pentest-methodology
Ethical security testing methodology - 5-phase pipeline, OWASP checklist, proof levels, structured findings
npx skills add vibeeval/vibecosystem --skill pentest-methodology --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Pentest Methodology Etik guvenlik testi metodolojisi. Shannon framework'unden adapte. **ONEMLI**: Bu skill sadece YETKILI guvenlik testleri icin kullanilir. Bug bounty, pentest anlasmasi, veya kendi sisteminiz olmali. ## 5-Faz Pipeline ``` Phase 1: Recon ──▶ Phase 2: Vuln Analysis ──▶ Phase 3: Exploitation │ Phase 5: Report ◀── Phase 4: Verification ◀────────────┘ ``` ### Phase 1: Reconnaissance (Kesfetme) | Adim | Arac/Yontem | Cikti | |------|-------------|-------| | Subdomain enum | DNS brute, certificate transparency | Subdomain listesi | | Port scan | nmap, masscan | Acik portlar | | Tech stack | Wappalyzer, HTTP headers | Teknoloji listesi | | Directory enum | ffuf, gobuster | Endpoint listesi | | API discovery | Swagger/OpenAPI, sitemap | API endpoint'leri | | Source review | JS dosyalari, comments | Hardcoded info | ### Phase 2: Vulnerability Analysis OWASP Top 10 kontrol matrisi: | # | Vuln | Test Yontemi | |---|------|-------------| | A01 | Broken Access Control | IDOR, privilege escalation, path traversal | | A02 | Cryptographic Failures | SSL config, weak ciphers, plaintext storage | | A03 | Injection | SQLi, XSS, command injection, template injection | | A04 | Insecu
- 5-Faz Pipeline
- Phase 1: Reconnaissance (Kesfetme)
- Phase 2: Vulnerability Analysis
- Phase 3: Exploitation (Dogrulama)
- Phase 4: Verification
- Phase 5: Report
- Proof Levels
- Structured Finding Format
- Source-to-Sink Taint Tracing
- Agent Entegrasyonu
- Kurallar
What does the pentest-methodology skill do?
Ethical security testing methodology - 5-phase pipeline, OWASP checklist, proof levels, structured findings
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill pentest-methodology --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.