Penetration Test Auto

Conduct systematic penetration testing following OWASP and NIST methodologies, covering reconnaissance, vulnerability assessment, exploitation testing, and remediation reporting.

When to Use This Command

Run this command when...

• You need to perform a security assessment of your web application or API before a production deployment
• You want to test for OWASP Top 10 vulnerabilities including injection, broken authentication, and XSS
• You need to evaluate authentication mechanisms, session management, and authorization bypass vectors
• You want automated reconnaissance followed by targeted manual testing with proof-of-concept documentation
• You need a penetration test report with severity ratings and prioritized remediation recommendations

Quick Start

Copy
# .claude/commands/penetration-test-auto.yaml
name: Penetration Test Auto
description: Automated penetration testing with OWASP methodology
inputs:
  - name: target
    description: "Test target: web, api, auth, or comprehensive"
    default: "comprehensive"

Copy
# Run comprehensive penetration test
claude "penetration-test-auto --target comprehensive"

# Focus on authentication testing
claude "penetration-test-auto --target auth"

# Test API endpoints specifically
claude "penetration-test-auto --target api"

Output:
  [recon] Service discovery: 3 listening ports
  [recon] Technology: Express.js 4.18, Node.js 20
  [scan] Testing OWASP Top 10 categories...
  Findings:
    CRITICAL: SQL injection in /api/search (parameterized fix needed)
    HIGH:     Missing rate limiting on /api/login
    MEDIUM:   CORS wildcard allows any origin
    LOW:      Server version exposed in headers
  [report] 4 findings documented with PoC examples
  Done. Report saved to security-report.md

Core Concepts

Concept	Description
Reconnaissance	Service discovery, technology fingerprinting, and attack surface mapping before testing begins
OWASP Top 10	Systematic testing for injection, broken auth, XSS, CSRF, insecure deserialization, and more
Proof of Concept	Each finding includes a reproducible example demonstrating the vulnerability
Risk Rating	Findings scored by severity (Critical/High/Medium/Low) using CVSS-aligned methodology
Remediation Roadmap	Prioritized fix recommendations with code examples and implementation guidance

Testing Phases:
  Phase 1         Phase 2           Phase 3         Phase 4
  ┌──────────┐   ┌──────────────┐  ┌───────────┐  ┌──────────┐
  │  Recon   │──>│ Vulnerability│─>│ Exploit   │─>│  Report  │
  │  & Map   │   │  Assessment  │  │ Testing   │  │ & Fixes  │
  └──────────┘   └──────────────┘  └───────────┘  └──────────┘
   - Ports        - OWASP Top 10    - XSS PoC      - Severity
   - Tech stack   - Input fuzzing   - SQLi PoC      - Remediation
   - Endpoints    - Auth review     - Escalation    - Code fixes

Configuration

Parameter	Type	Default	Description
target	string	"comprehensive"	Focus area: web, api, auth, infrastructure, or comprehensive
depth	string	"standard"	Testing depth: quick (top vulnerabilities), standard, or deep (exhaustive)
output	string	"security-report.md"	Report output file path and format
safe_mode	boolean	true	Avoid destructive tests that could corrupt data or crash services
methodology	string	"owasp"	Testing framework: owasp, nist, or ptes

Best Practices

1. Always test in a staging environment -- Never run penetration tests against production systems. Use a staging environment that mirrors production configuration and data.
2. Enable safe mode for shared environments -- The --safe-mode flag prevents destructive tests like data deletion or service crashes that could affect other developers or users.
3. Test after every major feature -- Run focused tests (e.g., --target auth) after implementing authentication changes rather than waiting for a full comprehensive test.
4. Document and track findings -- Treat each finding as a ticket. Create issues for every vulnerability and track remediation progress through your project management system.
5. Retest after fixes -- After applying remediation, re-run the specific test category to confirm the vulnerability is resolved and no regressions were introduced.

Common Issues

1. Services not running -- The command needs active services to test. Start your application and dependent services before running penetration tests.
2. False positives from framework defaults -- Some frameworks include default error pages or headers that trigger warnings. Verify findings against your actual configuration before treating them as vulnerabilities.
3. Insufficient permissions for infrastructure tests -- Container and network security tests may require elevated permissions. Run with appropriate access or focus on application-layer testing with --target web.