claude-pentest-skills - AI-powered web application penetration testing ski

项目说明

<di="center">

Claude Pentest Skills

Structured Web Application Penetration Testing with Claude Code

*OWASP-based methodology, curated payload references, strict gates, and report generation — all orchestrated through slash commands.*

<br>

![Claude Code]()
![OWASP WSTG]()

<br>

<a href="#-quick-start">Quick Start</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#-how-it-works">How It Works</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#-commands">Commands</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#-">Co</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#-project-structure">Structure</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#-contributing">Contributing</a>

<br>

</div>

<br>

---

<br>

The Problem

Pentesting with AI is powerful, but without structure it's chaotic:

<br>

The Solution

Claude Pentest Skills is a structured skill pack for Claude Code. It enforces scope, follows OWASP methodology, findings through a 6-gate quality process, and generates professional reports — all through simple slash commands.

<br>

<di="center">

| Before | After |
|:---|:---|
| Ad-hoc testing, no structure | OWASP WSTG methodology with co tracking |
| False positives in reports | 6-gate kills bad findings before they waste your time |
| "Is this in scope?" uncertainty | Mandatory /scope gate — refuses to test without authorization |
| Write reports from scratch | /report --full generates professional markdown + PDF |
| Forget what you tested | Payload log + co tracker across sessions |
| Search PayloadAllTheThings manually | Curated methodology + direct references per vuln class |

</div>

<br>

---

<br>

Quick Start

Step 1 — Clone

Step 2 — (Optional) Set up tools

Step 3 — Hunt

<br>

---

<br>

How It Works

Each command loads the right agent persona, methodology skill, and payload references. State is tracked per engagement in engagements/<target>/.

<br>

---

<br>

Commands

| Command | What It Does |
|:---|:---|
| /scope <target> | Define target scope and confirm authorization. Must run first. |
| /recon <target> | Map attack surface — tech stack, endpoints, input , WAF detection |
| /hunt <> | Test for a specific class using OWASP methodology |
| / | Run 6-gate quality check on all un findings |
| /report --full | Generate complete pentest report (exec summary, findings, remediation) |
| /report --finding F-001 | Generate report for a single finding |
| /status | Show engagement dashboard — findings, co, payload stats |

<br>

Hunt Targets

<br>

---

<br>

Agent Personas

3 specialized personas, each activated by the relevant command:

| Agent | Activated By | Personality | Role |
|:---|:---|:---|:---|
| Recon Agent | /recon | Systematic, methodical | Maps the full attack surface before exploitation |
| Hunter Agent | /hunt | Creati | Tries bypass techniques, iterates on partial success |
| Agent | / | Skeptical, ad | Assumes false positi pro |

When no command is acti behaves as a general security consultant.

<br>

---

<br>

Gate

Every finding must pass all 6 gates to reach the report. One failure = REJECTED or NEEDS-WORK.

This process eliminates false positives, ensures e quality, and produces findings that clients can independently.

<br>

---

<br>

Co

<details>
<summary><b>18 Classes</b> — click to expand</summary>
<br>

| Class | Sub-Classes |
|:---|:---|
| SQL Injection | Union, blind, time-based, error-based, auth bypass |
| XSS | Reflected, stored, DOM, CSP bypass, polyglots |
| SSRF | Internal access, cloud metadata, protocol abuse, IP bypass |
| SSTI | Jinja2, Twig, Freemarker, Pebble, Mako, ERB |
| Command Injection | Metacharacters, blind detection, space/quote bypass |
| XXE | Classic, blind OOB, S, XInclude, PHP filter |
| Path Tra | Encoding bypass, null byte, o UTF-8 |
| File Upload | Extension bypass, MIME spoof, magic bytes, polyglots |
| IDOR | Sequential ID, UUID harvest, GraphQL node, HPP |
| JWT Attacks | alg:none, RS256→HS256, KID injection, claim tampering |
| OAuth/OIDC | Redirect URI bypass, state absence, PKCE downgrade |
| NoSQL Injection | MongoDB operator injection, $regex blind, $where |
| Deserialization | Java/PHP/Python/.NET/Ruby/YAML gadgets |
| CSRF | Auto-submit forms, JSON CSRF, SameSite bypass |
| Open Redirect | Protocol-relati chains, @ symbol tricks |
| Request Smuggling | CL.TE, TE.CL, HTTP/2 downgrade, TE obfuscation |
| Race Condition | TOCTOU, coupon reuse, rate limit bypass, double spend |
| Prompt Injection | Direct o, system prompt extraction, persona hijack, encoding bypass, tool abuse, indirect injection |

</details>

<br>

---

<br>

Project Structure

<br>

---

<br>

Tool Integration

| Tool | Integration | Use |
|:---|:---|:---|
| Burp Suite | MCP server | Proxy, traffic analysis, request replay |
| SQLMap | Bash (post-detection) | Automated SQL injection exploitation |
| Commix | Bash (post-detection) | Automated command injection exploitation |
| Custom scripts | Claude generates on the fly | Race conditions, token analysis, encoding |
| md2pdf.py | Python (weasyprint) | Convert report markdown to styled PDF |

> SQLMap and Commix are used only after manual detection confirms the . Never as first-pass scanners.

<br>

---

<br>

Local Payloads

The public payloads/ directory contains methodology and payload references. For curated payload lists with full exploit code, add them to local-payloads/ (gitignored):

<br>

---

<br>

Safety Rules

These are enforced in CLAUDE.md. Non-negotiable.

<br>

---

<br>

Contributing

Contributions are welcome. Please read CONTRIBUTING.md before opening a pull request.

<br>

---

<br>

<di="center">

For authorized security testing only.
<br>
Only test systems you own or ha written permission to test.

</div>

项目信息

开发语言：Python

Star 数：46

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-powered web application penetration testing skills with Claude Code展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。