mcpField
P
pentest-engagement-methodology

pentest-engagement-methodology

github.com/securityskillsSecurity0254 installsUpdated 9w ago
Repository

About pentest-engagement-methodology

A structured methodology for authorized penetration tests, guiding teams from scope planning through reporting. It is intended for consistent test coverage and deliverables for clients or internal stakeholders.

Key features

  1. 01Confirm scope and rules of engagement
  2. 02Passive and active reconnaissance
  3. 03Verify and rank vulnerabilities
  4. 04Exploit only within authorized scope
  5. 05Clean up and record test artifacts
  6. 06Report findings and remediation advice

Use cases

  1. 01Planning an authorized penetration test
  2. 02Running a security assessment by phase
  3. 03Preparing an evidence-backed findings report

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill pentest-engagement-methodology

After installing, type/pentest-engagement-methodologyin Claude Code to confirm it loaded.

Details

From the project README

Penetration Test Engagement Methodology

Work through a structured, repeatable methodology for authorized penetration tests.

When to Use

  • You are planning or executing a penetration test with written authorization
  • You need to ensure coverage and consistency across an engagement
  • You are preparing deliverables for a client or internal stakeholder

Hard Rules

  1. Never test without written authorization. Verify the scope statement, rules of engagement (RoE), and emergency contacts before touching anything.
  2. Stay in scope. Check every IP, domain, and URL against the scope document before testing. If unsure, ask — do not guess.
  3. No destructive actions unless explicitly authorized: no DoS, no data destruction, no production brute-force lockouts.

Phases

1. Scoping and Planning
  • Capture in-scope assets, out-of-scope assets, testing windows, and escalation paths
  • Identify the engagement type: black/grey/white box
  • Agree on evidence-handling and data-destruction requirements
  • Prepare the test plan and get sign-off
2. Reconnaissance
  • Passive first: certificate transparency, DNS records, public code, job postings
  • Active second: port scanning, service fingerprinting, subdomain enumeration
  • Build an asset inventory with owner notes and observed technologies
3. Vulnerability Analysis
  • Map the attack surface to likely vulnerability classes per technology
  • Manual verification of every finding — scanners produce noise; you produce evidence
  • Rank candidate findings by exploitability and business impact
4. Exploitation
  • Use the least invasive proof that proves the finding (POC > payload)
  • Document: request, response, tool, version, and timestamp for every exploit attempt
  • Stop and escalate to the client if you reach a critical system boundary
5. Post-Exploitation
  • Demonstrate impact: what data or access the foothold yields
  • Attempt privilege escalation and lateral movement only within RoE
  • Clean up: remove shells, scripts, and artifacts; record what was created where
6. Reporting
  • Executive summary: business risk in plain language
  • Findings: title, severity (CVSS), affected assets, reproduction steps, evidence, remediation advice
  • Retest criteria and positive observations

Output Format

Deliver: test plan, asset inventory, findings report with evidence, cleanup log, and a debrief agenda.

Comments

Markdown supported