skills.rest
kalilurrahman
kalilurrahmanCOMMUNITY
Explore all skills by this author →
Website𝕏@krahmanGitHub

penetration-test-plan

Design penetration testing plans with scope, OWASP Top 10 coverage, and CVSS-scored findings.

1|Updated Mar 21, 2026
Search Tags:#penetration testing#owasp top 10#security assessment#ethical hacking#burp suite#vulnerability report#cvss scoring
One-click install
npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill penetration-test-plan-kalilurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: penetration-test-plan
Source: https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts/tree/main/05-security/penetration-test-plan
Command: npx skills add https://github.com/kalilurrahman/kr-claudiator-skills-original-prompts --skill penetration-test-plan-kalilurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Planning a penetration test without a structured methodology leads to missed vulnerabilities, legal exposure from undefined scope, and findings that developers cannot reproduce or fix. This Skill produces methodical test plans with explicit scope, rules of engagement, and actionable remediation guidance. ## Core Features & Use Cases - Scope and Rules of Engagement: Define in-scope targets, out-of-scope systems, testing windows, rate limits, and data handling rules to avoid legal and operational issues. - OWASP Top 10 Coverage: Systematically test for broken access control, injection, SSRF, cryptographic failures, and the other OWASP categories using tools like Burp Suite, OWASP ZAP, SQLMap, and Nmap. - CVSS-Scored Reporting: Document findings with severity ratings, reproduction steps, impact analysis, and concrete remediation code. - Use Case: A security team needs to test a staging web application and API before launch. Use this Skill to produce a grey-box test plan covering 40 hours of testing, then generate a findings report with 2 critical and 5 high vulnerabilities, each with reproduction steps and fix guidance. ## Quick Start Create a penetration test plan for my staging web application and REST API using a grey-box methodology with OWASP Top 10 coverage.

Frequently Asked Questions about penetration-test-plan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a penetration testing plan for a web application?▼

Define the scope (URLs, IP ranges, credentials), choose a methodology (black, grey, or white box), set rules of engagement, map the attack surface, then execute OWASP Top 10 tests. Document each finding with severity, reproduction steps, and remediation guidance.

What tools are used for penetration testing web apps?▼

Burp Suite intercepts and modifies requests for manual testing, OWASP ZAP runs automated vulnerability scans, SQLMap tests SQL injection, and Nmap performs port scanning and service detection. Each tool covers a different phase of the assessment.

What is the difference between black box, grey box, and white box testing?▼

Black box testing uses no internal knowledge, simulating an external attacker. Grey box provides credentials and partial system knowledge, balancing realism and depth. White box grants full access to source code and architecture for the most thorough coverage.

How are penetration test findings scored for severity?▼

Findings use CVSS scoring: critical (9.0-10.0) for RCE or auth bypass, high (7.0-8.9) for stored XSS or privilege escalation, medium (4.0-6.9) for reflected XSS or CSRF, and low (0.1-3.9) for information disclosure.

Why should penetration tests exclude production environments?▼

Testing production risks service disruption, data corruption, and customer impact even with rate limits. Staging environments replicate production behavior safely, and rules of engagement should explicitly exclude production, third-party services, and denial-of-service attacks.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-entry-point-analyzer

Map and analyze application entry points to assess security risk.

Official
Intermediate
johngutierrez31johngutierrez31

vulnerability-priority-engine

Score vulnerabilities by exploitability, exposure, impact, and remediation effort.

Community
Intermediate
HomericIntelligenceHomericIntelligence
18

scan-vulnerabilities

Scan code and dependencies for security vulnerabilities using Bandit, Safety, and Semgrep.

Official
Intermediate
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced