Agent-Skills.md

Agent Skills: Penetration Testing Methodology (PTES-Aligned)

PTES-aligned penetration testing methodology for backend, frontend, and mobile. Provides attack taxonomy, exploit techniques per vulnerability class, and platform-specific test matrices. Use when executing pentest workflow, planning security assessments, mapping attack surfaces, or building threat models.

UncategorizedID: hoangnguyen0403/agent-skills-standard/common-pentest-methodology

Repository

hoangnguyen0403/agent-skills-standard
HoangNguyen0403License: MIT
567164

Install this agent skill to your local

pnpm dlx add-skill https://github.com/HoangNguyen0403/agent-skills-standard/tree/HEAD/.codex/skills/common/common-pentest-methodology

Skill Files

Browse the full folder contents for common-pentest-methodology.

Download Skill

Loading file tree…

.codex/skills/common/common-pentest-methodology/SKILL.md

Skill Metadata

Name
common-pentest-methodology
Description
PTES-aligned penetration testing methodology for backend, frontend, and mobile. Provides attack taxonomy, exploit techniques per vulnerability class, and platform-specific test matrices. Use when executing pentest workflow, planning security assessments, mapping attack surfaces, or building threat models.

Penetration Testing Methodology (PTES-Aligned)

Priority: P0 (CRITICAL)

Always-Apply Rules

  • No Exploit = No Report: Every finding requires reproducible Proof-of-Concept. Hypotheses without PoC are discarded.
  • No Production Testing: All dynamic probes target local/staging only. Confirm authorization before Phase 1.
  • No Single-Platform Bias: Assess backend, frontend, AND mobile surfaces when in-scope.

Workflow

Load alongside /pentest workflow. Provides methodology backbone for all 7 phases.

  1. Scope → Define test mode (whitebox/greybox/blackbox), platforms, exclusions.
  2. Recon → Build asset inventory per platform. See platform-recon.
  3. Threat Model → Rank endpoints by risk. See threat-modeling.
  4. Analyze → Run vulnerability matrix across all domains. Load common-owasp, common-security-audit, common-dast-tooling.
  5. Exploit → Validate each finding with PoC. See exploit-techniques.
  6. Post-Exploit → Assess blast radius, lateral movement, privilege escalation.
  7. Report → Audit-grade output with CVSS scoring. See report-template and compliance-mapping.

Platform Coverage Matrix

| Domain | Backend/API | Frontend/Web | Mobile (iOS/Android) | |---|---|---|---| | Injection | SQLi, CMDi, NoSQLi, LDAPi | Template injection, DOM sinks | Content provider SQLi, Intent injection | | XSS | Response encoding | DOM XSS, innerHTML, framework bypasses | WebView loadUrl, JavaScript bridges | | Auth | JWT, OAuth, Session, MFA | Token storage, session management | Keychain/Keystore, biometric bypass | | AuthZ | BOLA/IDOR, BFLA, Mass Assignment | Client-side role gates | Local permission checks without server | | SSRF | HTTP client + user URL | SSR with user-supplied URL | Custom scheme fetching arbitrary URLs | | Business Logic | Race conditions, workflow bypass | Client-only validation, price tamper | IAP bypass, receipt validation skip | | Crypto | Weak hash, missing TLS | HTTP calls, weak CSP | Missing cert pin, cleartext traffic | | Config | CORS, debug mode, headers | Source maps, debug flags in prod | debuggable=true, ATS exceptions | | Deps/SCA | npm audit, pip-audit, cargo audit | Bundle vuln analysis | pod audit, Gradle dependency scan | | Secrets | Entropy + regex + liveness | Secrets in JS bundles | Keys in BuildConfig/Info.plist | | LLM/AI | Prompt injection, excessive agency | Output to DOM sinks | Agent tools without confirmation |

Continuous & Compliance Execution

  • Continuous Testing: Execute Delta scans on PRs or Replay regression PoCs. See continuous-pentest.
  • Compliance Mapping: Map findings to SOC 2, ISO 27001, PCI DSS, or OWASP MASVS. See compliance-mapping.

Anti-Patterns

  • No "scan and dump": Raw tool output not a pentest. Correlate findings across SAST + DAST + manual.
  • No severity inflation: Theoretical risk without exploit evidence ≠ confirmed vulnerability.
  • No happy-path-only: Test error states, edge cases, race conditions, not just golden flow.

References