---

name: Pentest description: Network reconnaissance and vulnerability scanning. USE WHEN user wants to scan a target, find vulnerabilities, or perform security assessment. args: [--quick|--web]

Pentest Skill

Comprehensive network reconnaissance and vulnerability scanning workflow.

Invocation

• /pentest <target> - Full 6-phase pipeline
• /pentest <target> --quick - Discovery + enumeration only (phases 1-2)
• /pentest <target> --web - Web-focused scan (phases 3-5, skip masscan)

Pre-Flight Checks

Before starting, verify:

Copy# Confirm target is authorized
echo "Target: <target>"
echo "IMPORTANT: Ensure you have written authorization to test this target."

# Set up results directory
PAI_DIR="${PAI_DIR:-/root/.claude}"
TARGET="<target>"
DATE=$(date +%Y-%m-%d)
RESULTS="$PAI_DIR/pentest-results/$TARGET/$DATE"
mkdir -p "$RESULTS"
echo "Results will be saved to: $RESULTS"

Use AskUserQuestion to confirm:

• User has authorization to test the target
• Scan type (full/quick/web) if not specified

Workflow

Create a TodoWrite list with all phases, then execute sequentially:

---

Phase 1: Discovery (masscan)

Purpose: Fast full-port scan to identify open ports before deep enumeration.

Skip if: --web flag specified

CopyPAI_DIR="${PAI_DIR:-/root/.claude}"
TARGET="<target>"
DATE=$(date +%Y-%m-%d)
RESULTS="$PAI_DIR/pentest-results/$TARGET/$DATE"

# Fast port discovery (all 65535 ports)
sudo masscan -p1-65535 $TARGET --rate=1000 -oL "$RESULTS/1-discovery.txt"

# Extract open ports for next phase
PORTS=$(grep "^open" "$RESULTS/1-discovery.txt" | cut -d' ' -f3 | sort -u | tr '\n' ',' | sed 's/,$//')
echo "Discovered ports: $PORTS"

Output: 1-discovery.txt - List of open ports

---

Phase 2: Enumeration (nmap)

Purpose: Detailed service detection, version fingerprinting, OS detection.

CopyPAI_DIR="${PAI_DIR:-/root/.claude}"
TARGET="<target>"
DATE=$(date +%Y-%m-%d)
RESULTS="$PAI_DIR/pentest-results/$TARGET/$DATE"

# If we have discovered ports from Phase 1, use them
if [ -f "$RESULTS/1-discovery.txt" ]; then
    PORTS=$(grep "^open" "$RESULTS/1-discovery.txt" | cut -d' ' -f3 | sort -u | tr '\n' ',' | sed 's/,$//')
else
    # Default to common ports if no discovery phase
    PORTS="21,22,23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080"
fi

# Detailed enumeration
sudo nmap -sC -sV -O -p$PORTS $TARGET -oA "$RESULTS/2-enumeration"

# Also output as text for easy reading
sudo nmap -sC -sV -O -p$PORTS $TARGET -oN "$RESULTS/2-enumeration.txt"

Output: 2-enumeration.xml, 2-enumeration.txt, 2-enumeration.gnmap

Stop here if: --quick flag specified

---

Phase 3: Web Fingerprinting (whatweb)

Purpose: Identify web technologies, frameworks, CMS versions.

Run on: HTTP (80, 8080, 8000, 8888) and HTTPS (443, 8443) ports found in enumeration.

CopyPAI_DIR="${PAI_DIR:-/root/.claude}"
TARGET="<target>"
DATE=$(date +%Y-%m-%d)
RESULTS="$PAI_DIR/pentest-results/$TARGET/$DATE"

# Identify web ports from nmap results
WEB_PORTS=$(grep -E "http|ssl" "$RESULTS/2-enumeration.txt" | grep -oP '^\d+' | sort -u)

# Run whatweb on each web port
for PORT in $WEB_PORTS; do
    PROTO="http"
    [[ $PORT == 443 ]] || [[ $PORT == 8443 ]] && PROTO="https"
    echo "Scanning $PROTO://$TARGET:$PORT"
    whatweb -v "$PROTO://$TARGET:$PORT" >> "$RESULTS/3-web-fingerprint.txt" 2>&1
done

# If no web ports detected, try common ones
if [ ! -s "$RESULTS/3-web-fingerprint.txt" ]; then
    whatweb -v "http://$TARGET" >> "$RESULTS/3-web-fingerprint.txt" 2>&1
    whatweb -v "https://$TARGET" >> "$RESULTS/3-web-fingerprint.txt" 2>&1
fi

Output: 3-web-fingerprint.txt

---

Phase 4: Directory Enumeration (gobuster)

Purpose: Discover hidden directories, files, and endpoints.

Run on: Each web service found.

CopyPAI_DIR="${PAI_DIR:-/root/.claude}"
TARGET="<target>"
DATE=$(date +%Y-%m-%d)
RESULTS="$PAI_DIR/pentest-results/$TARGET/$DATE"
WORDLIST="/usr/share/wordlists/dirb/common.txt"

# Run gobuster on primary web port (80 or 443)
# Adjust URL based on what's available
if curl -s -o /dev/null -w "%{http_code}" "http://$TARGET" | grep -q "200\|301\|302"; then
    gobuster dir -u "http://$TARGET" -w "$WORDLIST" -o "$RESULTS/4-directories-http.txt" -q
fi

if curl -s -o /dev/null -w "%{http_code}" -k "https://$TARGET" | grep -q "200\|301\|302"; then
    gobuster dir -u "https://$TARGET" -w "$WORDLIST" -o "$RESULTS/4-directories-https.txt" -k -q
fi

# Combine results
cat "$RESULTS"/4-directories-*.txt 2>/dev/null | sort -u > "$RESULTS/4-directories.txt"

Output: 4-directories.txt

---

Phase 5: Vulnerability Scanning (nikto + nuclei)

Purpose: Identify known vulnerabilities, misconfigurations, and CVEs.

CopyPAI_DIR="${PAI_DIR:-/root/.claude}"
TARGET="<target>"
DATE=$(date +%Y-%m-%d)
RESULTS="$PAI_DIR/pentest-results/$TARGET/$DATE"

# Nikto web vulnerability scan
nikto -h "$TARGET" -output "$RESULTS/5-nikto.txt" -Format txt

# Nuclei vulnerability scan (all templates)
nuclei -u "$TARGET" -o "$RESULTS/6-nuclei.txt" -silent

# Also output as JSON for parsing
nuclei -u "$TARGET" -o "$RESULTS/6-nuclei.json" -jsonl -silent

Output: 5-nikto.txt, 6-nuclei.txt, 6-nuclei.json

---

Phase 6: Report Generation

Purpose: Consolidate all findings into actionable report.

Generate REPORT.md with the following structure:

Copy# Penetration Test Report

**Target:** <target>
**Date:** <date>
**Tester:** Sai (PAI Pentest Skill)

---

## Executive Summary

[Brief overview of findings - critical issues, overall security posture]

---

## Open Ports & Services

| Port | State | Service | Version |
|------|-------|---------|---------|
[Parse from 2-enumeration.txt]

---

## Web Technologies

[Parse from 3-web-fingerprint.txt]

---

## Discovered Paths

[Parse from 4-directories.txt - highlight interesting finds]

---

## Vulnerabilities

### Critical
[List critical findings from nikto/nuclei]

### High
[List high severity findings]

### Medium
[List medium severity findings]

### Low/Informational
[List low severity findings]

---

## Recommendations

1. [Prioritized remediation steps]
2. [...]

---

## Raw Output Files

- `1-discovery.txt` - Port discovery results
- `2-enumeration.xml` - Full nmap scan
- `3-web-fingerprint.txt` - Web technology fingerprints
- `4-directories.txt` - Discovered paths
- `5-nikto.txt` - Nikto scan results
- `6-nuclei.json` - Nuclei findings (JSON)

Write the report to $RESULTS/REPORT.md.

---

Completion

After all phases complete:

1. Display summary of critical/high findings
2. Provide path to full report: $PAI_DIR/pentest-results/<target>/<date>/REPORT.md
3. Suggest next steps based on findings

Safety Notes

• Always confirm authorization before scanning
• Use --rate limits to avoid overwhelming targets
• Some scans (masscan, nmap -O) require root/sudo
• Results may contain sensitive information - secure appropriately