Pentest Checklist
Should be used when the user asks to "plan a penetration test", "create a security...
Install
npx skills add zebbern/claude-code-guide --skill pentest-checklist -g -a claude-code -y- Repository
- zebbern/claude-code-guide4.7k
- Category
- Testing
- Updated
- 4d ago
- License
- MIT
- Context cost
- Mediumabout 2,453 tokens
- Runs scripts
- No, instructions only
What it does
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.
Pentest Checklist
Purpose
Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.
Inputs/Prerequisites
- Clear business objectives for testing
- Target environment information
- Budget and timeline constraints
- Stakeholder contacts and authorization
- Legal agreements and scope documents
Outputs/Deliverables
- Defined pentest scope and objectives
- Prepared testing environment
- Security monitoring data
- Vulnerability findings report
- Remediation plan and verification
Core Workflow
Phase 1: Scope Definition
Define Objectives
- Clarify testing purpose - Determine goals (find vulnerabilities, compliance, customer assurance)
- Validate pentest necessity - Ensure penetration test is the right solution
- Align outcomes with objectives - Define success criteria
Reference Questions:
- Why are you doing this pentest?
- What specific outcomes do you expect?
- What will you do with the findings?
Know Your Test Types
| Type | Purpose | Scope |
|---|---|---|
| External Pentest | Assess external attack surface | Public-facing systems |
| Internal Pentest | Assess insider threat risk | Internal network |
| Web Application | Find application vulnerabilities | Specific applications |
| Social Engineering | Test human security | Employees, processes |
| Red Team | Full adversary simulation | Entire organization |
Enumerate Likely Threats
- Identify high-risk areas - Where could damage occur?
- Assess data sensitivity - What data could be compromised?
- Review legacy systems - Old systems often have vulnerabilities
- Map critical assets - Prioritize testing targets
