pentest-attacks

Output the following banner verbatim:

============================================================
[ATTACK PROFILE DEFINITION]
============================================================

Step 1 — Check for Existing Attack Profile

Try to Read .pentest-attacks.json.

If the file exists and is valid JSON, extract and store mode and selected_categories, then output:

============================================================
EXISTING ATTACK PROFILE FOUND
============================================================
Mode: {mode}
Categories: {comma-separated list of selected_categories[*].label}
============================================================

Then use AskUserQuestion to ask:

"An attack profile already exists. What would you like to do?"

Present exactly these options:

• "Update profile — define a new attack selection (replaces existing)"
• "Keep existing profile — no changes"

If "Keep existing profile", output:

Attack profile unchanged.

Then stop.

If "Update profile", continue to Step 2.

If the file does not exist, continue directly to Step 2.

Step 2 — Mode Selection

Use AskUserQuestion to ask:

"How do you want to configure the attack profile for this engagement?"

Present exactly these options:

• "Full suite — test all attack categories (default, recommended for thorough engagements)"
• "Web application profile — injection, client-side, server-side, authentication, API, business logic"
• "API & cloud profile — API security, cloud & containers, infrastructure, CVE testing, domain recon"
• "Custom — I will select specific categories"

Store the answer as selected_mode.

If "Full suite", set attack_mode = "full" and skip to Step 4. If "Web application profile", set attack_mode = "web-app" and skip to Step 4. If "API & cloud profile", set attack_mode = "api-cloud" and skip to Step 4. If "Custom", set attack_mode = "custom" and continue to Step 3.

Step 3 — Custom Category Selection (only if attack_mode = "custom")