@soulofzephir/pi-skill-pentesting 1.0.0

package/skills/pentesting/SKILL.md

@@ -0,0 +1,399 @@
+---
+name: pentesting
+description: Comprehensive website security testing skill for penetration testing, vulnerability assessment, security headers analysis, port scanning, SQL injection, XSS testing, OWASP Top 10, and SSL/TLS audit. Use when user asks for pentest, security check, security audit, vulnerability scan, header security, port scan, SQL injection, XSS, OWASP, ethical hacking, or bug bounty testing. Generates reports to site/domainname-date.md format.
+---
+
+# 🛡️ Pentesting & Security Check Skill
+
+> **AUTHOR:** Rz | **VERSION:** 2.0 | **LAST UPDATED:** 2025-07-05
+
+---
+
+## 📋 CAPABILITIES OVERVIEW
+
+This skill provides **COMPREHENSIVE PENTESTING** capabilities:
+
+| Category | Coverage | Automated |
+|----------|----------|-----------|
+| **Security Headers** | 9 critical headers | ✅ Script |
+| **Port Scanning** | 20+ common ports | ✅ Nmap/Script |
+| **SQL Injection** | Union, Blind, Time-based | ✅ SQLMap + Manual |
+| **XSS Testing** | Reflected, Stored, DOM | ✅ Payloads + Tools |
+| **Command Injection** | Linux & Windows | ✅ Commix + Manual |
+| **XXE Testing** | Basic, Blind, DoS | ✅ Manual |
+| **OWASP Top 10** | A01-A10 complete | ✅ Checklist |
+| **SSL/TLS Audit** | Certificate & Ciphers | ✅ testssl.sh |
+| **Report Generation** | .md format | ✅ Auto |
+
+---
+
+## 🔔 AUTO-LOAD TRIGGERS
+
+This skill auto-loads when user mentions:
+- pentest, pentesting, penetration test
+- security check, security audit, security scan
+- vulnerability scan, vulnerability assessment
+- ethical hacking, bug bounty
+- header security, security headers, CSP, HSTS
+- port scan, open ports, network scan
+- SQL injection, SQLi, XSS, command injection
+- OWASP, OWASP Top 10
+- "test keamanan", "cek security", "audit keamanan"
+
+---
+
+## ⚡ COMPLETE TEST CHECKLIST
+
+For a **comprehensive security assessment**, run these tests in order:
+
+### Phase 1: Reconnaissance (Information Gathering)
+```
+[ ] Domain enumeration (subdomains, WHOIS)
+[ ] Technology fingerprinting (CMS, framework, libraries)
+[ ] Directory enumeration (/admin, /api, /backup)
+[ ] Parameter discovery
+[ ] Social media / leak analysis
+```
+
+### Phase 2: Security Headers Analysis
+```
+[ ] Content-Security-Policy (CSP)
+[ ] Strict-Transport-Security (HSTS)
+[ ] X-Content-Type-Options
+[ ] X-Frame-Options
+[ ] Referrer-Policy
+[ ] Permissions-Policy
+[ ] Cache-Control
+[ ] Server header (version hiding)
+[ ] X-Powered-By (tech hiding)
+[ ] Cross-Origin policies (COOP, CORP, COEP)
+```
+
+### Phase 3: Port & Network Scanning
+```
+[ ] Full port scan (1-65535)
+[ ] Service version detection
+[ ] High-risk port exposure check:
+    [ ] Port 22 (SSH) - brute force, key-only?
+    [ ] Port 3306 (MySQL) - remote access?
+    [ ] Port 5432 (PostgreSQL) - remote access?
+    [ ] Port 27017 (MongoDB) - no-auth?
+    [ ] Port 6379 (Redis) - no-auth?
+    [ ] Port 11211 (Memcached) - DDoS risk?
+    [ ] Port 2375 (Docker) - NEVER expose!
+    [ ] Port 9200 (Elasticsearch) - data exposure?
+```
+
+### Phase 4: SSL/TLS Audit
+```
+[ ] Certificate validity (not expired, trusted CA)
+[ ] TLS version (no SSLv3, TLS 1.0, TLS 1.1)
+[ ] Weak ciphers disabled?
+[ ] HSTS implementation
+[ ] Certificate chain complete?
+[ ] Self-signed cert check
+[ ] OCSP stapling enabled?
+```
+
+### Phase 5: Authentication Testing
+```
+[ ] Login page brute force protection
+[ ] Password policy enforcement
+[ ] MFA availability
+[ ] Session management:
+    [ ] Session ID randomness
+    [ ] Session timeout
+    [ ] HttpOnly cookies
+    [ ] Secure cookies
+    [ ] SameSite attribute
+[ ] Password reset flow:
+    [ ] Token randomness
+    [ ] Token expiration
+    [ ] Email enumeration
+[ ] Account lockout policy
+[ ] CAPTCHA implementation
+```
+
+### Phase 6: Injection Testing
+```
+[ ] SQL Injection:
+    [ ] UNION-based
+    [ ] Boolean-based blind
+    [ ] Time-based blind
+    [ ] Error-based
+    [ ] Stacked queries
+[ ] XSS (Cross-Site Scripting):
+    [ ] Reflected XSS
+    [ ] Stored/Persistent XSS
+    [ ] DOM-based XSS
+    [ ] Polyglot XSS
+[ ] Command Injection:
+    [ ] Linux commands
+    [ ] Windows commands
+[ ] XXE (XML External Entity)
+[ ] LDAP Injection
+[ ] XPath Injection
+[ ] SSTI (Server-Side Template Injection)
+[ ] SSTRF (Server-Side Request Forgery)
+[ ] Expression Language Injection
+```
+
+### Phase 7: Business Logic Testing
+```
+[ ] IDOR (Insecure Direct Object Reference)
+[ ] Horizontal privilege escalation
+[ ] Vertical privilege escalation
+[ ] Price/total manipulation
+[ ] Quantity manipulation
+[ ] Coupon/promotion abuse
+[ ] Race condition (concurrency)
+[ ] Workflow bypass
+[ ] Mass assignment
+```
+
+### Phase 8: API Security
+```
+[ ] REST API testing:
+    [ ] Authorization bypass
+    [ ] Rate limiting
+    [ ] Input validation
+    [ ] CORS misconfiguration
+[ ] GraphQL testing:
+    [ ] Introspection enabled?
+    [ ] Query complexity
+    [ ] Depth limiting
+[ ] JWT testing:
+    [ ] Algorithm confusion
+    [ ] Weak secret
+    [ ] Token expiration
+    [ ] None algorithm
+[ ] API versioning issues
+```
+
+### Phase 9: OWASP Top 10
+```
+[ ] A01 - Broken Access Control
+    [ ] Vertical privilege escalation
+    [ ] Horizontal privilege escalation
+    [ ] IDOR
+    [ ] CORS misconfiguration
+[ ] A02 - Cryptographic Failures
+    [ ] Sensitive data exposure
+    [ ] Weak encryption
+    [ ] Default crypto
+    [ ] Insecure key management
+[ ] A03 - Injection
+    [ ] SQL Injection
+    [ ] XSS
+    [ ] Command Injection
+    [ ] LDAP/XXE/XPath
+[ ] A04 - Insecure Design
+    [ ] Missing rate limiting
+    [ ] Business logic flaws
+    [ ] Credential stuffing protection
+[ ] A05 - Security Misconfiguration
+    [ ] Default credentials
+    [ ] Debug mode
+    [ ] Directory listing
+    [ ] Unnecessary features
+    [ ] Error handling
+[ ] A06 - Vulnerable Components
+    [ ] Outdated libraries
+    [ ] Known CVEs
+    [ ] Unmaintained dependencies
+[ ] A07 - Identification & Auth Failures
+    [ ] Weak passwords
+    [ ] Session management
+    [ ] Credential exposure
+[ ] A08 - Software & Data Integrity
+    [ ] Insecure deserialization
+    [ ] CI/CD issues
+    [ ] Auto-update integrity
+[ ] A09 - Logging & Monitoring
+    [ ] No audit logging
+    [ ] Failed login tracking
+    [ ] Alert fatigue
+[ ] A10 - SSRF
+    [ ] URL validation bypass
+    [ ] Internal network access
+    [ ] Cloud metadata access
+```
+
+### Phase 10: Client-Side Testing
+```
+[ ] CORS misconfiguration
+[ ] WebSocket testing
+[ ] WebRTC leakage
+[ ] Service Worker security
+[ ] Browser storage (localStorage, sessionStorage)
+[ ] Cookies security attributes
+[ ] JWT in localStorage vs HttpOnly cookie
+```
+
+---
+
+## ⚡ WORKFLOW (Follow in Order)
+
+### Step 1: Confirm Scope
+```
+1. Target URL/IP: [user input]
+2. Testing type: [Full / Targeted]
+3. Authorization: [User owns this / Has permission]
+```
+
+### Step 2: Run Tests (follow Complete Test Checklist above)
+
+### Step 3: Generate Report
+
+**IMPORTANT:** Always save report to:
+```
+site/[domain]-[YYYY-MM-DD].md
+```
+
+Example:
+```
+site/example.com-2025-07-05.md
+site/api.target.com-2025-07-05.md
+site/subdomain.target.com-2025-07-05.md
+```
+
+---
+
+## 🔧 TOOLS & SCRIPTS
+
+Scripts available in `tools/`:
+```
+tools/
+├── header-scan.sh              # Linux/Mac headers
+├── header-scan.ps1             # Windows headers
+└── security-scan.ps1          # Windows ALL-IN-ONE
+```
+
+Checklists available in `checklists/`:
+```
+checklists/
+├── headers.md                  # 9 headers detail
+├── owasp.md                    # OWASP Top 10
+├── ports.md                    # Port scanning
+└── injection.md                # All injection types
+```
+
+---
+
+## 🚀 QUICK COMMANDS
+
+### Security Headers
+```bash
+# Linux/Mac
+chmod +x tools/header-scan.sh
+./tools/header-scan.sh https://target.com
+
+# Windows PowerShell
+.\tools\header-scan.ps1 -Target https://target.com
+```
+
+### Port Scanning
+```bash
+# Nmap quick
+nmap -sV -p 21,22,80,443,3306,5432,8080 target.com
+
+# Full scan
+nmap -p- -sV target.com
+
+# Nmap with scripts
+nmap -sC -sV -p- target.com
+```
+
+### Vulnerability Scanning
+```bash
+# Nuclei
+nuclei -u https://target.com
+
+# SQLMap
+sqlmap -u "https://target.com/search?q=1" --batch
+
+# Dalfox XSS
+dalfox url https://target.com/search?q=test
+
+# Commix
+commix -u "http://target.com/ping?ip=127.0.0.1"
+```
+
+### Full Scan
+```powershell
+# Windows - All in one
+.\tools\security-scan.ps1 -Target https://target.com
+```
+
+---
+
+## 📊 OUTPUT FORMAT
+
+### Header Score (0-100)
+```
+A (90-100): Excellent
+B (70-89):  Good
+C (50-69):  Needs Improvement
+D (30-49):  Poor
+F (0-29):   Critical
+```
+
+### Vulnerability Severity
+```
+🔴 CRITICAL   → Fix immediately
+🟠 HIGH       → Fix within 1 week
+🟡 MEDIUM     → Fix within 1 month
+🟢 LOW/INFO   → Fix when possible
+```
+
+### Report File
+**Format:** `site/[domain]-[YYYY-MM-DD].md`
+
+---
+
+## ⚠️ IMPORTANT REMINDERS
+
+1. **ONLY test targets you own or have written permission for**
+2. **Document all findings with evidence**
+3. **Use responsible disclosure for bugs found**
+4. **Respect rate limits to avoid DoS**
+5. **Always save reports to site/[domain]-[date].md**
+
+---
+
+## 🆘 HELP COMMANDS
+
+If user asks:
+- "apa bisa ini?" → Show CAPABILITIES OVERVIEW
+- "cara pakai" → Show QUICK COMMANDS
+- "test sekarang" → Start the test workflow
+- "check [target]" → Start security scan + save to site/[domain]-[date].md
+- "scan headers" → Run header scan
+- "test SQL injection" → Load SQLi payloads
+- "complete checklist" → Show COMPLETE TEST CHECKLIST
+
+---
+
+## 📝 EXAMPLES OF TRIGGER PHRASES
+
+```
+User: "pentest untuk website ini: example.com"
+→ Load SKILL → Start full pentest workflow → Generate site/example.com-2025-07-05.md
+
+User: "security audit untuk target.com"
+→ Load SKILL → Run all tests → Generate site/target.com-2025-07-05.md
+
+User: "OWASP check untuk API"
+→ Load SKILL → Run OWASP Top 10 checklist
+
+User: "scan subdomain ini: api.target.com"
+→ Load SKILL → Run all tests → Generate site/api.target.com-2025-07-05.md
+```
+
+---
+
+## ✅ SKILL READY
+
+**Status:** ACTIVE & READY FOR USE
+**Version:** 2.0
+**Author:** Rz (@soulofzephir)

package/skills/pentesting/checklists/headers.md

@@ -0,0 +1,286 @@
+# Security Headers Checklist
+
+## 🔒 Critical Security Headers
+
+### 1. Content-Security-Policy (CSP)
+
+**Purpose:** Prevent XSS, clickjacking, data injection
+
+**Good Example:**
+```
+Content-Security-Policy: 
+  default-src 'self'; 
+  script-src 'self' 'nonce-random123'; 
+  style-src 'self' https://fonts.googleapis.com;
+  img-src 'self' data: https:;
+  font-src 'self' https://fonts.gstatic.com;
+  connect-src 'self';
+  frame-ancestors 'none';
+  base-uri 'self';
+  form-action 'self'
+```
+
+**What to Check:**
+- [ ] `default-src 'self'` or restrictive source
+- [ ] No `unsafe-inline` in script-src (XSS risk!)
+- [ ] No `unsafe-eval` in script-src
+- [ ] `frame-ancestors 'none'` or `'self'`
+- [ ] `base-uri` restricted
+- [ ] `form-action` limited
+
+**Red Flags:**
+```diff
+- script-src 'unsafe-inline' 'unsafe-eval'
+- default-src *
+- style-src *
+```
+
+---
+
+### 2. Strict-Transport-Security (HSTS)
+
+**Purpose:** Force HTTPS, prevent protocol downgrade
+
+**Good Example:**
+```
+Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+```
+
+**What to Check:**
+- [ ] `max-age` minimum 31536000 (1 year)
+- [ ] `includeSubDomains` present
+- [ ] `preload` for maximum protection
+
+**Red Flags:**
+```diff
+- max-age=0
+- Missing header entirely
+```
+
+---
+
+### 3. X-Content-Type-Options
+
+**Purpose:** Prevent MIME sniffing
+
+**Good:**
+```
+X-Content-Type-Options: nosniff
+```
+
+**Check:**
+- [ ] Must be exactly "nosniff"
+- [ ] Should not be missing
+
+---
+
+### 4. X-Frame-Options
+
+**Purpose:** Prevent clickjacking
+
+**Good:**
+```
+X-Frame-Options: DENY
+# or
+X-Frame-Options: SAMEORIGIN
+```
+
+**What to Check:**
+- [ ] Not set to ALLOWALL (dangerous!)
+- [ ] Missing = vulnerable
+
+**Red Flags:**
+```diff
+- X-Frame-Options: ALLOWALL
+```
+
+---
+
+### 5. X-XSS-Protection
+
+**Purpose:** Legacy browser XSS filter (deprecated but still useful)
+
+**Good:**
+```
+X-XSS-Protection: 1; mode=block
+```
+
+**What to Check:**
+- [ ] Set to `1; mode=block` not just `0` (disabled)
+
+---
+
+### 6. Referrer-Policy
+
+**Purpose:** Control referrer information leakage
+
+**Good:**
+```
+Referrer-Policy: strict-origin-when-cross-origin
+# or stricter:
+Referrer-Policy: no-referrer
+```
+
+**What to Check:**
+- [ ] Not `no-referrer-when-downgrade` (leaks HTTPS→HTTP)
+- [ ] Not `unsafe-url` (leaks everything!)
+
+**Ranking (best to worst):**
+1. `no-referrer`
+2. `strict-origin-when-cross-origin`
+3. `same-origin`
+4. `origin`
+5. `strict-origin`
+6. `no-referrer-when-downgrade` ⚠️
+7. `origin-when-cross-origin`
+8. `unsafe-url` ❌
+
+---
+
+### 7. Permissions-Policy (formerly Feature-Policy)
+
+**Purpose:** Disable dangerous browser features
+
+**Good:**
+```
+Permissions-Policy: 
+  geolocation=(),
+  microphone=(),
+  camera=(),
+  payment=(self)
+```
+
+**What to Check:**
+- [ ] Camera/microphone disabled if not needed
+- [ ] Geolocation restricted
+- [ ] USB not exposed
+- [ ] No autoplay audio
+
+---
+
+### 8. Cache-Control
+
+**Purpose:** Prevent sensitive data caching
+
+**For sensitive pages:**
+```
+Cache-Control: no-store, no-cache, must-revalidate, private
+Pragma: no-cache
+```
+
+**Check:**
+- [ ] Login pages = no-store
+- [ ] User data pages = no-store
+- [ ] API responses with PII = no-store
+
+---
+
+### 9. Cross-Origin Policies
+
+```
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Resource-Policy: same-origin
+Cross-Origin-Embedder-Policy: require-corp
+```
+
+---
+
+## ⚠️ Information Leakage Headers (Should NOT expose)
+
+### Server Information
+
+**Bad (reveals version):**
+```
+Server: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1f
+X-Powered-By: PHP/7.4.3
+X-AspNet-Version: 4.0.30319
+```
+
+**Good:**
+```
+Server: nginx
+# or
+Server: Apache
+```
+
+**Check:**
+- [ ] Server header generic (no version)
+- [ ] X-Powered-By removed or hidden
+- [ ] X-AspNet-Version removed
+
+---
+
+## 📊 Header Security Score Calculation
+
+| Header | Points |
+|--------|--------|
+| CSP (strict) | 20 |
+| HSTS (max-age ≥ 31536000) | 15 |
+| X-Content-Type-Options | 10 |
+| X-Frame-Options | 10 |
+| Referrer-Policy (strict) | 10 |
+| Permissions-Policy | 10 |
+| Cache-Control (sensitive pages) | 10 |
+| No info leakage (Server, X-Powered-By) | 15 |
+
+**Score:**
+- 90-100: A (Excellent)
+- 70-89: B (Good)
+- 50-69: C (Needs improvement)
+- 30-49: D (Poor)
+- 0-29: F (Critical issues)
+
+---
+
+## 🔧 Quick Test Commands
+
+```bash
+# Check all headers
+curl -I -s https://target.com
+
+# Specific header check
+curl -sD - https://target.com | grep -iE "csp|hsts|x-frame|x-content|server"
+
+# Full verbose
+curl -v -s https://target.com 2>&1 | grep -iE "^< |server|x-powered"
+
+# Check CSP with report-uri
+curl -s https://target.com -I | grep -i content-security
+
+# Test missing headers script
+#!/bin/bash
+TARGET=$1
+echo "Checking headers for: $TARGET"
+curl -I -s $TARGET | awk '/^HTTP/ {print "\n["$0"]"} 
+  /[Ss]erver/ {print "⚠️ "$0}
+  /[Xx]-[Pp]owered/ {print "⚠️ "$0}
+  /[Ss]trict-[Tt]ransport/ {print "✅ "$0}
+  /[Xx]-[Cc]ontent-[Tt]ype/ {print "✅ "$0}
+  /[Xx]-[Ff]rame/ {print "✅ "$0}
+  /[Cc]ontent-[Ss]ecurity/ {print "✅ "$0}
+  /[Rr]eferrer/ {print "✅ "$0}
+'
+```
+
+---
+
+## 📋 Header Remediation Quick Reference
+
+| Header | Apache (.htaccess) | Nginx |
+|--------|-------------------|-------|
+| CSP | Header set Content-Security-Policy "..." | add_header Content-Security-Policy "..."; |
+| HSTS | Header always set Strict-Transport-Security "max-age=..." | add_header Strict-Transport-Security "max-age=..."; |
+| X-Frame | Header set X-Frame-Options "DENY" | add_header X-Frame-Options "DENY"; |
+| X-Content-Type | Header set X-Content-Type-Options "nosniff" | add_header X-Content-Type-Options "nosniff"; |
+| Remove Server | Header unset Server | server_tokens off; |
+| Remove X-Powered-By | Header unset X-Powered-By | fastcgi_hide_header X-Powered-By; |
+
+---
+
+## 🛡️ Tools for Header Analysis
+
+1. **securityheaders.com** - Online scanner with grade
+2. **observatory.mozilla.org** - Mozilla's header analyzer
+3. **csp-evaluator.google** - CSP specifically
+4. **ssllabs.com** - SSL/TLS + some headers
+5. **curl** - Manual check