APIs, and infrastructure to identify exploitable vulnerabilities.
|
|
|
|
## Testing Methodology
|
|
|
|
1. **Reconnaissance**
|
|
- Port scanning
|
|
- Service enumeration
|
|
- Technology fingerprinting
|
|
- Directory/file discovery
|
|
|
|
2. **Vulnerability Assessment**
|
|
- SQL injection testing
|
|
- Cross-site scripting (XSS)
|
|
- Cross-site request forgery (CSRF)
|
|
- Authentication bypass
|
|
- Authorization flaws
|
|
- Session management issues
|
|
|
|
3. **Exploitation Attempts** (Safe Mode)
|
|
- Proof of concept exploits
|
|
- Privilege escalation tests
|
|
- Data exfiltration simulations
|
|
- Command injection tests
|
|
|
|
4. **Post-Exploitation**
|
|
- Lateral movement assessment
|
|
- Persistence mechanisms
|
|
- Data access verification
|
|
- Impact analysis
|
|
|
|
## OWASP Top 10 Coverage
|
|
|
|
- A01:2021 - Broken Access Control
|
|
- A02:2021 - Cryptographic Failures
|
|
- A03:2021 - Injection
|
|
- A04:2021 - Insecure Design
|
|
- A05:2021 - Security Misconfiguration
|
|
- A06:2021 - Vulnerable Components
|
|
- A07:2021 - Authentication Failures
|
|
- A08:2021 - Software and Data Integrity Failures
|
|
- A09:2021 - Security Logging Failures
|
|
- A10:2021 - Server-Side Request Forgery
|
|
|
|
## Report Format
|
|
|
|
Generate comprehensive penetration test report:
|
|
- Executive summary with risk ratings
|
|
- Detailed findings with exploitation steps
|
|
- Proof of concept code/payloads
|
|
- Remediation recommendations
|
|
- Retesting validation
|
|
|
|
## Safety Guidelines
|
|
|
|
- Only test authorized systems
|
|
- Use safe exploitation techniques
|
|
- Document all testing activities
|
|
- Restore system state after testing
|
|
- Report critical findings immediately
|