@soulofzephir/pi-skill-pentesting 1.0.2 → 1.0.3

package/skills/pentesting/checklists/subdomain.md

@@ -0,0 +1,243 @@
+# Subdomain Discovery & Enumeration
+
+## 🔍 What is Subdomain Enumeration?
+
+Finding subdomains of a target domain for expanding attack surface.
+
+---
+
+## ⚠️ Why Subdomains Matter
+
+```
+Target: example.com
+├── www.example.com        (usually secured)
+├── api.example.com        (API attacks)
+├── dev.example.com        (dev environment - often vulnerable!)
+├── staging.example.com    (staging - often less secure)
+├── admin.example.com      (admin panel)
+├── git.example.com        (git repository)
+├── *.example.com          (thousands of possibilities)
+```
+
+---
+
+## 🧪 Subdomain Discovery Methods
+
+### 1. Passive Reconnaissance (No direct contact)
+
+#### Certificate Transparency Logs
+```bash
+# crt.sh
+curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' 2>/dev/null
+
+# Alternative
+curl -s "https://crt.sh/?q=target.com&output=json" | jq -r '.[].sub_domain'
+
+# certspotter
+curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true" | jq -r '.[].dns_names[]'
+```
+
+#### DNS Aggregators
+```bash
+# SecurityTrails
+curl -s "https://securitytrails.com/api/v1/domain/example.com/subdomains" \
+  -H "API-KEY: YOUR_KEY"
+
+# VirusTotal
+curl -s "https://www.virustotal.com/vtapi/v2/domain/report?apikey=YOUR_KEY&domain=target.com"
+
+# Shodan
+shodan domain target.com
+
+# DNSdumpster
+curl -s "https://dnsdumpster.com/static/map/target.com.png" -o target-map.png
+```
+
+#### Search Engine Dorking
+```
+site:*.target.com
+site:target.com -www
+inurl:target.com
+intitle:"target" -www
+```
+
+---
+
+### 2. Active Enumeration
+
+#### DNS Brute Force
+```bash
+# amass (fast)
+amass enum -passive -d target.com -o subdomains.txt
+amass enum -active -d target.com -brute -o subdomains.txt
+
+# subfinder (fast, passive)
+subfinder -d target.com -o subdomains.txt
+
+# sublist3r
+python sublist3r.py -d target.com -o subdomains.txt
+
+# massdns (fast DNS resolver)
+massdns -r resolvers.txt -t AAAA domains.txt -o A results.txt
+```
+
+#### Wordlists
+```
+# Common subdomains wordlist
+bitquark-subdomains-top100000.txt
+subdomains-top1million-5000.txt
+jhadriel-top1000.txt
+```
+
+#### DNS Zone Transfer
+```bash
+# Try zone transfer
+dig axfr @ns1.target.com target.com
+
+# dnsenum
+dnsenum target.com
+
+# fierce
+fierce -dns target.com
+```
+
+---
+
+### 3. OSINT Sources
+
+```bash
+# GitHub Search
+site:github.com "target.com"
+
+# Wayback Machine
+curl -s "https://web.archive.org/cdx/search/cdx?url=*.target.com/*&output=text" | sort -u
+
+# DNS dumpster
+curl -s "https://dnsdumpster.com/static/map/target.com.png"
+
+# Bufferover
+curl -s "https://dns.bufferover.run/dns?q=.target.com"
+
+# ThreatCrowd
+curl -s "https://threatcrowd.org/api/v2/domain/report/?domain=target.com"
+```
+
+---
+
+## 🧪 Testing Checklist
+
+### Passive Recon
+- [ ] Certificate Transparency logs
+- [ ] DNS aggregators (SecurityTrails, VirusTotal)
+- [ ] Search engine dorking
+- [ ] Wayback Machine
+- [ ] ASN enumeration
+
+### Active Enum
+- [ ] DNS brute force with wordlist
+- [ ] DNS zone transfer attempt
+- [ ] Virtual host enumeration
+- [ ] DNS wildcard detection
+
+### Analysis
+- [ ] Filter unique subdomains
+- [ ] Check for takeover opportunities
+- [ ] Check for forgotten subdomains
+- [ ] Check for staging/dev environments
+- [ ] Check for cloud services
+
+---
+
+## 🔧 Subdomain Takeover Checklist
+
+### Vulnerable Providers
+```
+✅ Amazon AWS (S3, CloudFront, Elastic Beanstalk)
+✅ GitHub Pages
+✅ Heroku
+✅ Fastly
+✅ Azure
+✅ Cloudflare
+✅ Shopify
+✅ Tumblr
+```
+
+### Indicators
+```
+- DNS points to service that no longer exists
+- CNAME points to expired/deactivated service
+- HTTP 404/403 on subdomain
+- "No Such Bucket" / "404 Not Found" errors
+```
+
+### Check Commands
+```bash
+# Check CNAME
+dig CNAME dev.target.com
+
+# Check for takeover
+nslookup虚无 subdomain.target.com
+```
+
+---
+
+## 🛠️ Tools Summary
+
+| Tool | Type | Speed | Accuracy |
+|------|------|-------|----------|
+| amass | Passive/Active | Fast | High |
+| subfinder | Passive | Very Fast | Medium |
+| sublist3r | Passive | Medium | Medium |
+| massdns | Active | Very Fast | High |
+| shuffledns | Active | Very Fast | High |
+| assetfinder | Passive | Fast | Medium |
+
+### Recommended Workflow
+```bash
+# 1. Passive enum (fast)
+subfinder -d target.com -o passive.txt
+
+# 2. Passive via crt.sh
+curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' > crt.txt
+
+# 3. Active brute force (slow but thorough)
+amass enum -active -d target.com -brute -o active.txt
+
+# 4. Combine and deduplicate
+cat passive.txt crt.txt active.txt | sort -u > all_subdomains.txt
+
+# 5. Check which are alive
+cat all_subdomains.txt | httprobe -c 50 > alive.txt
+```
+
+---
+
+## 📋 Subdomain Discovery Checklist
+
+| Method | Status | Notes |
+|--------|--------|-------|
+| crt.sh | ☐ | Certificate Transparency |
+| SecurityTrails | ☐ | Requires API key |
+| Subfinder | ☐ | Fast passive |
+| Amass | ☐ | Comprehensive |
+| Zone Transfer | ☐ | DNS zone transfer |
+| Brute Force | ☐ | With wordlist |
+| Wayback | ☐ | Historical subs |
+| Takeover Check | ☐ | Cloud services |
+
+---
+
+## 🚨 Common High-Risk Subdomains
+
+| Subdomain | Risk | Reason |
+|-----------|------|--------|
+| dev/* | 🔴 CRITICAL | Often unpatched, debug enabled |
+| staging/* | 🟠 HIGH | Less tested, similar to prod |
+| test/* | 🟠 HIGH | May have test credentials |
+| git/* | 🔴 CRITICAL | Source code exposure |
+| vpn/* | 🔴 CRITICAL | Gateway to internal |
+| admin/* | 🔴 CRITICAL | Admin panels |
+| api/* | 🟠 HIGH | API attack surface |
+| old/* | 🟠 HIGH | Often forgotten, unmaintained |
+| cdn/* | 🟡 MEDIUM | Can be used for phishing |
+| mail/* | 🟡 MEDIUM | Email security |

package/skills/pentesting/checklists/websocket.md

@@ -0,0 +1,197 @@
+# WebSocket Security Checklist
+
+## 🔍 What is WebSocket?
+
+Full-duplex communication over a single TCP connection. Common in:
+- Real-time chat applications
+- Live dashboards
+- Gaming
+- Collaborative tools
+- Streaming data
+
+```
+ws://target.com/socket
+wss://target.com/socket  (secure)
+```
+
+---
+
+## ⚠️ WebSocket Vulnerabilities
+
+### 1. Lack of Origin Validation
+```
+Attacker can connect from malicious site
+```
+
+### 2. Cross-Site WebSocket Hijacking (CSWSH)
+```
+Attacker tricks user into connecting to attacker's WebSocket
+```
+
+### 3. Lack of Authentication After Upgrade
+```
+WebSocket accepts connection before auth
+```
+
+### 4. Sensitive Data in Messages
+```
+PII, tokens transmitted without encryption
+```
+
+### 5. DoS via WebSocket
+```
+Unlimited message sending
+Connection pool exhaustion
+```
+
+---
+
+## 🧪 Testing Checklist
+
+### Phase 1: Discovery
+- [ ] WebSocket endpoint identified (ws:// or wss://)
+- [ ] WebSocket URL discovered
+- [ ] JavaScript analyzed for WebSocket usage
+- [ ] WSS (secure WebSocket) used?
+
+### Phase 2: Connection Testing
+- [ ] Connection without authentication?
+- [ ] Origin header validation?
+- [ ] Cross-origin connection possible?
+- [ ] Connection persists after logout?
+
+### Phase 3: Authentication
+- [ ] Token in URL? (security risk!)
+- [ ] Token in message header?
+- [ ] Token in cookie?
+- [ ] Token expiration checked?
+- [ ] Token reuse possible?
+
+### Phase 4: Authorization
+- [ ] Can access other users' data?
+- [ ] IDOR in WebSocket messages?
+- [ ] Privilege escalation possible?
+
+### Phase 5: Input Validation
+- [ ] XSS via WebSocket messages
+- [ ] SQL/NoSQL Injection in messages
+- [ ] Command Injection in messages
+- [ ] Message size limits enforced?
+
+### Phase 6: DoS Testing
+- [ ] Connection limit exists?
+- [ ] Message rate limiting?
+- [ ] Ping/pong heartbeats?
+- [ ] Auto-reconnect abuse possible?
+
+### Phase 7: Data Exposure
+- [ ] Sensitive data in messages?
+- [ ] PII exposure?
+- [ ] Stack traces in errors?
+- [ ] Debug messages?
+
+---
+
+## 🔧 Testing Tools & Commands
+
+### Browser DevTools
+```javascript
+// Open DevTools > Network > WS tab
+// Look for "ws://" or "wss://" connections
+
+// In Console
+WebSocket = WebSocket
+// Override to log all messages
+```
+
+### Manual Testing with wscat
+```bash
+# Install
+npm install -g wscat
+
+# Connect
+wscat -c ws://target.com/socket
+
+# Connect with headers
+wscat -c ws://target.com/socket -H "Authorization: Bearer TOKEN"
+
+# Connect with origin
+wscat -c ws://target.com/socket -o https://evil.com
+```
+
+### Python websocket-client
+```python
+import websocket
+
+ws = websocket.WebSocket()
+ws.connect("wss://target.com/socket", 
+           header={"Authorization": "Bearer TOKEN"})
+
+# Send message
+ws.send('{"type": "message", "text": "Hello"}')
+
+# Receive
+result = ws.recv()
+```
+
+### Burp Suite
+1. Proxy > WebSockets tab
+2. Enable interception
+3. Manipulate messages in transit
+
+---
+
+## 🔧 Common WebSocket Payloads
+
+### XSS via WebSocket
+```json
+{"message": "<script>alert(1)</script>"}
+{"type": "chat", "content": "<img src=x onerror=alert(1)>"}
+```
+
+### SQL Injection
+```json
+{"user_id": "1 OR 1=1"}
+{"id": "1; DROP TABLE users--"}
+```
+
+### NoSQL Injection
+```json
+{"username": {"$ne": ""}}
+{"id": {"$gt": 0}}
+```
+
+### Large Message (DoS)
+```json
+{"message": "A" * 100000}
+```
+
+---
+
+## 📋 WebSocket Security Score
+
+| Check | Points |
+|-------|--------|
+| WSS (secure) used | 15 |
+| Origin validation | 20 |
+| Authentication required | 20 |
+| Authorization enforced | 20 |
+| Input validation | 15 |
+| Rate limiting | 10 |
+
+**Total: /100**
+
+---
+
+## 🛡️ Secure WebSocket Checklist
+
+- [ ] Use `wss://` not `ws://`
+- [ ] Validate `Origin` header
+- [ ] Authenticate during WebSocket handshake
+- [ ] Use secure tokens (not in URL)
+- [ ] Implement rate limiting
+- [ ] Validate all input
+- [ ] Set message size limits
+- [ ] Implement heartbeat/ping-pong
+- [ ] Close connections on logout
+- [ ] Log WebSocket activity