pentest

Pentest

Black-box security audit of a running web application, from the outside, via HTTP.

Default language: match the user's request language (Russian or English). Pass --lang ru|en to override. Reports live in {cwd}/pentest-output/{target-slug}-{YYYY-MM-DD}/.

Assumption: the user has authorization from the target's owner. Do not ask for legalese — trust the user. But never run this skill against a target the user hasn't explicitly named.

---

Workflow

Phase 0 — Scope

Before touching the target, confirm:

• Target URL — full https://… URL of the deployed app (the mini app entry URL, not t.me/...).
• Aggression level — default L1. Let the user override:
  • L0 passive: public metadata only, zero probes of the app itself
  • L1 safe (default): single-request probes, read-only, no mutations
  • L2 authorized: mutations on the auditor's own test account (profile updates, intros, etc.)
  • L3 destructive: real injection payloads, cross-tenant access attempts, rate-limit probing without load testing
• Target type hint — telegram-miniapp | nextjs-vercel | supabase | generic. Auto-detect from headers if not provided.
• Language — ru or en (default: match user's language).
• Credentials needed? — if the target needs auth to explore (most apps do), ask the user to paste the auth artifact once:
  • Telegram mini apps: the launch URL fragment (https://…/#tgWebAppData=…) captured from DevTools when the app opens
  • Cookie-based apps: a session cookie or token from the user's logged-in session
  • Store it in secrets.txt under the workspace, add .gitignore to exclude it
  • Never include the raw auth artifact in any report file.

Phase 1 — Workspace

slug=$(echo "<target host>" | tr -cd 'a-z0-9-')
day=$(date +%Y-%m-%d)
workdir="${PWD}/pentest-output/${slug}-${day}"
mkdir -p "${workdir}"/{recon,bundle,scripts,findings,fixes}
echo 'secrets.txt
*.local.*
cookies.txt' > "${workdir}/.gitignore"