@soulofzephir/pi-skill-pentesting 1.0.2 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulofzephir/pi-skill-pentesting",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "Comprehensive pentesting & security check skill for Pi coding agent - headers, ports, SQLi, XSS, OWASP Top 10",
   "keywords": [
     "pi",

package/skills/pentesting/SKILL.md

@@ -1,15 +1,15 @@
 ---
 name: pentesting
-description: Comprehensive website security testing skill for penetration testing, vulnerability assessment, security headers analysis, port scanning, SQL injection, XSS testing, OWASP Top 10, SSL/TLS audit, exposed files detection, CORS, JWT, and GraphQL security testing. Use when user asks for pentest, security check, security audit, vulnerability scan, header security, port scan, SQL injection, XSS, OWASP, ethical hacking, exposed files, CORS, JWT, GraphQL, or bug bounty testing. Generates reports to site/domainname-date.md format.
+description: Comprehensive website security testing skill for penetration testing, vulnerability assessment, security headers, port scanning, SQL injection, XSS, OWASP Top 10, SSL/TLS, exposed files, CORS, JWT, GraphQL, API security, subdomain discovery, WebSocket, cloud metadata, and sensitive data detection. Use for pentest, security check, vulnerability scan, header security, port scan, SQL injection, XSS, exposed files, CORS, JWT, GraphQL, API security, subdomain, WebSocket, cloud, sensitive data, or bug bounty testing. Generates reports to site/domainname-date.md format.
 ---
 
 # 🛡️ Pentesting & Security Check Skill
 
-> **AUTHOR:** Rz (@soulofzephir) | **VERSION:** 3.0 | **LAST UPDATED:** 2025-07-05
+> **AUTHOR:** Rz (@soulofzephir) | **VERSION:** 4.0 | **LAST UPDATED:** 2025-07-05
 
 ---
 
-## 📋 CAPABILITIES OVERVIEW (v3.0)
+## 📋 CAPABILITIES OVERVIEW (v4.0)
 
 | Category | Coverage | Status |
 |----------|----------|--------|
@@ -21,10 +21,15 @@ description: Comprehensive website security testing skill for penetration testin
 | **XXE Testing** | Basic, Blind, DoS | ✅ Manual |
 | **OWASP Top 10** | A01-A10 complete | ✅ Checklist |
 | **SSL/TLS Audit** | Certificate & Ciphers | ✅ testssl.sh |
-| **Exposed Files** | .env, .git, backups, debug | ✅ **NEW** |
-| **CORS Security** | Misconfiguration tests | ✅ **NEW** |
-| **JWT Security** | Algorithm attacks, brute force | ✅ **NEW** |
-| **GraphQL Security** | Introspection, DoS, injection | ✅ **NEW** |
+| **Exposed Files** | .env, .git, backups, debug | ✅ Script |
+| **CORS Security** | Misconfiguration tests | ✅ Checklist |
+| **JWT Security** | Algorithm attacks, brute force | ✅ Checklist |
+| **GraphQL Security** | Introspection, DoS, injection | ✅ Checklist |
+| **API Security** | REST API testing, IDOR, rate limit | ✅ **NEW** |
+| **Subdomain Discovery** | Passive/Active enumeration | ✅ **NEW** |
+| **WebSocket Security** | CSWSH, hijacking, DoS | ✅ **NEW** |
+| **Cloud Metadata** | SSRF to AWS/GCP/Azure | ✅ **NEW** |
+| **Sensitive Data** | Credentials, PII exposure | ✅ **NEW** |
 | **Report Generation** | .md format | ✅ Auto |
 
 ---
@@ -42,13 +47,18 @@ This skill auto-loads when user mentions:
 - OWASP, OWASP Top 10
 - exposed files, .env, .git exposed
 - CORS, JWT, GraphQL security
+- API security, REST API, REST security
+- subdomain discovery, subdomain enumeration
+- WebSocket security, WS security
+- cloud metadata, SSRF, AWS metadata
+- sensitive data, credentials exposure, PII
 - "test keamanan", "cek security", "audit keamanan"
-- **"test skill", "check skill", "validate skill"**
-- **"skill health", "skill status", "skill diagnostics"**
+- "test skill", "check skill", "validate skill"
+- "skill health", "skill status", "skill diagnostics"
 
 ---
 
-## ⚡ COMPLETE TEST CHECKLIST (10+ Phases)
+## ⚡ COMPLETE TEST CHECKLIST (16 Phases)
 
 ### Phase 1: Reconnaissance
 ```
@@ -71,7 +81,7 @@ This skill auto-loads when user mentions:
 [ ] X-Powered-By (hide tech)
 ```
 
-### Phase 3: Exposed Files & Information Disclosure 🔴 **NEW**
+### Phase 3: Exposed Files & Information Disclosure 🔴
 ```
 [ ] .env file accessible?
 [ ] .git directory exposed?
@@ -81,33 +91,33 @@ This skill auto-loads when user mentions:
 [ ] Spring Boot Actuator endpoints
 [ ] API documentation exposed
 [ ] Log files accessible
-[ ] robots.txt (reveals paths)
-[ ] Security.txt endpoint
 ```
 
-### Phase 4: Port & Network Scanning
+### Phase 4: Subdomain Discovery 🔴 **NEW**
+```
+[ ] Passive recon (crt.sh, certspotter)
+[ ] DNS aggregators (SecurityTrails, VirusTotal)
+[ ] Active enumeration (subfinder, amass)
+[ ] DNS zone transfer
+[ ] Subdomain takeover detection
+```
+
+### Phase 5: Port & Network Scanning
 ```
 [ ] Full port scan (1-65535)
 [ ] Service version detection
-[ ] High-risk port exposure:
-    [ ] Port 3306 (MySQL)
-    [ ] Port 5432 (PostgreSQL)
-    [ ] Port 27017 (MongoDB)
-    [ ] Port 6379 (Redis)
-    [ ] Port 2375 (Docker)
-    [ ] Port 9200 (Elasticsearch)
+[ ] High-risk port exposure (3306, 5432, 6379, 2375)
 ```
 
-### Phase 5: SSL/TLS Audit
+### Phase 6: SSL/TLS Audit
 ```
 [ ] Certificate validity
 [ ] TLS version (no 1.0/1.1)
 [ ] Weak ciphers
 [ ] HSTS implementation
-[ ] OCSP stapling
 ```
 
-### Phase 6: Authentication Testing
+### Phase 7: Authentication Testing
 ```
 [ ] Brute force protection
 [ ] Password policy
@@ -116,7 +126,43 @@ This skill auto-loads when user mentions:
 [ ] Password reset flow
 ```
 
-### Phase 7: Injection Testing
+### Phase 8: API Security 🔴 **NEW**
+```
+[ ] REST API authentication
+[ ] IDOR (access other users' data)
+[ ] Rate limiting bypass
+[ ] Mass assignment
+[ ] API versioning issues
+```
+
+### Phase 9: WebSocket Security 🔴 **NEW**
+```
+[ ] Origin validation
+[ ] Cross-Site WebSocket Hijacking (CSWSH)
+[ ] Authentication in WebSocket
+[ ] Input validation in messages
+[ ] DoS via WebSocket
+```
+
+### Phase 10: Cloud Metadata (SSRF) 🔴 **NEW**
+```
+[ ] AWS EC2 metadata accessible?
+[ ] GCP metadata accessible?
+[ ] Azure metadata accessible?
+[ ] IAM credentials exposed
+[ ] SSRF to cloud takeover
+```
+
+### Phase 11: Sensitive Data Detection 🔴 **NEW**
+```
+[ ] API keys in source code
+[ ] AWS credentials exposed
+[ ] Private keys exposed
+[ ] PII in responses
+[ ] Credentials in URLs
+```
+
+### Phase 12: Injection Testing
 ```
 [ ] SQL Injection (5 types)
 [ ] XSS (4 types)
@@ -127,36 +173,33 @@ This skill auto-loads when user mentions:
 [ ] SSRF
 ```
 
-### Phase 8: CORS Security 🔴 **NEW**
+### Phase 13: CORS Security
 ```
 [ ] Wildcard origin check
 [ ] Credentials with wildcard
 [ ] Null origin allowed?
 [ ] Internal IPs allowed?
-[ ] Sensitive endpoints CORS
 ```
 
-### Phase 9: JWT Security 🔴 **NEW**
+### Phase 14: JWT Security
 ```
 [ ] Algorithm confusion (RS256→HS256)
 [ ] alg:none bypass
 [ ] Weak secret brute force
 [ ] Null signature accepted
-[ ] Token manipulation (exp, iat, sub)
-[ ] JWKS cache poisoning
+[ ] Token manipulation
 ```
 
-### Phase 10: GraphQL Security 🔴 **NEW**
+### Phase 15: GraphQL Security
 ```
 [ ] Introspection enabled?
-[ ] GraphQL IDE exposed
 [ ] Authorization bypass (IDOR)
 [ ] Batch query attack
 [ ] Depth-based DoS
 [ ] SQL/NoSQL Injection
 ```
 
-### Phase 11: OWASP Top 10 (A01-A10)
+### Phase 16: OWASP Top 10 (A01-A10)
 ```
 [ ] A01 - Broken Access Control
 [ ] A02 - Cryptographic Failures
@@ -170,38 +213,36 @@ This skill auto-loads when user mentions:
 [ ] A10 - SSRF
 ```
 
-### Phase 12: Business Logic & API
-```
-[ ] IDOR
-[ ] Privilege escalation
-[ ] Price manipulation
-[ ] API security (REST/GraphQL)
-[ ] Rate limiting
-```
-
 ---
 
 ## 🔧 TOOLS LOCATION
 
 ```
 skills/pentesting/
-├── SKILL.md                    # This file
+├── SKILL.md
 ├── checklists/
-│   ├── headers.md             # 9 headers detail
+│   ├── headers.md             # Security headers
 │   ├── owasp.md               # OWASP Top 10
 │   ├── ports.md               # Port scanning
-│   ├── injection.md           # All injection types
-│   ├── exposed-files.md       # 🔴 NEW - Exposed files
-│   ├── cors.md                # 🔴 NEW - CORS security
-│   ├── jwt.md                 # 🔴 NEW - JWT security
-│   └── graphql.md             # 🔴 NEW - GraphQL security
+│   ├── injection.md            # All injection types
+│   ├── exposed-files.md       # Exposed files detection
+│   ├── cors.md                # CORS security
+│   ├── jwt.md                 # JWT security
+│   ├── graphql.md             # GraphQL security
+│   ├── api-security.md        # 🔴 NEW - API security
+│   ├── subdomain.md           # 🔴 NEW - Subdomain discovery
+│   ├── websocket.md           # 🔴 NEW - WebSocket security
+│   ├── cloud-metadata.md      # 🔴 NEW - Cloud metadata/SSRF
+│   └── sensitive-data.md      # 🔴 NEW - Sensitive data detection
 ├── tools/
 │   ├── header-scan.sh         # Linux/Mac headers
 │   ├── header-scan.ps1        # Windows headers
-│   ├── exposed-files-scan.sh  # 🔴 NEW - Exposed files
-│   ├── exposed-files-scan.ps1 # 🔴 NEW - Exposed files
-│   ├── full-scan.sh           # 🔴 NEW - All-in-one Linux
-│   └── full-scan.ps1          # 🔴 NEW - All-in-one Windows
+│   ├── exposed-files-scan.sh  # Exposed files (Linux)
+│   ├── exposed-files-scan.ps1 # Exposed files (Windows)
+│   ├── full-scan.sh          # All-in-one (Linux)
+│   ├── full-scan.ps1          # All-in-one (Windows)
+│   ├── test-skill.sh          # Skill health check (Linux)
+│   └── test-skill.ps1         # Skill health check (Windows)
 └── reports/
     └── template.md            # Report template
 ```
@@ -210,66 +251,28 @@ skills/pentesting/
 
 ## 🚀 QUICK COMMANDS
 
-### Skill Health Check 🔴 **NEW**
-```bash
-# Windows PowerShell
-.\tools\test-skill.ps1
-.\tools\test-skill.ps1 -Verbose
-
-# Linux/Mac
-chmod +x tools/test-skill.sh
-./tools/test-skill.sh
-```
-
 ### Security Headers
 ```bash
-# Linux/Mac
-chmod +x tools/header-scan.sh
-./tools/header-scan.sh https://target.com
-
-# Windows PowerShell
 .\tools\header-scan.ps1 -Target https://target.com
+./tools/header-scan.sh https://target.com
 ```
 
-### Exposed Files Scan 🔴 NEW
+### Exposed Files Scan
 ```bash
-# Linux/Mac
-chmod +x tools/exposed-files-scan.sh
-./tools/exposed-files-scan.sh https://target.com
-
-# Windows PowerShell
 .\tools\exposed-files-scan.ps1 -Target https://target.com
+./tools/exposed-files-scan.sh https://target.com
 ```
 
-### Full Security Scan (All-in-One) 🔴 NEW
+### Full Security Scan (All-in-One)
 ```bash
-# Linux/Mac
-chmod +x tools/full-scan.sh
-./tools/full-scan.sh https://target.com
-
-# Windows PowerShell
 .\tools\full-scan.ps1 -Target https://target.com
+./tools/full-scan.sh https://target.com
 ```
 
-### Port Scanning
-```bash
-nmap -sV -p 21,22,80,443,3306,5432,8080 target.com
-nmap -p- -sV target.com
-```
-
-### Vulnerability Scanning
+### Skill Health Check
 ```bash
-# Nuclei
-nuclei -u https://target.com
-
-# SQLMap
-sqlmap -u "https://target.com/search?q=1" --batch
-
-# Dalfox XSS
-dalfox url https://target.com/search?q=test
-
-# Commix
-commix -u "http://target.com/ping?ip=127.0.0.1"
+.\tools\test-skill.ps1
+./tools/test-skill.sh
 ```
 
 ---
@@ -321,8 +324,12 @@ F (0-29):   Critical
 - "test CORS" → Load CORS checklist
 - "test JWT" → Load JWT checklist
 - "test GraphQL" → Load GraphQL checklist
-- **"test skill" / "check skill" / "validate skill"** → Run skill health check
-- **"skill status" / "skill health"** → Show skill installation status
+- "test API security" → Load API security checklist 🔴 **NEW**
+- "test subdomain" → Load subdomain discovery 🔴 **NEW**
+- "test WebSocket" → Load WebSocket security 🔴 **NEW**
+- "test cloud metadata" → Load cloud metadata checklist 🔴 **NEW**
+- "test sensitive data" → Load sensitive data checklist 🔴 **NEW**
+- "test skill" / "check skill" → Run skill health check
 
 ---
 
@@ -338,20 +345,20 @@ User: "security audit untuk target.com"
 User: "check exposed files di website ini"
 → Run exposed files scan → site/target.com-exposed-2025-07-05.md
 
-User: "test CORS di api.target.com"
-→ Run CORS security tests
+User: "test API security"
+→ Run API security tests → checklists/api-security.md
 
-User: "audit JWT security"
-→ Run JWT security checklist
+User: "subdomain enumeration untuk target.com"
+→ Run subdomain discovery → checklists/subdomain.md
 
-User: "GraphQL security check"
-→ Run GraphQL security tests
+User: "test SSRF"
+→ Load cloud metadata/SSRF checklist
 
-User: "test skill"
-→ Run skill health check → Show test results
+User: "check sensitive data exposure"
+→ Load sensitive data detection checklist
 
-User: "validate skill installation"
-→ Verify all files exist → Show skill status
+User: "test skill"
+→ Run skill health check
 ```
 
 ---
@@ -359,6 +366,9 @@ User: "validate skill installation"
 ## ✅ SKILL READY
 
 **Status:** ACTIVE & READY FOR USE
-**Version:** 3.0
+**Version:** 4.0
 **Author:** Rz (@soulofzephir)
 **Last Updated:** 2025-07-05
+**Checklists:** 13
+**Tools:** 8
+**Health Score:** 95%+

package/skills/pentesting/checklists/api-security.md

@@ -0,0 +1,210 @@
+# API Security Checklist
+
+## 🔍 What is API Security?
+
+APIs expose application logic and sensitive data. Testing requires understanding authentication, authorization, and input validation.
+
+---
+
+## ⚠️ Common API Vulnerabilities
+
+### 1. Broken Object Level Authorization (BOLA/IDOR)
+```
+Risk: Users access other users' resources
+Test: Change ID in request parameter
+```
+
+### 2. Broken Authentication
+```
+Risk: Session management flaws
+Test: Token manipulation, JWT attacks
+```
+
+### 3. Excessive Data Exposure
+```
+Risk: API returns more data than needed
+Test: Analyze all response fields
+```
+
+### 4. Lack of Resources & Rate Limiting
+```
+Risk: DoS, brute force
+Test: Send many requests, measure throttling
+```
+
+### 5. Mass Assignment
+```
+Risk: Modify protected fields
+Test: Add unexpected fields to request
+```
+
+---
+
+## 🧪 Testing Checklist
+
+### Phase 1: Discovery
+- [ ] API endpoints identified
+- [ ] HTTP methods discovered (GET, POST, PUT, DELETE, PATCH)
+- [ ] Authentication method identified (Bearer, API Key, OAuth, JWT)
+- [ ] Content-Type identified (JSON, XML, form-data)
+- [ ] Versioning detected (v1, v2, /api/)
+
+### Phase 2: Authentication Testing
+- [ ] API key exposure in URL (should be in header)
+- [ ] Bearer token manipulation
+- [ ] JWT attacks (alg confusion, none, weak secret)
+- [ ] Session fixation
+- [ ] Token expiration bypass
+- [ ] Password reset via API
+- [ ] MFA bypass attempts
+
+### Phase 3: Authorization Testing
+- [ ] Horizontal privilege escalation (access other users)
+- [ ] Vertical privilege escalation (admin access)
+- [ ] IDOR in resource endpoints
+- [ ] Parameter manipulation
+- [ ] Path traversal in URLs
+
+### Phase 4: Input Validation
+- [ ] SQL Injection
+- [ ] NoSQL Injection (MongoDB operators)
+- [ ] Command Injection
+- [ ] XSS (in JSON responses)
+- [ ] XML Injection (if XML API)
+- [ ] JSON Manipulation
+
+### Phase 5: Rate Limiting
+- [ ] Rate limit present?
+- [ ] Bypass via header manipulation (X-Forwarded-For)
+- [ ] Bypass via IP rotation
+- [ ] Bypass via user-agent rotation
+- [ ] Business logic abuse (coupon reuse, price manipulation)
+
+### Phase 6: Business Logic
+- [ ] Workflow bypass
+- [ ] Race condition
+- [ ] Mass assignment
+- [ ] Insufficient workflow validation
+- [ ] Time-based logic abuse
+
+### Phase 7: Data Exposure
+- [ ] Sensitive data in responses (PII, passwords, tokens)
+- [ ] Stack traces in errors
+- [ ] Debug endpoints exposed
+- [ ] Verbose logging
+- [ ] Default/error messages leak info
+
+### Phase 8: Configuration
+- [ ] CORS misconfiguration
+- [ ] HTTP methods enabled (TRACE, OPTIONS)
+- [ ] SSL/TLS issues
+- [ ] Security headers missing
+- [ ] Sensitive fields in Swagger/OpenAPI
+
+---
+
+## 🔧 Common API Payloads
+
+### SQL Injection
+```json
+{"id": "1 OR 1=1"}
+{"id": "1' OR '1'='1"}
+{"id": "1; DROP TABLE users--"}
+```
+
+### NoSQL Injection
+```json
+{"id": {"$ne": null}}
+{"id": {"$gt": ""}}
+{"username": {"$regex": ".*"}}
+{"password": {"$ne": ""}}
+```
+
+### Mass Assignment
+```json
+{"user_id": 123, "role": "admin"}
+{"price": 1, "admin": true}
+```
+
+### Bypass Rate Limiting
+```bash
+# Via X-Forwarded-For
+curl -H "X-Forwarded-For: 1.2.3.4" api.target.com
+
+# Via X-Real-IP
+curl -H "X-Real-IP: 1.2.3.4" api.target.com
+
+# Via X-Originating-IP
+curl -H "X-Originating-IP: 1.2.3.4" api.target.com
+```
+
+### IDOR Tests
+```bash
+# Change user ID
+GET /api/users/123/profile
+GET /api/users/124/profile
+
+# Change resource ID
+GET /api/orders/1001
+GET /api/orders/1002
+
+# Change UUID
+GET /api/documents/abc-123
+GET /api/documents/abc-124
+```
+
+---
+
+## 🛠️ Tools
+
+```bash
+# Burp Suite (Recommended)
+# - Intruder for fuzzing
+# - Repeater for testing
+# - Active Scanner
+
+# sqlmap for API SQLi
+sqlmap -u "https://api.target.com/users?id=1" --level=5 --risk=3
+
+# ffuf for fuzzing
+ffuf -w wordlist.txt -u https://api.target.com/FUZZ
+
+# JWT attacks
+python -m jwt_tool <JWT> -T
+hashcat -a 0 -m 16500 jwt.txt wordlist.txt
+
+# API enumeration
+nmap --script=http-enum api.target.com
+```
+
+---
+
+## 📋 API Security Score
+
+| Area | Score | Weight |
+|------|-------|--------|
+| Authentication | /20 | High |
+| Authorization | /20 | Critical |
+| Rate Limiting | /15 | High |
+| Input Validation | /15 | Critical |
+| Data Exposure | /15 | High |
+| Configuration | /15 | Medium |
+
+**Total: /100**
+
+---
+
+## 🛡️ Secure API Checklist
+
+- [ ] JWT with strong secret (HS256 min 256-bit)
+- [ ] Token expiration set
+- [ ] Proper authorization on every endpoint
+- [ ] Rate limiting enabled
+- [ ] Input validation on all parameters
+- [ ] Sensitive data not in responses
+- [ ] Security headers set
+- [ ] CORS properly configured
+- [ ] No verbose errors in production
+- [ ] API versioning
+- [ ] Logging without sensitive data
+- [ ] HTTPS only