🗡️ Penetration Tester Master Kit

penetration-tester-master

Ultimate Offensive Security Master Skill.

Dokhacgiakhoa/antigravity-ide·0installs507stars

SKILL.md

Full skill instructions

🗡️ Penetration Tester Master Kit

You are an Elite Red Team Lead and Professional Pentester. This skill provides a unified lifecycle for identifying, exploiting, and reporting security vulnerabilities.

1. Hacking Methodology & Planning

Structured approach to offensive engagements.

Phases: Recon → Scanning → Gaining Access → Maintaining Access → Covering Tracks.
Checklist: Define scope, obtain "Get Out of Jail Free" letter, and verify legal boundaries.
Goal: Move from low-privileged user or external network to Domain Admin or Data Exfiltration.

2. Reconnaissance & OSINT

Passive: Use Shodan, Google Dorks, and WHOIS.
Active: Nmap (Port scanning), Wireshark (Traffic analysis), and Subdomain enumeration (Sublist3r).
Tools: Find exposed Jenkins, Git configs, or unsecured API endpoints.

3. Exploitation (Web, API, Cloud)

Web: Master the OWASP Top 10.
- SQL Injection: Use SQLMap for automation.
- XSS/HTML Injection: Bypass CSP and steal cookies.
- Path Traversal/LFI: Read /etc/passwd or configuration files.
- IDOR: Access other users' data by manipulating IDs.
API: Fuzzing with Burp Suite, testing for Broken Object Level Authorization (BOLA).
Cloud (AWS/Azure): Target S3 misconfigurations, Metadata SSRF, and Lambda exploitation.

4. Post-Exploitation & PrivEsc

Metasploit Framework: Use for payload generation and session management.
Linux PrivEsc: Check for SUID binaries, kernel exploits, and misconfigured cron jobs.
Windows PrivEsc: Target DLL hijacking, Token Impersonation, and unquoted service paths.
Active Directory: Kerberoasting, Pass-the-Hash, and BloodHound enumeration.

5. Reporting & Remediation

Evidence: Collect screenshots, logs, and reproduction scripts (PoC).
Severity: Rank finds via CVSS (0-10).
Remediation: Provide clear, developer-friendly fixes (e.g., "Use parameterized queries" instead of "Fix SQL Injection").

🛠️ Execution Protocol

Classify Sector: Network, Web, Cloud, or Mobile?
Phase 1: Recon: Gather target intel.
Phase 2: Scanning: Identify services and versions.
Phase 3: Attack: Select and execute the specific exploit logic above.
Phase 4: PrivEsc: Elevate permissions if possible.
Final Report: Synthesize findings for the user.

Merged and optimized from 25 legacy offensive security and tool-specific skills.

🧠 Knowledge Modules (Fractal Skills)

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/Dokhacgiakhoa/antigravity-ide --skill penetration-tester-master

View on GitHub

.agent/skills/penetration-tester-master/SKILL.md

shopify-development
Build Shopify apps, extensions, themes using GraphQL Admin API, Shopify CLI, Polaris UI, and Liquid. TRIGGER: "shopify", "shopify app", "checkout extension", "admin extension", "POS extension", "shopify theme", "liquid template", "polaris", "shopify graphql", "shopify webhook", "shopify billing",...
1 installs
social-content
When the user wants help creating, scheduling, or optimizing social media content for LinkedIn, Twitter/X, Instagram, TikTok, Facebook, or other platforms. Also use when the user mentions 'LinkedIn post,' 'Twitter thread,' 'social media,' 'content calendar,' 'social scheduling,' 'engagement,' or ...
0 installs
javascript-testing-patterns
Implement comprehensive testing strategies using Jest, Vitest, and Testing Library for unit tests, integration tests, and end-to-end testing with mocking, fixtures, and test-driven development. Use when writing JavaScript/TypeScript tests, setting up test infrastructure, or implementing TDD/BDD w...
0 installs
api-documenter
Master API documentation with OpenAPI 3.1.
0 installs

More skills from Dokhacgiakhoa

Dokhacgiakhoa/antigravity-ide

Design LLM applications using the LangChain framework with agents, memory, and tool integration patterns. Use when building LangChain applications, implementing AI agents, or creating complex LLM workflows.

507 0

View

Dokhacgiakhoa/antigravity-ide

nextjs-app-router-patterns

Master Next.js 14+ App Router with Server Components, streaming, parallel routes, and advanced data fetching. Use when building Next.js applications, implementing SSR/SSG, or optimizing React Server Components.

507 0

View

Dokhacgiakhoa/antigravity-ide

startup-metrics-framework

This skill should be used when the user asks about "key startup

507 0

View

Dokhacgiakhoa/antigravity-ide

frontend-mobile-security-xss-scan

You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection poi

507 0

View

Dokhacgiakhoa/antigravity-ide

deployment-validation-config-validate

You are a configuration management expert specializing in validating, testing, and ensuring the correctness of application configurations. Create comprehensive validation schemas, implement configurat

507 0

View

Dokhacgiakhoa/antigravity-ide

Cross-Site Scripting and HTML Injection Testing

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techn...

507 0

View

Dokhacgiakhoa/antigravity-ide

nodejs-backend-patterns

Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices architectures.

507 0

View

Dokhacgiakhoa/antigravity-ide

projection-patterns

Build read models and projections from event streams. Use when implementing CQRS read sides, building materialized views, or optimizing query performance in event-sourced systems.

507 0

View

Dokhacgiakhoa/antigravity-ide