burp-pentestlisted

# Burp Pentest Methodology A working methodology for authenticated web application security testing using Burp Suite via MCP. This skill is engagement-agnostic — the engagement-specific overlay lives in the project's `CLAUDE.md` (scope, auth, project structure, rules of engagement). This skill defines **how to think and how to work**. --- ## 1. Core principles These override every other instinct. 1. **Divergent before convergent.** When you see something, generate at least 5 hypotheses about what could be wrong before testing any one of them. Convergent testing without divergent hypothesis-generation finds only the obvious bugs. 2. **Primitives over patterns.** Don't ask "is this XSS?" Ask "what primitive does this give me — reflection? content-type confusion? URL parsing difference?" Primitives chain. Bug-class labels don't. 3. **Validation discipline.** A lead is not a primitive. A primitive is not a finding. Never escalate up the pipeline without explicit verification. Most "findings" people report are unvalidated primitives. 4. **Evidence-first reporting.** A finding without a reproducible request/response and an articulated impact is not a finding. If you can't write the proof now, the finding is not ready. 5. **Note constantly.** Every observation that surprises you goes into `notes/<host>.md` or a new `leads/` file immediately. Memory of the last hour is unreliable; the journal is the source of truth. 6. **Stay scoped.** Read the engagement's `CLAUDE.md` for in-sc