Pentest-Skills

A collection of modular penetration testing skills designed for AI CLI tools (Claude Code / Gemini CLI).

English | 简体中文

---

Overview

💡 Core Philosophy

Forget complex command lines. Complete professional penetration testing with natural language.

Simply describe your testing objectives, and Claude Code will automatically select the right tools, execute commands, and analyze results.

---

Pentest-Skills provides atomic-level capabilities for penetration testing workflows. Each skill contains:

• Knowledge Documentation - Command templates and tool usage guides
• Helper Scripts - Python/Bash scripts for automation
• Reference Docs - Comprehensive tool documentation
• Asset Files - Wordlists, payloads, and resources

Quick Start

1️⃣ Install Claude Code

Before using the skills from this project, you need to install Claude Code or another AI Coding tool. Install using the official script:

# macOS, Linux, WSL:
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell:
irm https://claude.ai/install.ps1 | iex

# Windows CMD:
curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

After installation, verify:

claude --version

If a version number is displayed, the installation is successful!

Claude Code Official Installation Guide: https://code.anthropic.com/docs Claude Code Beginner Tutorial: https://www.runoob.com/claude-code/claude-code-install.html Skills Getting Started Tutorial: https://www.runoob.com/claude-code/claude-agent-skills.html

2️⃣ Install Skills

# git clone the project to local
git clone https://github.com/crazyMarky/pentest-skills.git

# Enter the project directory
cd pentest-skills

Copy skills to your .claude/skills/ directory:

# Copy all skills to your project's .claude/skills/ directory
cp -r * ~/.claude/skills/

Restart your IDE for the skills to be loaded.

3️⃣ Start Testing

Open Claude Code and describe your testing needs in natural language:

You: Scan localhost for open ports and analyze service versions

Simply describe in natural language, and the port scanning skill will be triggered automatically. The scan results will automatically analyze service versions.

That's it!

---

Skills

Information Gathering (Recon)

Skill	Description	Tools
recon-port-scan	Port scanning and service identification	nmap, masscan, rustscan
recon-subdomain	Subdomain enumeration and DNS reconnaissance	subfinder, amass, dnsx
recon-dir-scan	Directory and file enumeration	ffuf, gobuster, feroxbuster
recon-fingerprint	Web fingerprinting and WAF detection	wafw00f, whatweb, nuclei, httpx

Exploitation

Skill	Description	Tools
exploit-sqli	SQL injection detection and exploitation	sqlmap, manual injection techniques
exploit-xss	Cross-site scripting detection (Reflected/Stored/DOM/Blind)	XSStrike, Dalfox, XSpear
exploit-lfi	Local file inclusion and directory traversal	Path traversal payloads, log injection
exploit-file-download	Unsafe file download and path traversal	Encoding bypass, sensitive file scanning

---

✨ Why Choose Claude Code + Pentest-Skills?

Traditional Approach	Claude Code Approach
Need to memorize many tools and parameters	Describe needs in natural language
Manually combine multiple tools	AI automatically selects optimal toolchain
Manually analyze raw output	AI automatically generates analysis reports
Requires expertise	Lowers barrier to entry
Time-consuming and error-prone	Fast and accurate

In short: You discover problems, AI does the work.

Results Showcase

Port Scan Report Example

╔═══════════════════════════════════════════════════════╗
║              Nmap Scan Analysis Report                 ║
╠═══════════════════════════════════════════════════════╣
║ Target: 192.168.1.100                                 ║
║ Scan Time: 2025-02-07 12:30:45                        ║
║ Open Ports: 3                                          ║
╚═══════════════════════════════════════════════════════╝

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu
80/tcp  open  http     nginx 1.18.0
443/tcp open  https    nginx 1.18.0

Potential Risks:
  [!] SSH may be vulnerable to weak password attacks
  [!] HTTP can be upgraded to HTTPS
  [!] Recommended to check SSL certificate configuration

Subdomain Discovery Report Example

╔═══════════════════════════════════════════════════════╗
║         Subdomain Enumeration Report                   ║
╠═══════════════════════════════════════════════════════╣
║ Target Domain: example.com                             ║
║ Discovery Time: 2025-02-07 14:20:33                   ║
║ Total Subdomains: 1243                                 ║
╚═══════════════════════════════════════════════════════╝

High-Value Targets:
  ★ admin.example.com → 192.168.1.10 (Admin Panel)
  ★ api.example.com → 192.168.1.20 (API Endpoint)
  ★ dev.example.com → 192.168.1.30 (Development Environment)

Cloud Services Identified:
  - AWS: 234 subdomains
  - Cloudflare: 456 subdomains
  - Azure: 89 subdomains

Directory Scanning Report Example

╔═══════════════════════════════════════════════════════╗
║         Directory Scanning Report                      ║
╠═══════════════════════════════════════════════════════╣
║ Target: http://example.com                             ║
║ Scan Time: 2025-02-07 16:45:12                        ║
║ Directories Found: 156                                 ║
╚═══════════════════════════════════════════════════════╝

High-Value Discoveries:
  [200] /admin           → Admin Panel (authentication required)
  [200] /api/v1          → API Documentation
  [200] /uploads         → File Upload Directory
  [403] /.git            → Git Repository Exposure Risk
  [403] /backup          → Backup Directory (may contain sensitive files)

Status Code Distribution:
  200: 23 (accessible)
  301: 45 (redirects)
  403: 67 (forbidden - may contain sensitive information)
  404: 14899 (not found)

Recommendations:
  [!] Check /.git and /.svn for source code disclosure
  [!] /uploads directory may have arbitrary file upload vulnerability
  [!] /admin should use strong passwords and 2FA

Skill Structure

skill-name/
├── SKILL.md              # Core documentation (AI trigger)
├── scripts/              # Helper scripts
├── references/           # Detailed documentation
└── assets/               # Wordlists and resources

Requirements

Each skill documents its required tools. Common requirements:

• nmap - Port scanning
• subfinder - Subdomain enumeration
• dnsx - DNS resolution
• ffuf - Directory and file fuzzing
• (Optional) masscan, amass, rustscan, dirsearch, gobuster, etc.

Installing Tools

# Install subdomain enumeration tools
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

# Install directory scanning tools
go install -v github.com/ffuf/ffuf/v2/cmd/ffuf@latest

# Install port scanning tools
# Ubuntu/Debian
sudo apt install nmap

# macOS
brew install nmap

FAQ

Q: Are these tools safe? A: All scripts are open source for your review. The tools contain no malicious functionality.

Q: Can I use this in production? A: Only for authorized security testing. Unauthorized testing is illegal.

Q: How do I protect my privacy? A: Be careful with target information and don't share test results publicly.

Q: Must I use Claude Code? A: Claude Code is recommended for the best experience, but other compatible AI CLI tools are also supported.

License

Apache License 2.0 - see LICENSE for details.

Contributing

Contributions are welcome! Please:

1. Follow the existing skill structure
2. Include comprehensive documentation
3. Test scripts before submitting
4. Use English for SKILL.md (AI triggering)

---

⚠️ Legal Disclaimer & Terms of Use

This toolkit is intended for authorized security testing and educational purposes only.

Before using these tools, you must:

• Obtain written permission from the target system owner
• Comply with all applicable laws and regulations in your jurisdiction
• Use only for authorized penetration testing, CTF competitions, security research, or authorized testing
• Take full responsibility for your actions and consequences

Prohibited Activities

• Scanning or attacking any system without authorization
• Destructive testing on production environments
• Any illegal or malicious activities

Important Notice: Unauthorized computer system access may violate criminal laws and could result in prosecution.

---

By using this toolkit, you agree to the above terms. If you do not agree, do not use.