From pentest-framework
Enumerates subdomains, DNS records, open ports, tech stack, OSINT, and email security on target URL via passive pentest recon commands. For auditing deployed apps.
npx claudepluginhub sabania/pentest-cli --plugin pentest-frameworkThis skill is limited to using the following tools:
Run a comprehensive passive reconnaissance scan against a target URL to enumerate subdomains, DNS records, open ports, technology stack, and OSINT data.
Orchestrates pentest reconnaissance phase: enumerates subdomains via ASN/passive/brute, probes live hosts/ports, mines URLs/JS, dorks GitHub secrets, discovers cloud buckets, detects takeovers, maps attack surface.
Maps attack surface via subdomain discovery, port scanning, endpoint enumeration, and API discovery. Useful for security assessments and penetration testing.
Implements red team workflows for reconnaissance, subdomain enumeration, live host discovery, technology fingerprinting, and vulnerability discovery in bug bounty hunting.
Share bugs, ideas, or general feedback.
Run a comprehensive passive reconnaissance scan against a target URL to enumerate subdomains, DNS records, open ports, technology stack, and OSINT data.
The target URL is provided via $ARGUMENTS. If no URL is provided, ask the user for one.
Parse the target URL from $ARGUMENTS.
Delegate to recon-agent using the Agent tool. The agent must run the following commands sequentially, collecting all JSON output:
pentest -k -j -o ./findings recon subdomains <url>
pentest -k -j -o ./findings recon dns <url>
pentest -k -j -o ./findings recon ports <url>
pentest -k -j -o ./findings recon osint <url>
pentest -k -j -o ./findings discover tech <url>
pentest -k -j -o ./findings cloud email <url>
Read the JSON outputs from ./findings/ to gather all results.
Present a summary to the user covering:
-k to skip SSL verification for targets with self-signed certs.-j for machine-readable JSON output.-o ./findings to persist results for later reporting.