hoangnguyen0403/common-pentest-methodology
skills/common/common-pentest-methodology/SKILL.md
PTES-aligned penetration testing methodology for backend, frontend, and mobile. Provides attack taxonomy, exploit techniques per vulnerability class, and platform-specific test matrices. Use when executing pentest workflow, planning security assessments, mapping attack surfaces, or building threat models.
$ install --global
skillsauthnpx skillsauth add hoangnguyen0403/agent-skills-standard common-pentest-methodologyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 15, 2026, 3:26 AM201.9s9 files scanned
SKILL.md
- name:
- common-pentest-methodology
- description:
- PTES-aligned penetration testing methodology for backend, frontend, and mobile. Provides attack taxonomy, exploit techniques per vulnerability class, and platform-specific test matrices. Use when executing pentest workflow, planning security assessments, mapping attack surfaces, or building threat models.
Penetration Testing Methodology (PTES-Aligned)
Priority: P0 (CRITICAL)
Always-Apply Rules
- No Exploit = No Report: Every finding requires reproducible Proof-of-Concept. Hypotheses without PoC are discarded.
- No Production Testing: All dynamic probes target local/staging only. Confirm authorization before Phase 1.
- No Single-Platform Bias: Assess backend, frontend, AND mobile surfaces when in-scope.
Workflow
Load alongside /pentest workflow. Provides methodology backbone for all 7 phases.
- Scope → Define test mode (whitebox/greybox/blackbox), platforms, exclusions.
- Recon → Build asset inventory per platform. See platform-recon.
- Threat Model → Rank endpoints by risk. See threat-modeling.
- Analyze → Run vulnerability matrix across all domains. Load
common-owasp,common-security-audit,common-dast-tooling. - Exploit → Validate each finding with PoC. See exploit-techniques.
- Post-Exploit → Assess blast radius, lateral movement, privilege escalation.
- Report → Audit-grade output with CVSS scoring. See report-template and compliance-mapping.
Platform Coverage Matrix
| Domain | Backend/API | Frontend/Web | Mobile (iOS/Android) |
|---|---|---|---|
| Injection | SQLi, CMDi, NoSQLi, LDAPi | Template injection, DOM sinks | Content provider SQLi, Intent injection |
| XSS | Response encoding | DOM XSS, innerHTML, framework bypasses | WebView loadUrl, JavaScript bridges |
| Auth | JWT, OAuth, Session, MFA | Token storage, session management | Keychain/Keystore, biometric bypass |
| AuthZ | BOLA/IDOR, BFLA, Mass Assignment | Client-side role gates | Local permission checks without server |
| SSRF | HTTP client + user URL | SSR with user-supplied URL | Custom scheme fetching arbitrary URLs |
| Business Logic | Race conditions, workflow bypass | Client-only validation, price tamper | IAP bypass, receipt validation skip |
| Crypto | Weak hash, missing TLS | HTTP calls, weak CSP | Missing cert pin, cleartext traffic |
| Config | CORS, debug mode, headers | Source maps, debug flags in prod | debuggable=true, ATS exceptions |
| Deps/SCA | npm audit, pip-audit, cargo audit | Bundle vuln analysis | pod audit, Gradle dependency scan |
| Secrets | Entropy + regex + liveness | Secrets in JS bundles | Keys in BuildConfig/Info.plist |
| LLM/AI | Prompt injection, excessive agency | Output to DOM sinks | Agent tools without confirmation |
Continuous & Compliance Execution
- Continuous Testing: Execute Delta scans on PRs or Replay regression PoCs. See continuous-pentest.
- Compliance Mapping: Map findings to SOC 2, ISO 27001, PCI DSS, or OWASP MASVS. See compliance-mapping.
Anti-Patterns
- No "scan and dump": Raw tool output not a pentest. Correlate findings across SAST + DAST + manual.
- No severity inflation: Theoretical risk without exploit evidence ≠ confirmed vulnerability.
- No happy-path-only: Test error states, edge cases, race conditions, not just golden flow.
References
- Platform Reconnaissance — Phase 1 recon commands per platform
- Threat Modeling Guide — Phase 2 attack surface prioritization
- Exploit Techniques — Phase 4 PoC construction per vuln class
- Report Template — Phase 6 audit-grade report format
- OWASP Mobile Top 10 — Mobile vulnerability detection
- Compliance Mapping — SOC 2, ISO 27001, PCI DSS mapping
- Continuous Pentesting — CI/CD integration and Delta testing
Related Skills
hoangnguyen0403/common-operator-profile
testing
VerifiedTrustedCommunity
Infer the requesting operator's technical fluency from message content (never ask directly) and adapt register — business, hybrid, or technical — across SDLC workflow output. Use when starting sdlc, brainstorm-feature, plan-feature, verify-work, publish-notes, or session-report, or whenever a request's phrasing signals a non-technical or cross-stack operator.
524SKILL.mdUpdated Jul 12, 2026
hoangnguyen0403/database-transactions
documentation
VerifiedTrustedCommunity
Define transaction boundaries, locking, and consistency guarantees for multi-step writes. Use when designing atomic operations, retries, idempotency, or concurrent write behavior.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-schema-design
development
VerifiedTrustedCommunity
Design relational or document schemas from access patterns, cardinality, and lifecycle. Use when modeling entities, choosing embed vs normalize, or shaping schema boundaries before implementation.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-query-performance
data-ai
VerifiedTrustedCommunity
Diagnose database latency with explain plans, index ownership, and query-shape review. Use when a query is slow, an index is missing, or scans and N+1 patterns appear.
524SKILL.mdUpdated Jun 19, 2026