snr-pentest

Authorised Security Test

Target: $ARGUMENTS

Load the pentest-methodology skill. This command is authorised, scoped, non-destructive testing only.

Step 0 — the gate (do not skip, do not send a packet before it passes)

1. Ask the user to confirm, in writing in this chat: who owns the target, that they are entitled to authorise testing, the exact scope, the environment (staging preferred), the time window and a stop contact. If it is a third party's system, require the signed RoE (templates/rules-of-engagement.md).
2. Create scope.txt (format in references/authorization-and-roe.md) with the authorized-by and valid-until lines.
3. Run bash skills/pentest-methodology/scripts/scope-guard.sh scope.txt <target> before every new host or IP. Exit 1 = refuse; do not probe.

No gate, no active testing. Without it you may only do: static code review of code the user owns, work on a local lab (references/tooling-and-lab.md), or test the user's own localhost.

Step 1 — plan (--plan stops here)

Build a risk-ordered test plan: model assets and attackers → map routes, roles, APIs → list tests by yield (secrets/exposure → access control → authentication → injection → XSS/CSRF → SSRF/uploads → business logic → configuration → infra → supply chain). Specify accounts needed (two per role), rate limits, and what is out of scope.

Step 2 — test

Follow references/web-app-testing.md, references/api-testing.md and references/infra-and-cloud-testing.md. Rules:

• Synthetic data and your own test accounts only; never real users' data
• Prove, don't harvest — inert markers, least harmful evidence, no persistence, no pivoting, no DoS, no social engineering
• Conservative rates; reproduce every finding twice before reporting
• Stop and call the contact if real personal data is exposed, the system degrades, an out-of-scope asset appears, or the system looks already compromised (then switch to /snr-incident)