claude-code-pentest - 6 Claude Code skills that automate the entire pent

项目说明

<p align="center">
<h1 align="center">claude-code-pentest</h1>
<p align="center">
<strong>6 Claude Code skills that automate the entire pentest lifecycle.<br>From recon to exploit chains to bug bounty reports — just give it a domain.</strong>
</p>
<p align="center">
<img src=" alt="Python 3.8+">
<img src=" alt="License: MIT">
<img src=" alt="Claude Code">
<img src=" alt="6 Skills">
<img src=" alt="43 Scripts">
<img src=" alt="Zero Dependencies">
</p>
<p align="center">
Built by <a href="
</p>
</p>

---

> WARNING: Authorized security testing only. Unauthorized access to computer systems is illegal.
> Read the full disclaimer before use.

---

The Pipeline

What Each Skill Does

| # | Skill | What It Does | Scripts |
|---|-------|-------------|---------|
| 1 | recon-dominator | Subdomain enumeration, port scanning, tech fingerprinting, OSINT, Google dorking, Wayback analysis | 8 |
| 2 | attack-path-architect | Asset classification, trust mapping, MITRE ATT&CK attack trees, kill chain generation | 3 |
| 3 | webapp-exploit-hunter | SQLi, XSS, SSRF, IDOR, SSTI, auth bypass, file upload, race conditions + PoC generation | 11 |
| 4 | api-breaker | API discovery, schema reconstruction, BOLA/BFLA, mass assignment, JWT attacks, GraphQL abuse | 8 |
| 5 | cloud-pi | Cloud provider detection, S3/GCS/Azure buckets, subdomain takeover, ser, CI/CD exposure | 7 |
| 6 | | Cross-domain vuln correlation, exploit chain composition, C, bug bounty reports | 6 |

43 Python scripts total. Zero pip dependencies. Pure standard library.

Quick Start

Then just talk to Claude:

Requirements

Optional (for faster scanning)

System tools (usually pre-installed): dig, whois, nmap

Installation

Method 1: Personal skills (all projects)

Method 2: Project-le (single project)

Method 3: Single skill

Usage

Natural language (Claude auto-selects the right skill)

Direct in

Full Pentest Workflow

Each skill outputs structured JSON that feeds into the next skill in the pipeline.

Detailed Script Reference

<details>
<summary><b>recon-dominator</b> — 8 scripts</summary>

| Script | Function |
|--------|----------|
| passi.py | crt.sh, HackerTarget, RapidDNS, Wayback, subfinder integration |
| acti.py | DNS brute-force, zone transfer, permutation scanning |
| port_scanner.py | TCP connect scan, HTTP probing, WAF detection |
| tech_fingerprint.py | 50+ technology signatures, security header analysis |
| osint_correlator.py | WHOIS, ASN, reverse IP, GitHub dorks, email pro |
| google_dorker.py | 88 dorks across 9 categories |
| wayback_analyzer.py | URL categorization, JS analysis, remo detection |
| generate_report.py | Consolidated MD + JSON report |

</details>

<details>
<summary><b>attack-path-architect</b> — 3 scripts</summary>

| Script | Function |
|--------|----------|
| classify_assets.py | Asset type classification, exposure level, risk scoring |
| map_trust.py | Cookie scope, DNS relationships, TLS sharing, SSO detection |
| generate_attack_tree.py | Attack patterns, MITRE TTP mapping, kill chain generation |

</details>

<details>
<summary><b>webapp-exploit-hunter</b> — 11 scripts</summary>

| Script | Function |
|--------|----------|
| crawler.py | HTML parsing, form extraction, JS endpoint discovery, path fuzzing |
| sqli_tester.py | Error-based, boolean-based, time-based, UNION-based SQLi |
| xss_tester.py | Context-aware XSS (HTML, attribute, JS, URL), WAF bypass |
| ssrf_tester.py | Localhost, cloud metadata, protocol smuggling, IP bypass |
| ssti_tester.py | Jinja2, Twig, Freemarker, ERB, Smarty, Pebble, |
| idor_tester.py | Horizontal/ access, method , ID encoding |
| auth_tester.py | Default creds, JWT attacks, session analysis, CORS, headers |
| upload_tester.py | Double extension, null byte, magic bytes, Content-Type bypass |
| race_tester.py | Double spend, coupon reuse, parallel request racing |
| generate_poc.py | curl commands, Python scripts, reproduction steps |
| .py | Bug bounty reports with C |

</details>

<details>
<summary><b>api-breaker</b> — 8 scripts</summary>

| Script | Function |
|--------|----------|
| api_discovery.py | 70+ common API paths, GraphQL introspection, OpenAPI parsing |
| schema_builder.py | API schema reconstruction, OpenAPI 3.0 output |
| auth_analyzer.py | JWT decode/attack, none algorithm, key confusion, weak secrets |
| authz_tester.py | BOLA/BFLA testing with dual tokens |
| mass_assignment.py | 30+ injection fields, nested object testing |
| rate_limiter.py | 120+ rapid requests, 12 IP spoofing headers, GraphQL batching |
| logic_tester.py | Price manipulation, quantity o, pri escalation |
| api_report.py | OWASP API Top 10 mapping, per-finding reports |

</details>

<details>
<summary><b>cloud-pi</b> — 7 scripts</summary>

| Script | Function |
|--------|----------|
| cloud_detector.py | CNAME patterns, header analysis, IP whois for cloud pro |
| bucket_enum.py | S3/GCS/Azure bucket name generation and permission testing |
| takeo.py | 18 service fingerprints for dangling CNAME detection |
| ser.py | Lambda, API Gateway, Cloud Functions, Cloud Run discovery |
| cicd_finder.py | Jenkins, GitLab, GitHub Actions, Terraform, Docker/K8s configs |
| metadata_paths.py | SSRF , metadata-to-credential pi mapping |
| cloud_report.py | Consolidated cloud security report with remediation |

</details>

<details>
<summary><b></b> — 6 scripts</summary>

| Script | Function |
|--------|----------|
| import_findings.py | Normalizes findings from all tools to common format |
| correlate.py | 10 chain templates matching combinations |
| build_chains.py | Detailed chain construction with per-phase steps |
| calculate_impact.py | CVSS v3.1 recalculation, amplification rules |
| generate_chain_poc.py | Python scripts, curl sequences per chain |
| generate_report.py | HackerOne, Bugcrowd, and generic pentest report formats |

</details>

Architecture

Troubleshooting

| Problem | Solution |
|---------|----------|
| Skill not triggering automatically | Invoke directly with /skill-name |
| Scripts fail with "command not found" | Install optional Go tools (see Requirements) |
| Permission denied on scripts | Run chmod +x scripts/*.py inside the skill folder |
| Too many skills loaded | Install only the skills you need |
| Rate limiting (429 errors) | Scripts auto-adjust rate; use --delay flag |

Legal Disclaimer

This software is provided for authorized security testing and educational purposes only.

By using this software, you agree that:

1. You have explicit, written authorization to test any target system
2. You accept full responsibility for your actions and any consequences
3. The authors are not liable for any misuse, damage, or legal consequences
4. You will comply with all applicable laws in your jurisdiction

Unauthorized access to computer systems is a criminal offense under the Computer Fraud and Abuse Act (CFAA), Computer Misuse Act, Budapest Con on Cybercrime, and equi laws worldwide.

Read the full DISCLAIMER.md before using these tools.

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT License - See LICENSE for details.

Security

Found a in this project? See SECURITY.md.

---

<p align="center">
Built by <a href=" — Offensi & AI Integration
</p>

项目信息

开发语言：Python

Star 数：26

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕6 Claude Code skills that automate the entire pentest lifecycle. From recon to exploit chains to bug bounty reports — just give it a domain. 43 scripts, zero dependencies, pure Python.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。