# Essential Tools

Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary...

- Repository: https://github.com/transilienceai/communitytools (600 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-07-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add transilienceai/communitytools --skill essential-tools -g -a claude-code -y`
Codex: `npx skills add transilienceai/communitytools --skill essential-tools -g -a codex -y`
Cursor: `npx skills add transilienceai/communitytools --skill essential-tools -g -a cursor -y`
Gemini CLI: `npx skills add transilienceai/communitytools --skill essential-tools -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add transilienceai/communitytools`

## Description

Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Essential Tools

Core tools, methodology, and reporting standards for penetration testing.

## Components

| Component | Purpose |
|-----------|---------|
| **Burp Suite** | Proxy, scanner, intruder, repeater, sequencer |
| **Playwright** | Browser automation, evidence capture, SPA testing |
| **Binary Analysis** | Static analysis, reverse engineering, string extraction |
| **Nuclei** | Templated exposure & misconfiguration scanning |
| **sslscan** | TLS posture (protocols, ciphers, cert) |
| **Methodology** | PTES, OWASP WSTG, attack prioritization |
| **Reporting** | Professional report templates, PDF generation |

## Reference

- `reference/essential-skills*.md` - Burp Suite techniques and web security testing methodology
- `reference/playwright-automation.md` - Playwright MCP usage for pentesting
- `reference/binary-analysis-quickstart.md` - Static analysis for executable files and reverse engineering
- `reference/web-application-attacks.md` - Web application attack methodology
- `formats/transilience-report-style/pentest-report.md` - Finding quality standards, compliance mapping, and pre-delivery checklist

## Required-at-start tooling (web/API engagements)

Run an availability check before declaring recon complete:

`command -v subfinder nuclei sslscan httpx; curl -s "https://crt.sh/?q=%25.${DOMAIN}&output=json" | head -c1`

- Subdomain/CT enum: subfinder, certspotter, crt.sh
- TLS posture: sslscan
- Templated exposure: nuclei

If a tool-class is unavailable, record it as an explicit limitation, NEVER declare recon COMPLETE having skipped a whole class. Hand-rolled urllib is not a substitute (see skills/coordination/reference/principles.md 'Real tools before hand-rolled HTTP').