@soulofzephir/pi-skill-pentesting 1.0.0

package/skills/pentesting/reports/template.md

@@ -0,0 +1,268 @@
+# Security Audit Report Generator
+
+**Target:** [TARGET_URL]
+**Date:** [DATE]
+**Version:** 2.0
+
+---
+
+## 📋 Executive Summary
+
+| Metric | Value |
+|--------|-------|
+| Target URL | [TARGET_URL] |
+| Scan Date | [DATE] |
+| Header Score | [X]/100 |
+| Critical Issues | [X] |
+| High Risk | [X] |
+| Medium Risk | [X] |
+| Low Risk | [X] |
+| **Overall Risk** | [Critical/High/Medium/Low] |
+
+---
+
+## 🎯 Target Information
+
+```
+URL:          [URL]
+IP:           [IP if found]
+Server:       [Server info]
+SSL Grade:    [A-F or N/A]
+CMS/Framework:[If detected]
+```
+
+### Technology Stack Detected
+- [ ] Component: Version
+
+---
+
+## ✅ Test Coverage
+
+| Phase | Test | Status |
+|-------|------|--------|
+| 1 | Reconnaissance | ✅/❌/⏳ |
+| 2 | Security Headers | ✅/❌/⏳ |
+| 3 | Port Scanning | ✅/❌/⏳ |
+| 4 | SSL/TLS Audit | ✅/❌/⏳ |
+| 5 | Authentication Testing | ✅/❌/⏳ |
+| 6 | Injection Testing | ✅/❌/⏳ |
+| 7 | Business Logic | ✅/❌/⏳ |
+| 8 | API Security | ✅/❌/⏳ |
+| 9 | OWASP Top 10 | ✅/❌/⏳ |
+| 10 | Client-Side | ✅/❌/⏳ |
+
+---
+
+## 🔒 Security Headers Analysis
+
+### Header Score: [X]/100
+
+| Header | Status | Value | Risk |
+|--------|--------|-------|------|
+| CSP | ✅/❌/⚠️ | [value] | XSS/Injection |
+| HSTS | ✅/❌/⚠️ | [value] | Protocol Downgrade |
+| X-Content-Type-Options | ✅/❌/⚠️ | [value] | MIME Sniffing |
+| X-Frame-Options | ✅/❌/⚠️ | [value] | Clickjacking |
+| Referrer-Policy | ✅/❌/⚠️ | [value] | Info Leakage |
+| Permissions-Policy | ✅/❌/⚠️ | [value] | Feature Abuse |
+| Cache-Control | ✅/❌/⚠️ | [value] | Data Exposure |
+| Server | ✅/❌/⚠️ | [value] | Reconnaissance |
+| X-Powered-By | ✅/❌/⚠️ | [value] | Tech Exposure |
+| Cross-Origin Policies | ✅/❌/⚠️ | [value] | Security |
+
+---
+
+## 🔌 Port Scan Results
+
+| Port | Service | Status | Risk |
+|------|---------|--------|------|
+| [PORT] | [SERVICE] | OPEN/CLOSED | [RISK_LEVEL] |
+
+### High-Risk Findings
+```
+[ ] Port [X] exposed - [RECOMMENDATION]
+[ ] Port [X] should not be public - [RECOMMENDATION]
+```
+
+---
+
+## 🔐 SSL/TLS Audit
+
+| Check | Status | Details |
+|-------|--------|---------|
+| Certificate Valid | ✅/❌ | [Details] |
+| TLS 1.2/1.3 Only | ✅/❌ | [Details] |
+| Weak Ciphers | ✅/❌ | [Details] |
+| HSTS Implemented | ✅/❌ | [Details] |
+| Self-Signed | ✅/❌ | [Details] |
+
+---
+
+## 🔴 Critical Issues
+
+### [ISSUE-001] [Title]
+
+| Field | Value |
+|-------|-------|
+| **Risk Level** | 🔴 CRITICAL |
+| **CVSS Score** | [X.X] |
+| **OWASP Category** | [A01-A10] |
+| **Status** | Open |
+
+**Description:**
+[Detailed description]
+
+**Evidence:**
+```
+[Paste evidence - request/response]
+```
+
+**Impact:**
+[What an attacker can achieve]
+
+**Reproduction:**
+1. [Step 1]
+2. [Step 2]
+3. [Step 3]
+
+**Remediation:**
+```[code]
+[Fix recommendation]
+```
+
+**References:**
+- CWE-[XXX]
+- [Related link]
+
+---
+
+## 🟠 High Risk Issues
+
+### [ISSUE-XXX] [Title]
+
+| Field | Value |
+|-------|-------|
+| **Risk Level** | 🟠 HIGH |
+| **CVSS Score** | [X.X] |
+| **OWASP Category** | [A01-A10] |
+
+**Description:**
+[...]
+
+**Remediation:**
+[...]
+
+---
+
+## 🟡 Medium Risk Issues
+
+### [ISSUE-XXX] [Title]
+
+| Field | Value |
+|-------|-------|
+| **Risk Level** | 🟡 MEDIUM |
+| **CVSS Score** | [X.X] |
+
+**Description:**
+[...]
+
+**Remediation:**
+[...]
+
+---
+
+## 🟢 Low Risk / Informational
+
+### [INFO-001] [Title]
+
+| Field | Value |
+|-------|-------|
+| **Risk Level** | 🟢 LOW/INFO |
+
+**Finding:**
+[...]
+
+**Recommendation:**
+[...]
+
+---
+
+## 📊 Vulnerability Summary
+
+| ID | Title | Risk | Status |
+|----|-------|------|--------|
+| ISSUE-001 | [Title] | 🔴 CRITICAL | Open |
+| ISSUE-002 | [Title] | 🟠 HIGH | Open |
+| ISSUE-003 | [Title] | 🟡 MEDIUM | Open |
+| INFO-001 | [Title] | 🟢 INFO | Open |
+
+---
+
+## ✅ OWASP Top 10 Checklist
+
+| Category | Status | Findings |
+|----------|--------|----------|
+| A01 - Broken Access Control | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A02 - Cryptographic Failures | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A03 - Injection | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A04 - Insecure Design | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A05 - Security Misconfiguration | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A06 - Vulnerable Components | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A07 - Auth Failures | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A08 - Data Integrity | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A09 - Logging Failures | ✅ Pass / ⚠️ Review / ❌ Fail | |
+| A10 - SSRF | ✅ Pass / ⚠️ Review / ❌ Fail | |
+
+---
+
+## 📝 Remediation Priority
+
+### Immediate (Critical)
+1. [Issue-001] - [Action]
+2. [Issue-002] - [Action]
+
+### Short-term (High/Medium)
+1. [Issue-003] - [Action]
+2. [Issue-004] - [Action]
+
+### Long-term (Low)
+1. [Issue-005] - [Action]
+
+---
+
+## 🔗 References & Tools
+
+### Tools Used
+- Burp Suite
+- Nmap
+- Nuclei
+- SQLMap
+- Dalfox
+- [Other tools]
+
+### References
+- OWASP Top 10: https://owasp.org/Top10/
+- CWE: https://cwe.mitre.org/
+- CVSS Calculator: https://nvd.nist.gov/vuln-metrics/cvss
+- Security Headers: https://securityheaders.com/
+
+---
+
+## 📎 Appendix
+
+### Test Environment
+- **Browser:** [Browser/Version]
+- **Testing Tool:** [Tool]
+- **Network:** [VPN/Direct]
+
+### Test Accounts
+| Role | Username | Password |
+|------|----------|----------|
+| Admin | [admin@test.com] | ******* |
+| User | [user@test.com] | ******* |
+
+---
+
+**Report Generated:** [DATE]
+**Auditor:** Rz (@soulofzephir)
+**Next Review:** [DATE]

package/skills/pentesting/tools/generate-report.ps1

@@ -0,0 +1,327 @@
+# Security Report Generator v2.0
+# Generates report to: site/[domain]-[date].md
+
+param(
+    [Parameter(Mandatory=$false)]
+    [string]$Target = "",
+    
+    [Parameter(Mandatory=$false)]
+    [string]$OutputDir = "site"
+)
+
+$ErrorActionPreference = "Continue"
+
+# ═══════════════════════════════════════════════════════════
+# REPORT CONFIGURATION
+# ═══════════════════════════════════════════════════════════
+
+# Get current date
+$Date = Get-Date -Format "yyyy-MM-dd"
+
+# Parse target URL
+if ($Target -match "https?://") {
+    $Uri = [System.Uri]$Target
+    $Domain = $Uri.Host
+    $Scheme = $Uri.Scheme
+} else {
+    $Domain = $Target
+    $Target = "https://$Target"
+}
+
+# Create output filename
+$OutputFile = "$OutputDir/$Domain-$Date.md"
+
+# ═══════════════════════════════════════════════════════════
+# CREATE OUTPUT DIRECTORY
+# ═══════════════════════════════════════════════════════════
+
+if (-not (Test-Path $OutputDir)) {
+    New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+    Write-Host "📁 Created directory: $OutputDir" -ForegroundColor Cyan
+}
+
+# ═══════════════════════════════════════════════════════════
+# START SCAN
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "╔═══════════════════════════════════════════════════╗" -ForegroundColor Cyan
+Write-Host "║  🛡️ Security Audit Report Generator v2.0         ║" -ForegroundColor Cyan
+Write-Host "╚═══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host ""
+
+# ═══════════════════════════════════════════════════════════
+# HEADER SCAN
+# ═══════════════════════════════════════════════════════════
+
+Write-Host "🔒 Scanning Security Headers..." -ForegroundColor Yellow
+$HeaderScore = 0
+$Headers = @{}
+$Issues = @()
+
+try {
+    $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 15 -ErrorAction Stop
+    $ResponseHeaders = $Response.Headers
+} catch {
+    try {
+        $Target = $Target -replace "^https", "http"
+        $Response = Invoke-WebRequest -Uri $Target -Method Head -TimeoutSec 15 -ErrorAction Stop
+        $ResponseHeaders = $Response.Headers
+    } catch {
+        Write-Host "⚠️  Cannot connect to target" -ForegroundColor Red
+        $ResponseHeaders = @{}
+    }
+}
+
+# HSTS
+$HSTS = $ResponseHeaders["Strict-Transport-Security"]
+if ($HSTS) {
+    $Headers["HSTS"] = "✅ Present"
+    if ($HSTS -match "max-age=([3-9]\d{5,}|\d{7,})") { $HeaderScore += 15 }
+    else { $HeaderScore += 8; $Issues += "HSTS max-age too short" }
+} else {
+    $Headers["HSTS"] = "❌ Missing"
+    $Issues += "HSTS not implemented"
+}
+
+# CSP
+$CSP = $ResponseHeaders["Content-Security-Policy"]
+if ($CSP) {
+    $Headers["CSP"] = "✅ Present"
+    $HeaderScore += 20
+    if ($CSP -match "unsafe-inline") { $Issues += "CSP contains unsafe-inline" }
+} else {
+    $Headers["CSP"] = "❌ Missing"
+    $Issues += "CSP not implemented (XSS risk)"
+}
+
+# X-Content-Type-Options
+$XCTO = $ResponseHeaders["X-Content-Type-Options"]
+if ($XCTO -eq "nosniff") {
+    $Headers["X-Content-Type-Options"] = "✅ nosniff"
+    $HeaderScore += 10
+} else {
+    $Headers["X-Content-Type-Options"] = "❌ Missing"
+    $Issues += "X-Content-Type-Options not set"
+}
+
+# X-Frame-Options
+$XFO = $ResponseHeaders["X-Frame-Options"]
+if ($XFO -eq "DENY") {
+    $Headers["X-Frame-Options"] = "✅ DENY"
+    $HeaderScore += 10
+} elseif ($XFO -eq "SAMEORIGIN") {
+    $Headers["X-Frame-Options"] = "✅ SAMEORIGIN"
+    $HeaderScore += 8
+} else {
+    $Headers["X-Frame-Options"] = "❌ Missing"
+    $Issues += "X-Frame-Options not set (clickjacking risk)"
+}
+
+# Referrer-Policy
+$RP = $ResponseHeaders["Referrer-Policy"]
+if ($RP) {
+    $Headers["Referrer-Policy"] = "✅ $RP"
+    $HeaderScore += 10
+} else {
+    $Headers["Referrer-Policy"] = "⚠️ Missing"
+    $HeaderScore += 5
+}
+
+# Cache-Control
+$CC = $ResponseHeaders["Cache-Control"]
+if ($CC -match "no-store|no-cache") {
+    $Headers["Cache-Control"] = "✅ Secure"
+    $HeaderScore += 10
+} else {
+    $Headers["Cache-Control"] = "⚠️ $CC"
+    $HeaderScore += 5
+}
+
+# Server
+$Server = $ResponseHeaders["Server"]
+if ($Server) {
+    if ($Server -match "/\d|Advanced|Version") {
+        $Headers["Server"] = "⚠️ Leaks version: $Server"
+        $Issues += "Server header leaks version"
+    } else {
+        $Headers["Server"] = "⚠️ $Server"
+    }
+}
+
+# X-Powered-By
+$XPB = $ResponseHeaders["X-Powered-By"]
+if ($XPB) {
+    $Headers["X-Powered-By"] = "⚠️ $XPB"
+    $Issues += "X-Powered-By leaks technology"
+}
+
+Write-Host "   Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+
+# ═══════════════════════════════════════════════════════════
+# PORT SCAN (Quick)
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "🔌 Quick Port Check..." -ForegroundColor Yellow
+
+$Ports = @(80, 443, 8080, 3306, 5432, 6379, 27017, 22)
+$OpenPorts = @()
+
+foreach ($Port in $Ports) {
+    try {
+        $TCP = New-Object System.Net.Sockets.TcpClient
+        $Result = $TCP.BeginConnect($Domain, $Port, $null, $null)
+        $Wait = $Result.AsyncWaitHandle.WaitOne(500)
+        
+        if ($Wait -and $TCP.Connected) {
+            $Service = switch ($Port) {
+                80 { "HTTP" }
+                443 { "HTTPS" }
+                8080 { "HTTP-Alt" }
+                3306 { "MySQL" }
+                5432 { "PostgreSQL" }
+                6379 { "Redis" }
+                27017 { "MongoDB" }
+                22 { "SSH" }
+            }
+            $OpenPorts += [PSCustomObject]@{ Port = $Port; Service = $Service }
+            
+            if ($Port -in @(3306, 5432, 6379, 27017, 2375)) {
+                $Issues += "High-risk port $Port ($Service) is open!"
+            }
+        }
+        $TCP.Close()
+    } catch {}
+}
+
+if ($OpenPorts.Count -eq 0) {
+    Write-Host "   No common ports detected from external" -ForegroundColor Gray
+} else {
+    Write-Host "   Open ports: $($OpenPorts.Port -join ', ')" -ForegroundColor Yellow
+}
+
+# ═══════════════════════════════════════════════════════════
+# GENERATE REPORT
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "📝 Generating report..." -ForegroundColor Yellow
+
+$Report = @"
+# 🔒 Security Audit Report
+
+**Target:** $Target
+**Date:** $Date
+**Generated by:** Pi Pentesting Skill v2.0
+
+---
+
+## 📋 Executive Summary
+
+| Metric | Value |
+|--------|-------|
+| Target URL | $Target |
+| Scan Date | $Date |
+| Header Score | $HeaderScore/100 |
+| High-Risk Ports | $($OpenPorts.Count) |
+| Issues Found | $($Issues.Count) |
+
+---
+
+## 🔒 Security Headers Analysis
+
+### Header Score: **$HeaderScore/100** $(if($HeaderScore -ge 90){"(A - Excellent)"}elseif($HeaderScore -ge 70){"(B - Good)"}elseif($HeaderScore -ge 50){"(C - Needs Improvement)"}else{"(D/F - Poor)"})
+
+| Header | Status |
+|--------|--------|
+$(foreach ($key in $Headers.Keys) {
+    "| $key | $($Headers[$key]) |"
+})
+
+---
+
+## 🔌 Port Scan Results
+
+| Port | Service |
+|------|---------|
+$(if ($OpenPorts.Count -gt 0) {
+    foreach ($p in $OpenPorts) {
+        "| $($p.Port) | $($p.Service) |"
+    }
+} else {
+    "| - | No common ports detected |"
+})
+
+---
+
+## ⚠️ Issues Identified
+
+$(if ($Issues.Count -gt 0) {
+    foreach ($issue in $Issues) {
+        "- ⚠️  $issue"
+    }
+} else {
+    "- ✅ No major issues detected in quick scan"
+})
+
+---
+
+## 📊 Recommendations
+
+### Immediate Actions
+1. Implement missing security headers
+2. Close unnecessary exposed ports
+3. Enable HSTS with proper max-age
+4. Configure Content-Security-Policy
+
+### Short-term
+1. Regular security scanning
+2. Implement OWASP Top 10 controls
+3. Set up monitoring and logging
+4. Security headers automated testing
+
+---
+
+## 🔗 Further Testing Recommended
+
+- Full port scan (nmap -p-)
+- SQL Injection testing (sqlmap)
+- XSS testing (dalfox/xsstrike)
+- OWASP Top 10 comprehensive checklist
+- Business logic testing
+- API security assessment
+
+---
+
+## 📋 Report Location
+
+**File:** `$OutputFile`
+**Date:** $Date
+
+---
+
+**Report Generated:** $(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
+**Author:** Rz (@soulofzephir)
+"@
+
+# Save report
+$Report | Out-File -FilePath $OutputFile -Encoding UTF8
+
+# ═══════════════════════════════════════════════════════════
+# COMPLETE
+# ═══════════════════════════════════════════════════════════
+
+Write-Host ""
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host "✅ Report Generated Successfully!" -ForegroundColor Green
+Write-Host "═══════════════════════════════════════════════════" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "📄 Report Location: $OutputFile" -ForegroundColor White
+Write-Host "📊 Header Score: $HeaderScore/100" -ForegroundColor $(if($HeaderScore -ge 70){"Green"}else{"Red"})
+Write-Host "⚠️  Issues Found: $($Issues.Count)" -ForegroundColor $(if($Issues.Count -gt 0){"Yellow"}else{"Green"})
+Write-Host ""
+Write-Host "🔗 Online Tools:" -ForegroundColor Cyan
+Write-Host "   Headers: https://securityheaders.com/?q=$Domain"
+Write-Host "   SSL:     https://ssllabs.com/ssltest/analyze.html?d=$Domain"
+Write-Host ""