@soulofzephir/pi-skill-pentesting 1.0.0 → 1.0.2

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@soulofzephir/pi-skill-pentesting",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Comprehensive pentesting & security check skill for Pi coding agent - headers, ports, SQLi, XSS, OWASP Top 10",
   "keywords": [
     "pi",
-    "pi-package", 
+    "pi-package",
     "pi-skill",
     "pentesting",
     "security",

package/skills/pentesting/SKILL.md

@@ -1,28 +1,30 @@
 ---
 name: pentesting
-description: Comprehensive website security testing skill for penetration testing, vulnerability assessment, security headers analysis, port scanning, SQL injection, XSS testing, OWASP Top 10, and SSL/TLS audit. Use when user asks for pentest, security check, security audit, vulnerability scan, header security, port scan, SQL injection, XSS, OWASP, ethical hacking, or bug bounty testing. Generates reports to site/domainname-date.md format.
+description: Comprehensive website security testing skill for penetration testing, vulnerability assessment, security headers analysis, port scanning, SQL injection, XSS testing, OWASP Top 10, SSL/TLS audit, exposed files detection, CORS, JWT, and GraphQL security testing. Use when user asks for pentest, security check, security audit, vulnerability scan, header security, port scan, SQL injection, XSS, OWASP, ethical hacking, exposed files, CORS, JWT, GraphQL, or bug bounty testing. Generates reports to site/domainname-date.md format.
 ---
 
 # 🛡️ Pentesting & Security Check Skill
 
-> **AUTHOR:** Rz | **VERSION:** 2.0 | **LAST UPDATED:** 2025-07-05
+> **AUTHOR:** Rz (@soulofzephir) | **VERSION:** 3.0 | **LAST UPDATED:** 2025-07-05
 
 ---
 
-## 📋 CAPABILITIES OVERVIEW
+## 📋 CAPABILITIES OVERVIEW (v3.0)
 
-This skill provides **COMPREHENSIVE PENTESTING** capabilities:
-
-| Category | Coverage | Automated |
-|----------|----------|-----------|
+| Category | Coverage | Status |
+|----------|----------|--------|
 | **Security Headers** | 9 critical headers | ✅ Script |
-| **Port Scanning** | 20+ common ports | ✅ Nmap/Script |
+| **Port Scanning** | 20+ common ports | ✅ Script |
 | **SQL Injection** | Union, Blind, Time-based | ✅ SQLMap + Manual |
 | **XSS Testing** | Reflected, Stored, DOM | ✅ Payloads + Tools |
 | **Command Injection** | Linux & Windows | ✅ Commix + Manual |
 | **XXE Testing** | Basic, Blind, DoS | ✅ Manual |
 | **OWASP Top 10** | A01-A10 complete | ✅ Checklist |
 | **SSL/TLS Audit** | Certificate & Ciphers | ✅ testssl.sh |
+| **Exposed Files** | .env, .git, backups, debug | ✅ **NEW** |
+| **CORS Security** | Misconfiguration tests | ✅ **NEW** |
+| **JWT Security** | Algorithm attacks, brute force | ✅ **NEW** |
+| **GraphQL Security** | Introspection, DoS, injection | ✅ **NEW** |
 | **Report Generation** | .md format | ✅ Auto |
 
 ---
@@ -38,24 +40,25 @@ This skill auto-loads when user mentions:
 - port scan, open ports, network scan
 - SQL injection, SQLi, XSS, command injection
 - OWASP, OWASP Top 10
+- exposed files, .env, .git exposed
+- CORS, JWT, GraphQL security
 - "test keamanan", "cek security", "audit keamanan"
+- **"test skill", "check skill", "validate skill"**
+- **"skill health", "skill status", "skill diagnostics"**
 
 ---
 
-## ⚡ COMPLETE TEST CHECKLIST
-
-For a **comprehensive security assessment**, run these tests in order:
+## ⚡ COMPLETE TEST CHECKLIST (10+ Phases)
 
-### Phase 1: Reconnaissance (Information Gathering)
+### Phase 1: Reconnaissance
 ```
-[ ] Domain enumeration (subdomains, WHOIS)
-[ ] Technology fingerprinting (CMS, framework, libraries)
-[ ] Directory enumeration (/admin, /api, /backup)
+[ ] Domain enumeration
+[ ] Technology fingerprinting
+[ ] Directory enumeration
 [ ] Parameter discovery
-[ ] Social media / leak analysis
 ```
 
-### Phase 2: Security Headers Analysis
+### Phase 2: Security Headers (9 Headers)
 ```
 [ ] Content-Security-Policy (CSP)
 [ ] Strict-Transport-Security (HSTS)
@@ -64,224 +67,160 @@ For a **comprehensive security assessment**, run these tests in order:
 [ ] Referrer-Policy
 [ ] Permissions-Policy
 [ ] Cache-Control
-[ ] Server header (version hiding)
-[ ] X-Powered-By (tech hiding)
-[ ] Cross-Origin policies (COOP, CORP, COEP)
+[ ] Server header (hide version)
+[ ] X-Powered-By (hide tech)
+```
+
+### Phase 3: Exposed Files & Information Disclosure 🔴 **NEW**
+```
+[ ] .env file accessible?
+[ ] .git directory exposed?
+[ ] Backup files (zip, sql, bak)
+[ ] Debug/Admin panels accessible
+[ ] Sensitive configuration files
+[ ] Spring Boot Actuator endpoints
+[ ] API documentation exposed
+[ ] Log files accessible
+[ ] robots.txt (reveals paths)
+[ ] Security.txt endpoint
 ```
 
-### Phase 3: Port & Network Scanning
+### Phase 4: Port & Network Scanning
 ```
 [ ] Full port scan (1-65535)
 [ ] Service version detection
-[ ] High-risk port exposure check:
-    [ ] Port 22 (SSH) - brute force, key-only?
-    [ ] Port 3306 (MySQL) - remote access?
-    [ ] Port 5432 (PostgreSQL) - remote access?
-    [ ] Port 27017 (MongoDB) - no-auth?
-    [ ] Port 6379 (Redis) - no-auth?
-    [ ] Port 11211 (Memcached) - DDoS risk?
-    [ ] Port 2375 (Docker) - NEVER expose!
-    [ ] Port 9200 (Elasticsearch) - data exposure?
-```
-
-### Phase 4: SSL/TLS Audit
-```
-[ ] Certificate validity (not expired, trusted CA)
-[ ] TLS version (no SSLv3, TLS 1.0, TLS 1.1)
-[ ] Weak ciphers disabled?
+[ ] High-risk port exposure:
+    [ ] Port 3306 (MySQL)
+    [ ] Port 5432 (PostgreSQL)
+    [ ] Port 27017 (MongoDB)
+    [ ] Port 6379 (Redis)
+    [ ] Port 2375 (Docker)
+    [ ] Port 9200 (Elasticsearch)
+```
+
+### Phase 5: SSL/TLS Audit
+```
+[ ] Certificate validity
+[ ] TLS version (no 1.0/1.1)
+[ ] Weak ciphers
 [ ] HSTS implementation
-[ ] Certificate chain complete?
-[ ] Self-signed cert check
-[ ] OCSP stapling enabled?
+[ ] OCSP stapling
 ```
 
-### Phase 5: Authentication Testing
+### Phase 6: Authentication Testing
 ```
-[ ] Login page brute force protection
-[ ] Password policy enforcement
+[ ] Brute force protection
+[ ] Password policy
 [ ] MFA availability
-[ ] Session management:
-    [ ] Session ID randomness
-    [ ] Session timeout
-    [ ] HttpOnly cookies
-    [ ] Secure cookies
-    [ ] SameSite attribute
-[ ] Password reset flow:
-    [ ] Token randomness
-    [ ] Token expiration
-    [ ] Email enumeration
-[ ] Account lockout policy
-[ ] CAPTCHA implementation
-```
-
-### Phase 6: Injection Testing
-```
-[ ] SQL Injection:
-    [ ] UNION-based
-    [ ] Boolean-based blind
-    [ ] Time-based blind
-    [ ] Error-based
-    [ ] Stacked queries
-[ ] XSS (Cross-Site Scripting):
-    [ ] Reflected XSS
-    [ ] Stored/Persistent XSS
-    [ ] DOM-based XSS
-    [ ] Polyglot XSS
-[ ] Command Injection:
-    [ ] Linux commands
-    [ ] Windows commands
-[ ] XXE (XML External Entity)
-[ ] LDAP Injection
-[ ] XPath Injection
-[ ] SSTI (Server-Side Template Injection)
-[ ] SSTRF (Server-Side Request Forgery)
-[ ] Expression Language Injection
-```
-
-### Phase 7: Business Logic Testing
-```
-[ ] IDOR (Insecure Direct Object Reference)
-[ ] Horizontal privilege escalation
-[ ] Vertical privilege escalation
-[ ] Price/total manipulation
-[ ] Quantity manipulation
-[ ] Coupon/promotion abuse
-[ ] Race condition (concurrency)
-[ ] Workflow bypass
-[ ] Mass assignment
-```
-
-### Phase 8: API Security
-```
-[ ] REST API testing:
-    [ ] Authorization bypass
-    [ ] Rate limiting
-    [ ] Input validation
-    [ ] CORS misconfiguration
-[ ] GraphQL testing:
-    [ ] Introspection enabled?
-    [ ] Query complexity
-    [ ] Depth limiting
-[ ] JWT testing:
-    [ ] Algorithm confusion
-    [ ] Weak secret
-    [ ] Token expiration
-    [ ] None algorithm
-[ ] API versioning issues
-```
-
-### Phase 9: OWASP Top 10
-```
-[ ] A01 - Broken Access Control
-    [ ] Vertical privilege escalation
-    [ ] Horizontal privilege escalation
-    [ ] IDOR
-    [ ] CORS misconfiguration
-[ ] A02 - Cryptographic Failures
-    [ ] Sensitive data exposure
-    [ ] Weak encryption
-    [ ] Default crypto
-    [ ] Insecure key management
-[ ] A03 - Injection
-    [ ] SQL Injection
-    [ ] XSS
-    [ ] Command Injection
-    [ ] LDAP/XXE/XPath
-[ ] A04 - Insecure Design
-    [ ] Missing rate limiting
-    [ ] Business logic flaws
-    [ ] Credential stuffing protection
-[ ] A05 - Security Misconfiguration
-    [ ] Default credentials
-    [ ] Debug mode
-    [ ] Directory listing
-    [ ] Unnecessary features
-    [ ] Error handling
-[ ] A06 - Vulnerable Components
-    [ ] Outdated libraries
-    [ ] Known CVEs
-    [ ] Unmaintained dependencies
-[ ] A07 - Identification & Auth Failures
-    [ ] Weak passwords
-    [ ] Session management
-    [ ] Credential exposure
-[ ] A08 - Software & Data Integrity
-    [ ] Insecure deserialization
-    [ ] CI/CD issues
-    [ ] Auto-update integrity
-[ ] A09 - Logging & Monitoring
-    [ ] No audit logging
-    [ ] Failed login tracking
-    [ ] Alert fatigue
-[ ] A10 - SSRF
-    [ ] URL validation bypass
-    [ ] Internal network access
-    [ ] Cloud metadata access
+[ ] Session management (HttpOnly, Secure, SameSite)
+[ ] Password reset flow
 ```
 
-### Phase 10: Client-Side Testing
+### Phase 7: Injection Testing
 ```
-[ ] CORS misconfiguration
-[ ] WebSocket testing
-[ ] WebRTC leakage
-[ ] Service Worker security
-[ ] Browser storage (localStorage, sessionStorage)
-[ ] Cookies security attributes
-[ ] JWT in localStorage vs HttpOnly cookie
+[ ] SQL Injection (5 types)
+[ ] XSS (4 types)
+[ ] Command Injection
+[ ] XXE
+[ ] LDAP Injection
+[ ] SSTI
+[ ] SSRF
 ```
 
----
-
-## ⚡ WORKFLOW (Follow in Order)
-
-### Step 1: Confirm Scope
+### Phase 8: CORS Security 🔴 **NEW**
 ```
-1. Target URL/IP: [user input]
-2. Testing type: [Full / Targeted]
-3. Authorization: [User owns this / Has permission]
+[ ] Wildcard origin check
+[ ] Credentials with wildcard
+[ ] Null origin allowed?
+[ ] Internal IPs allowed?
+[ ] Sensitive endpoints CORS
 ```
 
-### Step 2: Run Tests (follow Complete Test Checklist above)
-
-### Step 3: Generate Report
-
-**IMPORTANT:** Always save report to:
+### Phase 9: JWT Security 🔴 **NEW**
 ```
-site/[domain]-[YYYY-MM-DD].md
+[ ] Algorithm confusion (RS256→HS256)
+[ ] alg:none bypass
+[ ] Weak secret brute force
+[ ] Null signature accepted
+[ ] Token manipulation (exp, iat, sub)
+[ ] JWKS cache poisoning
 ```
 
-Example:
+### Phase 10: GraphQL Security 🔴 **NEW**
 ```
-site/example.com-2025-07-05.md
-site/api.target.com-2025-07-05.md
-site/subdomain.target.com-2025-07-05.md
+[ ] Introspection enabled?
+[ ] GraphQL IDE exposed
+[ ] Authorization bypass (IDOR)
+[ ] Batch query attack
+[ ] Depth-based DoS
+[ ] SQL/NoSQL Injection
 ```
 
----
-
-## 🔧 TOOLS & SCRIPTS
-
-Scripts available in `tools/`:
+### Phase 11: OWASP Top 10 (A01-A10)
 ```
-tools/
-├── header-scan.sh              # Linux/Mac headers
-├── header-scan.ps1             # Windows headers
-└── security-scan.ps1          # Windows ALL-IN-ONE
+[ ] A01 - Broken Access Control
+[ ] A02 - Cryptographic Failures
+[ ] A03 - Injection
+[ ] A04 - Insecure Design
+[ ] A05 - Security Misconfiguration
+[ ] A06 - Vulnerable Components
+[ ] A07 - Auth Failures
+[ ] A08 - Data Integrity
+[ ] A09 - Logging Failures
+[ ] A10 - SSRF
 ```
 
-Checklists available in `checklists/`:
+### Phase 12: Business Logic & API
+```
+[ ] IDOR
+[ ] Privilege escalation
+[ ] Price manipulation
+[ ] API security (REST/GraphQL)
+[ ] Rate limiting
 ```
-checklists/
-├── headers.md                  # 9 headers detail
-├── owasp.md                    # OWASP Top 10
-├── ports.md                    # Port scanning
-└── injection.md                # All injection types
+
+---
+
+## 🔧 TOOLS LOCATION
+
+```
+skills/pentesting/
+├── SKILL.md                    # This file
+├── checklists/
+│   ├── headers.md             # 9 headers detail
+│   ├── owasp.md               # OWASP Top 10
+│   ├── ports.md               # Port scanning
+│   ├── injection.md           # All injection types
+│   ├── exposed-files.md       # 🔴 NEW - Exposed files
+│   ├── cors.md                # 🔴 NEW - CORS security
+│   ├── jwt.md                 # 🔴 NEW - JWT security
+│   └── graphql.md             # 🔴 NEW - GraphQL security
+├── tools/
+│   ├── header-scan.sh         # Linux/Mac headers
+│   ├── header-scan.ps1        # Windows headers
+│   ├── exposed-files-scan.sh  # 🔴 NEW - Exposed files
+│   ├── exposed-files-scan.ps1 # 🔴 NEW - Exposed files
+│   ├── full-scan.sh           # 🔴 NEW - All-in-one Linux
+│   └── full-scan.ps1          # 🔴 NEW - All-in-one Windows
+└── reports/
+    └── template.md            # Report template
 ```
 
 ---
 
 ## 🚀 QUICK COMMANDS
 
+### Skill Health Check 🔴 **NEW**
+```bash
+# Windows PowerShell
+.\tools\test-skill.ps1
+.\tools\test-skill.ps1 -Verbose
+
+# Linux/Mac
+chmod +x tools/test-skill.sh
+./tools/test-skill.sh
+```
+
 ### Security Headers
 ```bash
 # Linux/Mac
@@ -292,16 +231,30 @@ chmod +x tools/header-scan.sh
 .\tools\header-scan.ps1 -Target https://target.com
 ```
 
+### Exposed Files Scan 🔴 NEW
+```bash
+# Linux/Mac
+chmod +x tools/exposed-files-scan.sh
+./tools/exposed-files-scan.sh https://target.com
+
+# Windows PowerShell
+.\tools\exposed-files-scan.ps1 -Target https://target.com
+```
+
+### Full Security Scan (All-in-One) 🔴 NEW
+```bash
+# Linux/Mac
+chmod +x tools/full-scan.sh
+./tools/full-scan.sh https://target.com
+
+# Windows PowerShell
+.\tools\full-scan.ps1 -Target https://target.com
+```
+
 ### Port Scanning
 ```bash
-# Nmap quick
 nmap -sV -p 21,22,80,443,3306,5432,8080 target.com
-
-# Full scan
 nmap -p- -sV target.com
-
-# Nmap with scripts
-nmap -sC -sV -p- target.com
 ```
 
 ### Vulnerability Scanning
@@ -319,12 +272,6 @@ dalfox url https://target.com/search?q=test
 commix -u "http://target.com/ping?ip=127.0.0.1"
 ```
 
-### Full Scan
-```powershell
-# Windows - All in one
-.\tools\security-scan.ps1 -Target https://target.com
-```
-
 ---
 
 ## 📊 OUTPUT FORMAT
@@ -347,7 +294,7 @@ F (0-29):   Critical
 ```
 
 ### Report File
-**Format:** `site/[domain]-[YYYY-MM-DD].md`
+**Format:** `site/[domain]-[date].md`
 
 ---
 
@@ -363,14 +310,19 @@ F (0-29):   Critical
 
 ## 🆘 HELP COMMANDS
 
-If user asks:
 - "apa bisa ini?" → Show CAPABILITIES OVERVIEW
 - "cara pakai" → Show QUICK COMMANDS
 - "test sekarang" → Start the test workflow
-- "check [target]" → Start security scan + save to site/[domain]-[date].md
+- "check [target]" → Full scan + save report
 - "scan headers" → Run header scan
+- "scan exposed files" → Run exposed files scan
+- "full scan" → Run all-in-one scanner
 - "test SQL injection" → Load SQLi payloads
-- "complete checklist" → Show COMPLETE TEST CHECKLIST
+- "test CORS" → Load CORS checklist
+- "test JWT" → Load JWT checklist
+- "test GraphQL" → Load GraphQL checklist
+- **"test skill" / "check skill" / "validate skill"** → Run skill health check
+- **"skill status" / "skill health"** → Show skill installation status
 
 ---
 
@@ -378,16 +330,28 @@ If user asks:
 
 ```
 User: "pentest untuk website ini: example.com"
-→ Load SKILL → Start full pentest workflow → Generate site/example.com-2025-07-05.md
+→ Full pentest workflow → site/example.com-2025-07-05.md
 
 User: "security audit untuk target.com"
-→ Load SKILL → Run all tests → Generate site/target.com-2025-07-05.md
+→ Run all tests → site/target.com-2025-07-05.md
+
+User: "check exposed files di website ini"
+→ Run exposed files scan → site/target.com-exposed-2025-07-05.md
+
+User: "test CORS di api.target.com"
+→ Run CORS security tests
+
+User: "audit JWT security"
+→ Run JWT security checklist
+
+User: "GraphQL security check"
+→ Run GraphQL security tests
 
-User: "OWASP check untuk API"
-→ Load SKILL → Run OWASP Top 10 checklist
+User: "test skill"
+→ Run skill health check → Show test results
 
-User: "scan subdomain ini: api.target.com"
-→ Load SKILL → Run all tests → Generate site/api.target.com-2025-07-05.md
+User: "validate skill installation"
+→ Verify all files exist → Show skill status
 ```
 
 ---
@@ -395,5 +359,6 @@ User: "scan subdomain ini: api.target.com"
 ## ✅ SKILL READY
 
 **Status:** ACTIVE & READY FOR USE
-**Version:** 2.0
+**Version:** 3.0
 **Author:** Rz (@soulofzephir)
+**Last Updated:** 2025-07-05