mcpField
P
pentest-config-hardening

pentest-config-hardening

github.com/jd-opensourceSecurity31563 installsUpdated 28w ago
Repository

About pentest-config-hardening

A configuration-hardening penetration-testing skill for auditors assessing web-facing systems. It systematically checks security headers, TLS, HTTP methods, exposed infrastructure, cloud storage, CSP, and cookies.

Key features

  1. 01HTTP security-header audit
  2. 02TLS protocol and cipher review
  3. 03HTTP method testing
  4. 04Infrastructure exposure checks
  5. 05Cloud storage misconfiguration checks
  6. 06CSP and cookie security review

Use cases

  1. 01Reviewing web endpoint security configuration
  2. 02Finding exposed admin and monitoring interfaces
  3. 03Checking TLS and certificate settings
  4. 04Assessing CSP, cookie, and storage risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jd-opensource/joysafeter --skill pentest-config-hardening

After installing, type/pentest-config-hardeningin Claude Code to confirm it loaded.

Bundled filesreferences/tools.mdreferences/workflows.md

Details

From the project README

Pentest Config Hardening

Purpose

Shannon checks only 2 of 14 WSTG-CONF items. The remaining 12 are "low-hanging fruit" findings expected in every professional pentest report — straightforward to test systematically.

Prerequisites

Authorization Requirements
  • Written authorization with infrastructure testing scope
  • Target URL list for all web-facing endpoints
  • CDN/WAF awareness — some headers may be set by infrastructure, not application
Environment Setup
  • testssl.sh for comprehensive TLS analysis
  • nmap with ssl-enum-ciphers script
  • curl for manual header inspection
  • nuclei with misconfig templates

Core Workflow

  1. HTTP Security Headers: Audit HSTS (+ preload), CSP policy analysis, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CORP/COEP/COOP (WSTG-CONF-07/14).
  2. TLS Configuration: Protocol versions (TLS 1.0/1.1 deprecation), cipher suite strength, certificate validity, HSTS preload status, certificate transparency.
  3. HTTP Method Handling: OPTIONS enumeration, PUT/DELETE on static resources, TRACE for XST, method override headers (WSTG-CONF-06).
  4. Infrastructure Exposure: Admin interfaces (WSTG-CONF-05), default credentials on management consoles, exposed monitoring endpoints (/metrics, /health, /debug).
  5. Cloud Storage Misconfig: Public S3 buckets, Azure blob containers, GCP storage referenced in app code or responses (WSTG-CONF-11).
  6. CSP Bypass Analysis: unsafe-inline, unsafe-eval, overly broad source lists, JSONP on allowed domains, missing base-uri (WSTG-CONF-12).
  7. Cookie Security: Secure flag, HttpOnly flag, SameSite attribute, cookie scope, session cookie entropy.

WSTG Coverage

WSTG IDTest NameStatus
WSTG-CONF-02Test Application Platform Configuration✅
WSTG-CONF-03Test File Extensions Handling✅
WSTG-CONF-04Review Old Backup and Unreferenced Files✅
WSTG-CONF-05Enumerate Infrastructure and Admin Interfaces✅
WSTG-CONF-06Test HTTP Methods✅
WSTG-CONF-07Test HTTP Strict Transport Security✅
WSTG-CONF-08Test RIA Cross Domain Policy✅
WSTG-CONF-09Test File Permission✅
WSTG-CONF-11Test Cloud Storage✅
WSTG-CONF-12Test Content Security Policy✅
WSTG-CONF-13Test for Subdomain Takeover✅
WSTG-CONF-14Test Security Headers✅

Tool Categories

CategoryToolsPurpose
TLS Testingtestssl.sh, nmap ssl-enum-ciphersProtocol and cipher analysis
Header AuditSecurityHeaders.com API, Mozilla ObservatorySecurity header grading
Method Testingcurl, nmap http-methodsHTTP method enumeration
CSP AnalysisCSP Evaluator, custom scriptsCSP bypass assessment
Cloud StorageS3Scanner, cloud_enumPublic bucket detection
Subdomainsubjack, can-i-take-over-xyzSubdomain takeover detection

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors

Comments

Markdown supported