claude-pentest-skillslisted

# Claude Pentest Skills Structured methodology, curated payload references, and strict validation processes for **authorized** web application penetration testing. ## When to use Use this skill when performing authorized web application penetration testing. It provides: - A structured engagement workflow: scope definition, reconnaissance, vulnerability hunting, finding validation, and report generation - OWASP Web Security Testing Guide (WSTG) methodology with coverage tracking - 18 vulnerability class references with PayloadAllTheThings links - A 6-gate validation process that eliminates false positives - Professional pentest report generation (markdown + PDF) **Only use against systems you own or have explicit written authorization to test.** ## Instructions ### Standard Workflow ``` /scope <target> → Define authorization (REQUIRED first step) /recon <target> → Map attack surface (endpoints, tech stack, inputs) /hunt <vuln-class> → Test for a specific vulnerability class /validate → Run 6-gate quality check on findings /report --full → Generate professional pentest report /status → View engagement progress dashboard ``` ### Safety Rules (Non-Negotiable) 1. **Never** test without running `/scope` first 2. **Never** send requests to out-of-scope domains or paths 3. **Always** log every payload attempt before analyzing the response 4. **Stop and ask** the user if uncertain whether an action is in scope 5. **Warn and get confirmation