Stickman230

Stickman230/claude-pentest

Plugin Claude Code

Claude Code plugins for authorized security testing, AI threat testing, and reconnaissance.

Stickman230/claude-pentest

Plugin Claude Code

Full penetration testing framework - 63 attack categories across 11 domains covering OWASP, injection, authentication, cloud, and more.

Stickman230/claude-pentest

Agent

Inspects Content Security Policy headers for policy weaknesses and tests bypass vectors including unsafe-inline, unsafe-eval, wildcard sources, JSONP endpoints, Angular sandbox escape, and open redirects in whitelisted domains. Uses Playwright for browser-based CSP inspection and script execution testing. Follows…

Stickman230/claude-pentest

Agent

Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override. Generates browser-loadable PoC HTML for confirmed findings. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

Stickman230/claude-pentest

Agent

Identifies technology stacks, researches known CVEs in NVD/Exploit-DB/GitHub, adapts public PoC exploits, and validates exploitability against live targets. Follows 4-phase workflow. Deployed by cve-testing skill coordinator.

Stickman230/claude-pentest

Agent

Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate transparency), port scanning (nmap, masscan), and service enumeration. Builds attack surface inventory. Follows 4-phase workflow. Deployed by domain-assessment skill coordinator.

Stickman230/claude-pentest

Agent

Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap for automated SQLi detection and curl for manual probing. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

Stickman230/claude-pentest

Agent

Discovers REST API endpoints, GraphQL schemas, SOAP/WSDL services, WebSocket connections, and API documentation (Swagger/OpenAPI/Postman). Enumerates versioned APIs (v1/v2/v3) and undocumented endpoints. Produces structured API endpoint inventory. Follows 4-phase workflow. Deployed by web-application-mapping skill…

Stickman230/claude-pentest

Agent

Runs active directory and file brute-forcing using ffuf, gobuster, feroxbuster, nikto, and dirsearch to discover directories, files, backup files, configuration files, admin panels, and hidden resources. Produces structured directory inventory. Follows 4-phase workflow. Deployed by web-application-mapping skill…

Stickman230/claude-pentest

Agent

Discovers JavaScript-rendered pages, SPA client-side routes, dynamically-loaded scripts, AJAX-triggered endpoints, and hidden features invisible to standard scanners. Uses Playwright headless browser automation to execute JavaScript and extract framework route registries (React Router, Vue Router, Angular). Follows…

Stickman230/claude-pentest

Agent

Identifies and catalogs all dependencies, frameworks, libraries, and versions across backend and frontend stacks. Generates a Software Bill of Materials (SBOM) and correlates component versions against known CVE databases to flag components needing CVE testing. Follows 4-phase workflow. Deployed by…

Stickman230/claude-pentest

Agent

Synthesizes outputs from all four mapping agents (software-catalog, directory-scanner, api-discovery, javascript-mapper) into a unified attack surface report. Categorizes surfaces by type and risk, deduplicates overlapping findings, and produces a prioritized testing checklist. Reads-only from prior agent outputs …

Stickman230/claude-pentest

Agent

On-demand PayloadsAllTheThings fetcher. Use when a pentest agent needs full payloads not in local payloads/ files. Input: PATT category name (see URL Map). Output: relevant payloads extracted from PATT GitHub raw content.

Stickman230/claude-pentest

Agent

Executes specific vulnerability tests. Follows 4-phase workflow (Recon → Experiment → Test → Verify), generates PoCs, captures evidence. Specialized by attack type.

Stickman230/claude-pentest

Agent

Penetration-test PLANNER. Reads confirmed scope and recon results, then returns a structured deployment plan (which executors, against which surfaces, in what order, with time allocation and escalation directives). Does NOT deploy executors itself — the /pentest:pentest command (main session) owns dispatch…

Stickman230/claude-pentest

Agent

Tests for client-side JavaScript prototype pollution via URL query parameters, hash fragments, and JSON payloads. Verifies pollution by evaluating Object.prototype in browser DOM via Playwright. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

Stickman230/claude-pentest

Agent

Tests for reflected, stored, and DOM-based XSS vulnerabilities across HTML, attribute, JavaScript, URL, and CSS contexts. Covers framework-specific sinks (React dangerouslySetInnerHTML, Vue v-html, Angular bypass), WAF evasion, and CSP bypass techniques. Uses Playwright for browser-based evidence capture. Follows…

Stickman230/claude-pentest

Command

Define the attack profile for an engagement — select which attack categories and skills to use. Saves to .pentest-attacks.json. If run before /pentest:pentest, the orchestrator will respect the selection. If run standalone, does not launch a pentest.

Stickman230/claude-pentest

Command

Close pentest session — summarizes findings, ensures outputs are saved, lifts isolation, and prompts for /clear.

Stickman230/claude-pentest

Command

Connect to a Metasploit-Kali Server (MKS) REST API — verifies connectivity, discovers available Kali tools, and configures agents to prefer MKS endpoints over local Bash equivalents.

Stickman230/claude-pentest

Command

Define or update engagement scope — saves scope to disk without launching a pentest. Can be run before or during an engagement. If a pentest is active and the target changes drastically, warns the operator and suggests a new engagement.

Stickman230/claude-pentest

Command

Activate pentest mode — displays ASCII art, configures session isolation, collects engagement scope, then OWNS the engagement: pre-flight, recon, planning (via the pentester-orchestrator planner), executor dispatch, a time-budget quota loop, aggregation, and report generation.

Stickman230/claude-pentest

Skill Claude CodeCodex

Authentication testing skill - automates signup, login, 2FA bypass, CAPTCHA solving, and bot detection evasion using Playwright MCP. Tests authentication security controls. Includes behavioral biometrics simulation, OTP handling, and automated account creation for security assessments.

Stickman230/claude-pentest

Skill Claude CodeCodex

Application security testing coordinator for common vulnerability patterns including XSS, injection flaws, and client-side security issues. Orchestrates specialized testing agents to identify and validate common application security weaknesses.