skills.rest
habrahgithub
habrahgithubCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

penetration-testing

Perform authorized penetration testing on applications, APIs, and network services.

Updated Feb 1, 2026
Search Tags:#security#reconnaissance#remediation#exploitation#api-security#penetration-testing#vulnerability-assessment
One-click install
npx skills add https://github.com/habrahgithub/node-backend-starter --skill penetration-testing-habrahgithub
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: penetration-testing
Source: https://github.com/habrahgithub/node-backend-starter/tree/main/.codex/skills/penetration-testing
Command: npx skills add https://github.com/habrahgithub/node-backend-starter --skill penetration-testing-habrahgithub

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a structured, safety-conscious workflow for performing authorized penetration testing to find, validate, and communicate exploitable security weaknesses in applications and APIs.

Core Features & Use Cases

  • Authorization-first workflow: Enforces explicit permission, scoped targets, and non-destructive defaults before any testing begins.
  • End-to-end testing steps: Guidance for reconnaissance, attack-surface mapping, systematic vulnerability testing, controlled exploitation within scope, evidence capture, and remediation recommendations.
  • Use Case: Run a scoped assessment of a pre-production API to identify authentication, authorization, injection, and data exposure flaws, and produce a prioritized findings report with reproducible proof steps.

Quick Start

Conduct an authorized penetration test of the target API, enumerate the attack surface, validate vulnerabilities with reproducible evidence, and deliver a prioritized remediation report.

Frequently Asked Questions about penetration-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform penetration testing on a pre-production API to find exploitable vulnerabilities?▼

Penetration testing of a pre-production API involves reconnaissance, attack-surface mapping, systematic vulnerability testing, and controlled exploitation within scope to identify authentication, authorization, and data exposure flaws while capturing reproducible evidence.

What authorization is required before starting an authorized penetration test?▼

Authorized penetration testing requires explicit written permission, a defined target scope, and non-destructive approval for exploit attempts before any testing begins to ensure safety-conscious and legally compliant security assessments.

How does vulnerability assessment work during a scoped security engagement?▼

Vulnerability assessment during a security engagement works by systematically testing the attack surface, validating discovered security weaknesses through controlled exploitation, and capturing evidence to confirm the flaws are exploitable.

Can I use this penetration testing workflow for internal red team exercises?▼

Yes, this penetration testing workflow applies to controlled red team exercises, internal pre-production tests, and web or API assessments, provided you maintain explicit authorization and defined target scope throughout the engagement.

What is the best way to document and report exploitable security flaws found in applications?▼

The best way to report exploitable security flaws is to capture reproducible evidence during testing and deliver a prioritized findings report containing actionable remediation recommendations for each discovered vulnerability.

Related Skills

Explore More Software Engineering Skills→
pekralpekral

penetration-tester

Validate exploitability of web application and API vulnerabilities through authorized penetration testing.

Community
Advanced
ArabelaTsoArabelaTso
142

cve-watchlist-action-recommendation-generator

Generate prioritized CVE watchlists and remediation recommendations from JSON/SARIF scan results.

Community
Advanced
langbyyilangbyyi
96

recon-and-methodology

Create structured reconnaissance plans for authorized security testing and bug bounty engagements.

Community
Advanced
jinyimeng01jinyimeng01
54

vuln-classes

Classifies web application vulnerabilities using detection signals and exploitation concepts.

Community
Intermediate