pentest-engagement

Name: pentest-engagement
Author: transilienceai

423stars74forks

How to install pentest-engagement?

transilienceai/communitytools/pentest-engagement

$npx -y skills add transilienceai/communitytools --skill pentest-engagement

Installs into the current project.

Summary

Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mo

Files · 1

View on GitHub

SKILL.md

1	# Pentest Engagement
2
3	Orchestrates a scoped pentest end-to-end via the `pentest-engagement` workflow. It is the breadth-complete, coverage-gated counterpart to the flag-shaped `htb-solve` — same engine (`coordinator-loop`, now with interleaved per-finding validation built into the loop), but driven by an attack-class coverage matrix instead of a flag, with surface expansion and root-cause severity baked in.
4
5	## When to use
6	A real (non-CTF) engagement defined by a scope — either:
7	- WEB — web / API / cloud apps defined by apex domains / asset URLs, or
8	- NETWORK — a list of IPs / CIDRs / ranges (e.g. 1500 hosts) to scan for live services and vulnerabilities.
9
10	The workflow auto-detects the mode in Setup (`engagement_kind`): predominantly IPs/CIDRs → network; apex domains / app URLs → web. For HackTheBox/CTF use `hackthebox` (htb-solve) instead.
11
12	## Run it
13	WEB — from a scope file or inline:
14	```
15	Workflow('pentest-engagement', { scope_file: 'projects/pentest/<engagement>-scope.md' })
16	Workflow('pentest-engagement', { scope: { engagement_name, apex_domains:[], assets:[...], creds_env:[...], roe, business_tier } })
17	```
18	NETWORK — inline IP/CIDR list or a scope file containing one (a plain newline list of IPs/CIDRs is accepted):
19	```
20	Workflow('pentest-engagement', { targets: ['10.0.0.0/24', '192.0.2.0/24', '198.51.100.7'] })
21	Workflow('pentest-engagement', { scope_file: 'projects/pentest/<engagement>-ips.txt', scan_profile: 'standard' })
22	```
23	Options (shared): `maxConcurrent` (default = prudent, derived from CPU cores — ~half the cores, capped 2–8; never hundreds/thousands of parallel tasks), `dryRun`, `max_experiments`, `business_tier`, `report` (default true).
24	Options (network): `scan_profile` `light` (bounded `1-1024` + curated less-common, for large/fast sweeps) / `standard` (full-range `-p-` on every reachable host, DEFAULT; two-stage SYN→`-sV` on found-open ports, host-count-guarded, message-bus + non-443-TLS aware) / `full` (`-p-` + bounded UDP); `udp` (top-50 UDP; off for light/standard, auto-on for full); `slice_size` (hosts per scan worker, auto ≈64 IP-list / 2 CIDR-heavy); `deepen_top` (deep-dive the N highest-value hosts, default 10, `0` to skip); `geo_vantages` (≤2 gcp zones for the 2nd-vantage allowlist re-probe; overrides the US+EU default), `auto_provision` (default true; `false` = detect+flag only, no cloud spend). On a source-IP/geo-allowlist signature the workflow auto-provisions a 2nd-geography vantage and re-probes the filtered hosts before concluding "no surface."
25
26	Write the scope file per [`reference/scope-file-format.md`](reference/scope-file-format.md). Credentials are referenced by env-var name only and read from the repo `.env` via `python3 tools/env-reader.py` — never inline secret values.
27
28	## Phases (what the workflow does)
29	1. Setup — `env-reader` creds, parse scope, classify kind (web\|network), read CPU cores → prudent parallel-task cap, `OUTPUT_DIR = projects/pentest/<date>_<engagement>/`, STARTED Slack (gated).
30	2. Expand (WEB, the #1 fix) — MANDATORY CT-log / passive-DNS / origin-discovery across every in-scope apex (`crt.sh`, `certspotter`, `subfinder`, origin-discovery for CDN/WAF-fronted hosts). Scope = the discovered surface, not the handoff. Builds the per-asset work list + seeds each asset's coverage matrix.
31	Scan (NETWORK, replaces Expand) — slice the IP/CIDR set into machine-prudent batches; one nmap worker per slice (agents scale with slices ≈ dozens, never with IP count) runs the SAME pipeline: host discovery (reachability is unknown) → bounded common+less-common port/service scan → CVE surfacing (`nmap --script vulners`, `nuclei`, each CVE-ID enriched via `tools/nvd-lookup.py`) → writes a uniform per-IP tree `hosts/<ip>/{recon,host.json,findings}` + a merged `recon/inventory/`.
32	3. Assess (single interleaved stage — no separate downstream validation pass) — WEB: each asset → `coordinator-loop` (coverage mode), which validates each candidate the instant it is materialized on fresh blind agents (strict per-finding cure/drop loop) before search continues. NETWORK: bounded `coordinator-loop` deep-dives on only the `deepen_top` highest-value hosts, same interleaved per-finding validation (everything else is the uniform tool-scan, not a

People who liked this also viewed

6 picks

Type

pentest-engagement

423stars74forks

View on GitHub

How to install pentest-engagement?

transilienceai/communitytools/pentest-engagement

$npx -y skills add transilienceai/communitytools --skill pentest-engagement

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Pentest Engagement
2
3	Orchestrates a scoped pentest end-to-end via the `pentest-engagement` workflow. It is the breadth-complete, coverage-gated counterpart to the flag-shaped `htb-solve` — same engine (`coordinator-loop`, now with interleaved per-finding validation built into the loop), but driven by an attack-class coverage matrix instead of a flag, with surface expansion and root-cause severity baked in.
4
5	## When to use
6	A real (non-CTF) engagement defined by a scope — either:
7	- WEB — web / API / cloud apps defined by apex domains / asset URLs, or
8	- NETWORK — a list of IPs / CIDRs / ranges (e.g. 1500 hosts) to scan for live services and vulnerabilities.
9
10	The workflow auto-detects the mode in Setup (`engagement_kind`): predominantly IPs/CIDRs → network; apex domains / app URLs → web. For HackTheBox/CTF use `hackthebox` (htb-solve) instead.
11
12	## Run it
13	WEB — from a scope file or inline:
14	```
15	Workflow('pentest-engagement', { scope_file: 'projects/pentest/<engagement>-scope.md' })
16	Workflow('pentest-engagement', { scope: { engagement_name, apex_domains:[], assets:[...], creds_env:[...], roe, business_tier } })
17	```
18	NETWORK — inline IP/CIDR list or a scope file containing one (a plain newline list of IPs/CIDRs is accepted):
19	```
20	Workflow('pentest-engagement', { targets: ['10.0.0.0/24', '192.0.2.0/24', '198.51.100.7'] })
21	Workflow('pentest-engagement', { scope_file: 'projects/pentest/<engagement>-ips.txt', scan_profile: 'standard' })
22	```
23	Options (shared): `maxConcurrent` (default = prudent, derived from CPU cores — ~half the cores, capped 2–8; never hundreds/thousands of parallel tasks), `dryRun`, `max_experiments`, `business_tier`, `report` (default true).
24	Options (network): `scan_profile` `light` (bounded `1-1024` + curated less-common, for large/fast sweeps) / `standard` (full-range `-p-` on every reachable host, DEFAULT; two-stage SYN→`-sV` on found-open ports, host-count-guarded, message-bus + non-443-TLS aware) / `full` (`-p-` + bounded UDP); `udp` (top-50 UDP; off for light/standard, auto-on for full); `slice_size` (hosts per scan worker, auto ≈64 IP-list / 2 CIDR-heavy); `deepen_top` (deep-dive the N highest-value hosts, default 10, `0` to skip); `geo_vantages` (≤2 gcp zones for the 2nd-vantage allowlist re-probe; overrides the US+EU default), `auto_provision` (default true; `false` = detect+flag only, no cloud spend). On a source-IP/geo-allowlist signature the workflow auto-provisions a 2nd-geography vantage and re-probes the filtered hosts before concluding "no surface."
25
26	Write the scope file per [`reference/scope-file-format.md`](reference/scope-file-format.md). Credentials are referenced by env-var name only and read from the repo `.env` via `python3 tools/env-reader.py` — never inline secret values.
27
28	## Phases (what the workflow does)
29	1. Setup — `env-reader` creds, parse scope, classify kind (web\|network), read CPU cores → prudent parallel-task cap, `OUTPUT_DIR = projects/pentest/<date>_<engagement>/`, STARTED Slack (gated).
30	2. Expand (WEB, the #1 fix) — MANDATORY CT-log / passive-DNS / origin-discovery across every in-scope apex (`crt.sh`, `certspotter`, `subfinder`, origin-discovery for CDN/WAF-fronted hosts). Scope = the discovered surface, not the handoff. Builds the per-asset work list + seeds each asset's coverage matrix.
31	Scan (NETWORK, replaces Expand) — slice the IP/CIDR set into machine-prudent batches; one nmap worker per slice (agents scale with slices ≈ dozens, never with IP count) runs the SAME pipeline: host discovery (reachability is unknown) → bounded common+less-common port/service scan → CVE surfacing (`nmap --script vulners`, `nuclei`, each CVE-ID enriched via `tools/nvd-lookup.py`) → writes a uniform per-IP tree `hosts/<ip>/{recon,host.json,findings}` + a merged `recon/inventory/`.
32	3. Assess (single interleaved stage — no separate downstream validation pass) — WEB: each asset → `coordinator-loop` (coverage mode), which validates each candidate the instant it is materialized on fresh blind agents (strict per-finding cure/drop loop) before search continues. NETWORK: bounded `coordinator-loop` deep-dives on only the `deepen_top` highest-value hosts, same interleaved per-finding validation (everything else is the uniform tool-scan, not a

People who liked this also viewed

6 picks

Type