Common Pentest Methodology
PTES-aligned penetration testing methodology for backend, frontend, and mobile.
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-pentest-methodology -g -a claude-code -y- Repository
- HoangNguyen0403/agent-skills-standard582
- Category
- Design
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 985 tokens
- Runs scripts
- No, instructions only
What it does
PTES-aligned penetration testing methodology for backend, frontend, and mobile. Provides attack taxonomy, exploit techniques per vulnerability class, and platform-specific test matrices. Use when executing pentest workflow, planning security assessments, mapping attack surfaces, or building threat models.
Penetration Testing Methodology (PTES-Aligned)
Priority: P0 (CRITICAL)
Always-Apply Rules
- No Exploit = No Report: Every finding requires reproducible Proof-of-Concept. Hypotheses without PoC are discarded.
- No Production Testing: All dynamic probes target local/staging only. Confirm authorization before Phase 1.
- No Single-Platform Bias: Assess backend, frontend, AND mobile surfaces when in-scope.
Workflow
Load alongside /pentest workflow. Provides methodology backbone for all 7 phases.
- Scope → Define test mode (whitebox/greybox/blackbox), platforms, exclusions.
- Recon → Build asset inventory per platform. See platform-recon.
- Threat Model → Rank endpoints by risk. See threat-modeling.
- Analyze → Run vulnerability matrix across all domains. Load
common-owasp,common-security-audit,common-dast-tooling. - Exploit → Validate each finding with PoC. See exploit-techniques.
- Post-Exploit → Assess blast radius, lateral movement, privilege escalation.
- Report → Audit-grade output with CVSS scoring. See report-template and compliance-mapping.
