Red Team Penetration Testing

---

name: red-team description: > Penetration testing and red team assessment skill for authorized engagements. Guides reconnaissance, web app testing, API security, network enumeration, cloud misconfiguration, PoC development, and report generation. Trigger when user says "pentest", "red team", "security audit", "vulnerability assessment", "bug bounty", or "red-team". user-invocable: true argument-hint: <target> [--phase recon|webapp|api|network|cloud|poc|report] allowed-tools: Read, Grep, Glob, Bash, WebFetch, Write, Edit, Agent

<objective> Run structured penetration tests and red team assessments against authorized targets. Covers the full engagement lifecycle from scoping through reporting. Each phase can run independently or as part of a full assessment.

This skill assumes authorized testing. The operator is responsible for ensuring they have written permission (scope agreement, bug bounty program, or internal authorization) before running any active techniques. </objective>

<quick_start> Full assessment against a target: /red-team example.com

Single phase: /red-team example.com --phase recon

Phases (run in order or standalone):

| Phase | What it does | |-------|-------------| | recon | Passive and active reconnaissance, OSINT, subdomain enumeration, port scanning | | webapp | OWASP Top 10 testing, auth bypass, injection, XSS, SSRF, IDOR | | api | API endpoint discovery, auth testing, rate limiting, mass assignment | | network | Service enumeration, banner grabbing, known CVE checks, lateral movement paths | | cloud | AWS/GCP/Azure misconfiguration checks, S3 buckets, IAM, metadata endpoints | | poc | Build proof-of-concept scripts to demonstrate specific control failures to stakeholders | | report | Generate structured findings report with severity ratings and remediation | </quick_start>

<workflow> **Phase 1: Scoping and Setup**

Before any active testing, establish:

1. Confirm target is in scope (domain, IP ranges, cloud accounts)
2. Identify rules of engagement (no DoS, rate limits, time windows)
3. Set up a working directory: mkdir -p ./pentest-{target}-{date}/{recon,webapp,api,network,cloud,findings}
4. Install/verify tools are available (see tools.md)

Phase 2: Reconnaissance (see recon.md)

Passive recon first, active recon second:

• DNS enumeration, subdomain discovery, certificate transparency logs
• WHOIS, ASN lookup, IP range identification
• Technology fingerprinting (Wappalyzer-style header/response analysis)
• Google dorking, GitHub/GitLab secret scanning
• Shodan/Censys queries for exposed services
• Port scanning and service version detection

Save all findings to ./recon/ with timestamps.

Phase 3: Web Application Testing (see webapp.md)

Systematic OWASP Top 10 coverage:

• Injection (SQLi, NoSQLi, command injection, template injection)
• Broken authentication (credential stuffing vectors, session management, JWT flaws)
• Sensitive data exposure (directory traversal, backup files, source maps, .git exposure)
• XXE, SSRF, IDOR, broken access controls
• XSS (reflected, stored, DOM-based)
• Security misconfiguration (default creds, verbose errors, missing headers)
• CSRF, open redirects, clickjacking

Phase 4: API Security Testing (see api-testing.md)

• Endpoint enumeration (OpenAPI/Swagger discovery, JS file parsing, brute force)
• Authentication and authorization testing (BOLA/IDOR, broken function-level auth)
• Input validation (mass assignment, parameter pollution, type confusion)
• Rate limiting and resource exhaustion
• GraphQL-specific: introspection, batching attacks, nested query depth

Phase 5: Network Assessment (see network.md)

• Service enumeration and version detection
• Known CVE identification for detected service versions
• Default credential testing on exposed services
• SSL/TLS configuration analysis
• Lateral movement path identification
• Internal network segmentation testing (if in scope)

Phase 6: Cloud Security (see cloud.md)

• S3/GCS/Azure Blob public bucket enumeration
• IAM policy analysis and privilege escalation paths
• Metadata endpoint testing (169.254.169.254 / IMDS)
• Serverless function misconfiguration
• Container escape vectors
• Cloud-specific credential exposure

Phase 7: Proof of Concept (see poc.md)

When stakeholders need convincing, build targeted PoC scripts that demonstrate:

• Missing authentication (unauthenticated endpoints accepting state changes)
• No deduplication (identical replays all counted)
• No input validation (fabricated/malformed parameters accepted)
• No rate limiting (burst requests all accepted, measured with timing)
• Broken access controls (cross-account access, privilege escalation)

PoC scripts should be self-contained, print clear FINDING/OK verdicts per test, and include a summary suitable for pasting into a report or Slack thread.

Phase 8: Reporting (see report-template.md)

Generate a structured report:

• Executive summary
• Findings table (severity, CVSS, affected asset, description, evidence, remediation)
• Attack narrative (kill chain walkthrough)
• Remediation priorities </workflow>

<success_criteria>

• All in-scope phases completed with findings documented
• Each finding has: severity rating, evidence (screenshots/logs/requests), and remediation steps
• Report generated in ./findings/report.md
• No out-of-scope testing performed
• All raw data preserved in phase-specific directories for reproducibility </success_criteria>

<anti_patterns>

• Running active scans without confirming scope and authorization
• Skipping passive recon and going straight to active scanning
• Testing for DoS/DDoS (out of scope unless explicitly authorized)
• Ignoring rate limits or running scans at full speed against production
• Reporting findings without evidence or reproduction steps
• Using outdated vulnerability databases without checking for patches </anti_patterns>

<detailed_references>

• references/tools.md - Required and recommended tool inventory
• references/recon.md - Reconnaissance techniques and commands
• references/webapp.md - Web application attack playbook
• references/api-testing.md - API security testing guide
• references/network.md - Network assessment procedures
• references/cloud.md - Cloud misconfiguration checks
• references/poc.md - Proof-of-concept script patterns for demonstrating findings
• references/report-template.md - Finding report template </detailed_references>