playbook-infra
Infrastructure pentest playbook — PTES-based phase flow for internal networks, servers, and non-web services. Load at the START of an internal/infra engagement or multi-host network assessment. Triggers - internal network, subnet/CIDR scan, infra pentest, multi-host, pivoting, lateral movement across services.
git clone --depth 1 https://github.com/s0ld13rr/pentestcode /tmp/playbook-infra && cp -r /tmp/playbook-infra/skills/playbooks/infra ~/.claude/skills/playbook-infraSKILL.md
# Infrastructure Pentest Playbook Based on PTES (Penetration Testing Execution Standard). ## Scope Verification Before starting: - Confirm target IPs/CIDRs are authorized - Identify excluded hosts/services - Note time windows and rules of engagement - Verify emergency contacts ## Phase Flow ### 1. Passive Reconnaissance - WHOIS, DNS records, ASN mapping - Subdomain enumeration (passive sources only) - Certificate transparency logs - Shodan/Censys for exposed services - **Goal**: Map attack surface without touching targets ### 2. Active Enumeration - Host discovery: `nmap -sn <cidr>` - Port scan: `nmap -sS -p- --min-rate 5000 <targets>` - Service detection: `nmap -sV -sC -p <ports> <targets>` - OS detection: `nmap -O <targets>` - UDP top ports: `nmap -sU --top-ports 50 <targets>` - Protocol-specific enumeration (SMB, LDAP, SNMP, NFS, RPC) - **Goal**: Complete inventory of hosts, ports, services, versions ### 3. Vulnerability Assessment - Automated: `nuclei -severity critical,high` + `nmap --script vuln` - CVE search for every versioned service: `searchsploit <service> <version>` - Default credential checks on all login services - SSL/TLS configuration: `sslscan`, `testssl.sh` - Misconfiguration checks (open databases, exposed APIs, anonymous access) - **Goal**: Prioritized vulnerability list with evidence ### 4. Exploitation Priority order: 1. Known CVEs with public exploits (critical/high) 2. Default/weak credentials 3. Misconfigurations allowing access 4. Brute force attacks 5. Manual exploitation of custom services - **Goal**: Gain initial access, document every attempt ### 5. Post-Exploitation - Privilege escalation on every accessed host - Credential harvesting (files, memory, databases) - Lateral movement with found credentials - Network pivoting to unreachable segments - Data discovery (sensitive files, databases, secrets) - **Goal**: Demonstrate maximum impact, document attack path ### 6. Reporting - Executive summary with risk rating - Technical findings by severity (CVSS scoring) - Attack path narrative with evidence - Remediation recommendations prioritized by risk - Host summary table ## Tool Arsenal **Scanning**: nmap, masscan, nuclei, nikto **Enumeration**: enum4linux-ng, ldapsearch, snmpwalk, gobuster **Exploitation**: metasploit, searchsploit, hydra, crackmapexec **Post-exploit**: linpeas/winpeas, mimikatz, impacket suite **Reporting**: custom report generator
Work with Effect v4 / effect-smol TypeScript code in this repo
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.
Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULN_ASSESS.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.