Stickman230/claude-pentest

Stickman230/claude-pentest

Agent

Part of pentest

Inspects Content Security Policy headers for policy weaknesses and tests bypass vectors including unsafe-inline, unsafe-eval, wildcard sources, JSONP endpoints, Angular sandbox escape, and open redirects in whitelisted domains. Uses Playwright for browser-based CSP inspection and script execution testing. Follows…

Stickman230/claude-pentest

Agent

Part of pentest

Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override. Generates browser-loadable PoC HTML for confirmed findings. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

Stickman230/claude-pentest

Agent

Part of pentest

Identifies technology stacks, researches known CVEs in NVD/Exploit-DB/GitHub, adapts public PoC exploits, and validates exploitability against live targets. Follows 4-phase workflow. Deployed by cve-testing skill coordinator.

Stickman230/claude-pentest

Agent

Part of pentest

Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate transparency), port scanning (nmap, masscan), and service enumeration. Builds attack surface inventory. Follows 4-phase workflow. Deployed by domain-assessment skill coordinator.

Stickman230/claude-pentest

Agent

Part of pentest

Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap for automated SQLi detection and curl for manual probing. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

Stickman230/claude-pentest

Agent

Part of pentest

Discovers REST API endpoints, GraphQL schemas, SOAP/WSDL services, WebSocket connections, and API documentation (Swagger/OpenAPI/Postman). Enumerates versioned APIs (v1/v2/v3) and undocumented endpoints. Produces structured API endpoint inventory. Follows 4-phase workflow. Deployed by web-application-mapping skill…

Stickman230/claude-pentest

Agent

Part of pentest

Runs active directory and file brute-forcing using ffuf, gobuster, feroxbuster, nikto, and dirsearch to discover directories, files, backup files, configuration files, admin panels, and hidden resources. Produces structured directory inventory. Follows 4-phase workflow. Deployed by web-application-mapping skill…

Stickman230/claude-pentest

Agent

Part of pentest

Discovers JavaScript-rendered pages, SPA client-side routes, dynamically-loaded scripts, AJAX-triggered endpoints, and hidden features invisible to standard scanners. Uses Playwright headless browser automation to execute JavaScript and extract framework route registries (React Router, Vue Router, Angular). Follows…

Stickman230/claude-pentest

Agent

Part of pentest

Identifies and catalogs all dependencies, frameworks, libraries, and versions across backend and frontend stacks. Generates a Software Bill of Materials (SBOM) and correlates component versions against known CVE databases to flag components needing CVE testing. Follows 4-phase workflow. Deployed by…

Stickman230/claude-pentest

Agent

Part of pentest

Synthesizes outputs from all four mapping agents (software-catalog, directory-scanner, api-discovery, javascript-mapper) into a unified attack surface report. Categorizes surfaces by type and risk, deduplicates overlapping findings, and produces a prioritized testing checklist. Reads-only from prior agent outputs …

Stickman230/claude-pentest

Agent

Part of pentest

On-demand PayloadsAllTheThings fetcher. Use when a pentest agent needs full payloads not in local payloads/ files. Input: PATT category name (see URL Map). Output: relevant payloads extracted from PATT GitHub raw content.

Stickman230/claude-pentest

Agent

Part of pentest

Executes specific vulnerability tests. Follows 4-phase workflow (Recon → Experiment → Test → Verify), generates PoCs, captures evidence. Specialized by attack type.

Stickman230/claude-pentest

Agent

Part of pentest

Penetration-test PLANNER. Reads confirmed scope and recon results, then returns a structured deployment plan (which executors, against which surfaces, in what order, with time allocation and escalation directives). Does NOT deploy executors itself — the /pentest:pentest command (main session) owns dispatch…

Stickman230/claude-pentest

Agent

Part of pentest

Tests for client-side JavaScript prototype pollution via URL query parameters, hash fragments, and JSON payloads. Verifies pollution by evaluating Object.prototype in browser DOM via Playwright. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.

Stickman230/claude-pentest

Agent

Part of pentest

Tests for reflected, stored, and DOM-based XSS vulnerabilities across HTML, attribute, JavaScript, URL, and CSS contexts. Covers framework-specific sinks (React dangerouslySetInnerHTML, Vue v-html, Angular bypass), WAF evasion, and CSP bypass techniques. Uses Playwright for browser-based evidence capture. Follows…