pentest-full

/pentest-full — Complete Security Audit

Run a full-spectrum security audit against a target application. This is the main entry point that orchestrates all other pentest skills sequentially, from passive reconnaissance through active exploitation testing, and generates a final PDF report.

Input

The target URL is provided via $ARGUMENTS. If no URL is provided, ask the user for one.

Steps

1. Parse the target URL from $ARGUMENTS.

2. Create the findings directory:

   mkdir -p ./findings
   

3. Phase 1 — Passive Reconnaissance (no consent needed):

   Delegate to recon-agent. Run all recon commands:

   pentest -k -j -o ./findings recon subdomains <url>
   pentest -k -j -o ./findings recon dns <url>
   pentest -k -j -o ./findings recon ports <url>
   pentest -k -j -o ./findings recon osint <url>
   pentest -k -j -o ./findings discover tech <url>
   pentest -k -j -o ./findings cloud email <url>
   

   Present a brief summary of recon results before proceeding.

4. Phase 2 — Security Configuration Scanning (no consent needed):

   Delegate to scanner-agent. Run all scan commands:

   pentest -k -j -o ./findings scan headers <url>
   pentest -k -j -o ./findings scan ssl <url>
   pentest -k -j -o ./findings scan cors <url>
   pentest -k -j -o ./findings cloud waf <url>
   

   Present a brief summary of configuration findings.

5. Phase 3 — Discovery (no consent needed):

   Delegate to discovery-agent. Run all discovery commands:

   pentest -k -j -o ./findings discover bundle <url>
   pentest -k -j -o ./findings discover api <url>
   pentest -k -j -o ./findings discover graphql <url>
   pentest -k -j -o ./findings baas <url>
   

   Present a brief summary of discovered assets.

6. Phase 4 — Business Logic Analysis (no consent needed):

   Delegate to logic-agent. The agent crawls the application and tests for:

   • IDOR vulnerabilities
   • Privilege escalation
   • Payment/pricing manipulation
   • Workflow bypass
   • Rate limiting bypass
   • Feature access control issues Present a brief summary of business logic findings.

7. Phase 5 — Active Testing Decision Point:

   Ask the user:

   Phases 1-4 (passive testing) are complete. The following active tests send real attack payloads to the target:

   • Injection testing: SQLi, XSS, SSTI, SSRF, command injection, LFI, open redirect
   • Advanced attacks: Request smuggling, race conditions, cache poisoning, subdomain takeover
   • Auth brute force: Login brute force attempts

   Only proceed if you own the target or have written authorization.

   Do you want to run active tests? (yes/no)

8. Phase 6 — Active Testing (only if user consents):

   Run in parallel:

   • Delegate to injection-agent with all inject commands using --active --yes
   • Delegate to advanced-agent with all advanced commands using --active --yes Present combined active testing results.

9. Phase 7 — Report Generation:

   Delegate to report-agent:

   pentest report ./findings/
   

10. Present Executive Summary to the user:

    • Overall risk rating (Critical / High / Medium / Low)
    • Total findings by severity
    • Top 5 most critical findings with brief descriptions
    • Report file location
    • Key remediation priorities

Notes

• This skill orchestrates the entire audit workflow. Each phase delegates to a specialized agent.
• Passive phases (1-4) run without consent. Active phases (5-6) require explicit user consent.
• The full audit can take significant time depending on target size and complexity.
• All results are persisted in ./findings/ for the final report.
• Use -k to skip SSL verification for targets with self-signed certs.
• Use -j for machine-readable JSON output.