enum-web

@pentest-core/skills/shared/engagement-resolver.md @pentest-core/skills/shared/scope-validator.md @pentest-core/skills/shared/activity-log.md @pentest-core/skills/shared/safe-auth-validation.md

/enum-web — Web Application Security Assessment

You are conducting comprehensive security assessment of web applications and APIs to evaluate security controls, identify vulnerabilities, and validate compliance with web security standards. Your goal is to analyze application security configurations, authentication mechanisms, and defensive measures using systematic assessment methodologies.

---

Step 1: Resolve Active Engagement

Run the engagement resolver block verbatim before any other logic.

# --- Engagement Resolver ---
ENGAGEMENT_JSON=$(cat ~/.pentest/active-engagement 2>/dev/null)

if [ -z "$ENGAGEMENT_JSON" ]; then
  echo "No active engagement found. Run /pentest-init or /pentest-switch." >&2
  exit 1
fi

if [ ! -f "$ENGAGEMENT_JSON" ]; then
  echo "Active engagement path '$ENGAGEMENT_JSON' does not exist. Run /pentest-switch." >&2
  exit 1
fi

ENGAGEMENT_ID=$(jq -r '.engagement_id' "$ENGAGEMENT_JSON")
OUTPUT_DIR=$(jq -r '.output_dir' "$ENGAGEMENT_JSON")
ASSESSOR=$(whoami)

ASSESSOR_MATCH=$(jq -r --arg h "$ASSESSOR" '.security assessors[] | select(.handle == $h) | .handle' "$ENGAGEMENT_JSON")
if [ -z "$ASSESSOR_MATCH" ]; then
  echo "Operator '$ASSESSOR' is not registered on this engagement." >&2
  exit 1
fi
# --- End Engagement Resolver ---

After this block, $ENGAGEMENT_ID, $OUTPUT_DIR, and $ASSESSOR are guaranteed set and valid. If the resolver fails for any reason, stop and tell the user to run /pentest-init.

---

Step 2: Parse Arguments and Determine Targets

Accepted input

• URL — e.g., https://app.acme.com or http://10.0.0.1:8080
• No argument — fall back to most recent active recon output

ARG="${1:-}"

if [ -n "$ARG" ]; then
  WEB_TARGETS=("$ARG")
elif ls "${OUTPUT_DIR}/recon/active-"*.json > /dev/null 2>&1; then
  RECON_FILE=$(ls -t "${OUTPUT_DIR}/recon/active-"*.json | head -1)
  echo "No URL specified — reading web services from $RECON_FILE"
  # Extract hosts with web ports from the most recent active recon output
  WEB_TARGETS_JSON=$(jq '[.hosts[] | {ip, hostnames, ports: [.ports[] | select(.category == "web")]} | select(.ports | length > 0)]' "$RECON_FILE" 2>/dev/null)
  if [ -z "$WEB_TARGETS_JSON" ] || [ "$WEB_TARGETS_JSON" = "[]" ]; then
    echo "No web services found in $RECON_FILE. Provide a URL: /enum-web <url>" >&2
    exit 1
  fi
  # Build URL list from recon data
  mapfile -t WEB_TARGETS < <(echo "$WEB_TARGETS_JSON" | jq -r '.[] | .ip as $ip | .ports[] | (if .tls then "https" else "http" end) + "://" + $ip + ":" + (.port | tostring)')
else
  echo "No URL provided and no active recon data found." >&2
  echo "Provide a URL: /enum-web <url>" >&2
  exit 1
fi