vuln-assessment-phase
Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULN_ASSESS.
git clone --depth 1 https://github.com/s0ld13rr/pentestcode /tmp/vuln-assessment-phase && cp -r /tmp/vuln-assessment-phase/skills/phases/vuln-assessment ~/.claude/skills/vuln-assessment-phaseSKILL.md
# Vulnerability Assessment Checklist
## Automated Vulnerability Scanning
```bash
# Nuclei — critical and high first
nuclei -u <target> -severity critical,high -o nuclei_crithigh.txt
nuclei -u <target> -t cves/ -o nuclei_cves.txt
nuclei -u <target> -t misconfiguration/ -o nuclei_misconfig.txt
nuclei -u <target> -t exposures/ -o nuclei_exposures.txt
# From list of URLs
nuclei -l urls.txt -severity critical,high -o nuclei_bulk.txt
# Nmap vuln scripts
nmap --script vuln -p <ports> <target> -oA vuln_scan
```
## CVE Lookup
For each identified service version:
```bash
searchsploit <service> <version>
searchsploit --nmap services.xml # parse nmap output
```
## Default Credentials Check
Test common defaults for discovered services:
- Web admin panels: admin/admin, admin/password, root/root
- Databases: root/(empty), sa/(empty), postgres/postgres
- SSH: root/toor, admin/admin
- Network devices: admin/admin, cisco/cisco
```bash
# Hydra single credential test
hydra -l admin -p admin <target> <protocol>
```
## Web Vulnerability Assessment
```bash
# SQL injection discovery
sqlmap -u "http://<target>/page?id=1" --batch --level 3 --risk 2
# XSS scanning
dalfox url "http://<target>/page?q=test"
# SSL/TLS issues
sslscan <target>
testssl.sh <target>
# Security headers
curl -sI http://<target> | grep -iE "x-frame|x-content|strict-transport|content-security|x-xss"
```
## Misconfiguration Checks
- Anonymous FTP access: `ftp <target>` with anonymous/anonymous
- Open Redis: `redis-cli -h <target> INFO`
- MongoDB no auth: `mongosh --host <target> --eval "db.adminCommand('listDatabases')"`
- Elasticsearch open: `curl http://<target>:9200/_cat/indices`
- Docker API exposed: `curl http://<target>:2375/version`
- Kubernetes API: `curl -k https://<target>:6443/api`
## Severity Classification
- **Critical**: RCE, auth bypass, default creds on critical service, SQLi with data access
- **High**: File read/write, privilege escalation vector, SSRF to internal
- **Medium**: XSS (stored), information disclosure (sensitive), misconfig with limited impact
- **Low**: XSS (reflected), verbose errors, minor info disclosure
- **Info**: Open ports, version disclosure, missing headers
## Phase Completion Criteria
Move to EXPLOITATION when:
- Automated scans completed
- CVEs checked for all versioned services
- Default credentials tested
- Web vulns assessed
- All findings recorded with severity and evidenceWork with Effect v4 / effect-smol TypeScript code in this repo
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.
Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.