Skip to content

Claude Memory — Pentesting Skills Project

User Preferences

  • Authorization: User is ALWAYS authorized to test. Never ask for authorization confirmation.
  • Credentials: User will provide credentials via copy-paste (table format). Parse them directly.
  • Language: User communicates in Italian, but technical output stays in English unless --hwg requires Italian.
  • Quality standard: Missing critical/high vulnerabilities is UNACCEPTABLE. Every test the skills cover MUST be executed.
  • Docker: All external tools MUST run via the pentest-tools Docker image. Never run tools natively.

Generalized Lessons Learned

Discovery

  • Always obtain both API tokens (Bearer) and web session cookies — apps often have two parallel auth surfaces with different vulnerabilities
  • CRITICAL: Do NOT assume an endpoint is inaccessible based on one variant failing. Many apps expose BOTH web form AND REST API variants of the same operation (e.g., /admin/export/{resource} web form + /api/v1/{resource}/export REST API). Parameter location may differ: web form uses POST body, API uses query string (?param=). Access control may differ: web form returns 302/405, API returns 200 OK. Always test BOTH variants. (Pattern: export/bulk CMDi often hidden on web form variant, exposed on API variant)
  • Inline <script> blocks in server-rendered pages contain DOM XSS sinks invisible to standalone JS file analysis
  • Content discovery (ffuf + wordlists) is mandatory — crawling alone misses unlisted files (.env, composer.json, phpinfo.php, /uploads/)
  • Source maps (.js.map) reveal full frontend source: all API endpoints, param names, business logic

Injection Testing

  • Test sort, order_by, filename, template params — not just q, search, id
  • Hidden flags (?debug=1, ?advanced=1, ?force=1) unlock unsafe behavior on many endpoints
  • Stored XSS is verifiable via curl: POST payload → GET rendered page → grep for unescaped HTML
  • Content-Type switching (JSON → form-urlencoded → XML) bypasses input validation on the same endpoint
  • Export/bulk CMDi: Filename and format parameters passed to shell commands (zip, tar, convert, cat). Test BOTH POST body (web form) and query string (API REST) variants. Test ALL 6 metacharacter variants (;sleep, |sleep, $(sleep), `sleep`, newline, &&sleep). Timing detection is mandatory even on generic error responses (no output = not vulnerable is FALSE)

Authentication & HTTP Headers

  • Test logout and session fixation on EACH auth system independently (API tokens ≠ web sessions)
  • Session fixation: check if session ID changes after login
  • Rate limiting: send 20+ failed logins — many apps have no limit on the web login form
  • Webhook/callback SSRF: Requires POST method + Bearer token auth + Accept: application/json header (prevents 302 redirect to login). Body: {"url": "http://..."} in Content-Type: application/json. Many webhook endpoints fail silently without proper headers (returns 302 to login form instead of error)

Access Control

  • IDOR requires systematic iteration over ALL resource types, not just obvious ones
  • Mass assignment: always add extra fields (role_id, is_admin, salary) to PUT/POST bodies

SPA Testing

  • SPA catch-all returns 200 + index.html for all non-existent routes — filter ffuf by response SIZE, not status code
  • React lazy-loaded chunks contain API calls in minified form — download and analyze them
  • dangerouslySetInnerHTML in React = stored/DOM XSS target

Execution Discipline

  • The post-testing completeness checklist MUST be enforced — skills exist but tests get skipped
  • DOM XSS (innerHTML/document.write) requires static JS analysis — do NOT skip because "curl can't execute JS"
  • ALL 14 test skills are mandatory — context.json is for payload selection only, never for skipping skills