H-mmer

H-mmer/pentest-agents

Agent Claude Code

Privilege Escalation specialist (H1 #26). Use for testing vertical and horizontal privilege escalation, role manipulation, admin endpoint access, and permission boundary violations.

H-mmer/pentest-agents

Agent Claude Code

Report quality scorer. Use BEFORE submitting any report to validate completeness, clarity, title strength, CVSS accuracy, PoC quality, and overall report grade. Provide the draft report path or content.

H-mmer/pentest-agents

Agent Claude Code

Race Condition specialist (H1 #29). Use for testing TOCTOU flaws, double-spend, parallel request abuse on balance operations, coupon redemption, and any non-idempotent state changes.

H-mmer/pentest-agents

Agent Claude Code

Remote Code Execution specialist (H1 #70). Use for testing command injection, template injection (SSTI), deserialization, expression language injection, and any vector that achieves server-side code execution.

H-mmer/pentest-agents

Agent Claude Code

Attack surface ranker. Takes recon output + brain data, produces P1/P2/Kill prioritized attack plan with concrete curl commands for each P1 target. Use after recon to decide what to test first.

H-mmer/pentest-agents

Agent Claude Code

Reconnaissance agent for target enumeration. Use for subdomain discovery, port scanning, service fingerprinting, tech stack identification, and OSINT gathering. Specify scope and depth: 'passive' for DNS/cert/OSINT only, 'active' for port scans and probing, 'deep' for comprehensive enumeration.

H-mmer/pentest-agents

Agent Claude Code

Security report generation agent. Use for compiling findings into formal penetration test reports, executive summaries, technical write-ups, and bug bounty submissions. Provide the findings directory or list of vulnerabilities to document.

H-mmer/pentest-agents

Agent Claude Code

Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Adversarial validator for SAST findings. Your ONLY job is to DISPROVE the candidate. Find every reason it's not exploitable. If you can't disprove it, it survives. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Maps entry points where untrusted data enters a source file. Lists every function that receives external input with data type, size constraints, and initial validation. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Builds working exploits from confirmed SAST findings. Takes a confirmed crash, develops it into a full exploit. Tier 1 (DoS) → Tier 5 (code execution). Use via /sast command after PoC confirmation.

H-mmer/pentest-agents

Agent Claude Code

Source file attack surface ranker. Reads a repository, scores every source file 1-5 by exploitability. Outputs ranked JSON for per-file hunting. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Traces data flow from entry points to dangerous operations. Cross-file reasoning to determine which entries can reach which dangers, and what validation exists in between. MUST run on Opus for reasoning depth. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Analyzes validation gaps in data flows. Takes traced flows and identifies where checks are missing, insufficient, or bypassable. The 'interaction reasoning' step — finds bugs that exist in the gaps between individually correct-looking code. MUST run on Opus. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Focused PoC builder for SAST candidates. Receives a SPECIFIC candidate vulnerability that survived adversarial validation. Writes a PoC, compiles, runs with ASan, confirms or rejects. Use via /sast command.

H-mmer/pentest-agents

Agent Claude Code

Target scope validation agent. Use BEFORE any active testing to verify targets are in scope. Provide the target and the program name or scope file. Checks against .scope.txt, scope.yaml, and fetches live program scope from HackerOne/Bugcrowd/Intigriti APIs if configured.

H-mmer/pentest-agents

Agent Claude Code

SQL Injection specialist (H1 #67). Use for error-based, blind boolean, blind time-based, UNION-based, and out-of-band SQLi testing. Provide target endpoints with injectable parameters.

H-mmer/pentest-agents

Agent Claude Code

SSRF vulnerability hunting specialist. Use for testing URL-accepting parameters, webhook endpoints, file import features, and any server-side request functionality. Provide target endpoints with URL parameters.

H-mmer/pentest-agents

Agent Claude Code

Server-Side Template Injection specialist. Covers Jinja2 (H1 #74), Twig, Velocity, FreeMarker, ERB, Handlebars, Thymeleaf. Use for any rule-engine, comment/message rendering, PR automation, admin template, or user-customizable template surface. Systematic blocklist mapper + CVE bypass runner + runtime-vs-parse…

H-mmer/pentest-agents

Agent Claude Code

Subdomain Takeover specialist (H1 #145). Use for finding dangling DNS records pointing to unclaimed cloud resources, expired services, or deprovisioned infrastructure.

H-mmer/pentest-agents

Agent Claude Code

Finding validator. Runs 7-Question Gate + 4-gate checklist. Kills weak/theoretical findings FAST before any report writing. Output: PASS, KILL, DOWNGRADE, or CHAIN REQUIRED.

H-mmer/pentest-agents

Agent Claude Code

Automated vulnerability scanning agent. Use for running nuclei templates, nikto scans, SSL/TLS analysis, header checks, and known CVE detection against targets. Provide target URL or list and scan profile: 'quick' for top vulns, 'standard' for common checks, 'thorough' for deep scanning.

H-mmer/pentest-agents

Agent Claude Code

WAF fingerprinting and behavior mapping specialist. Use to identify the WAF, map its blocking rules, find bypass techniques, and document WAF behavior for other agents. Always run this before xss-hunter or injection testing on WAF-protected targets.

H-mmer/pentest-agents

Agent Claude Code

Smart contract and Web3/DeFi security auditor. Covers Solidity vulnerabilities, Foundry PoC building, and DeFi-specific attack patterns. Use for Immunefi, Code4rena, and other Web3 bug bounty programs.