pentest-internal
Post-authorization testing on authorized internal hosts: service enumeration, credential and privilege paths, lateral-movement reasoning, and sensitive-data discovery, causing no disruption and staying on listed hosts. Read before internal-network or post-exploitation work.
- License 许可
- Apache-2.0
- 所属仓库
- enowdev/enowxcli
- 最近更新
- 2026-10-06
- Stars
- ★ 67
- Forks
- 21
01 前言 Front Matter
- name
- pentest-internal
- description
- Post-authorization testing on authorized internal hosts: service enumeration, credential and privilege paths, lateral-movement reasoning, and sensitive-data discovery, causing no disruption and staying on listed hosts. Read before internal-network or post-exploitation work.
02 资源文件 1
- 参考文档agents/openai.yaml586 B
03 SKILL.md 正文
Internal / post-exploitation testing
This runs only on hosts the engagement explicitly lists, after authorization, and never spreads beyond them. The goal is to show what an attacker who already has a foothold could reach, not to actually take over the network.
What to look at
- Service enumeration on authorized hosts: what is listening, versions, default or weak credentials.
- Credential paths: reused passwords, secrets in config files, world-readable key material, tokens in memory or on disk.
- Privilege escalation: misconfigured sudo, weak file permissions on services, unpatched local issues, reason about the path and demonstrate it benignly.
- Lateral movement: which hosts a compromised one could reach, and how. Describe the path; do not carve a trail of compromised machines through the network.
- Sensitive data reachable from the foothold.
Rules
Cause no disruption. Read rather than write. Do not persist, do not pivot to
out-of-scope hosts, do not destroy or alter data. Record every confirmed path
with report_finding, and hand the chained picture to the lead, a set of
medium findings that together reach domain admin is a critical finding.
04 同仓库更多 Skills
demo-skill
Project-scope demo skill for tests.
writing
Writing words people read: the specific thing instead of claims, words to drop, sentences, interface copy (buttons, labels, errors, empty states, confirmations), page copy, notifications and emails, alt text and link text, numbers and dates, words that translate well, documentation and voice. Read before writing a page's copy, an interface's text or a document.
ui
Designing or restyling an interface: direction, layout, type, colour, icons, components, states, responsive behaviour. Read before building a page, a screen or a set of components.
ui-themes
Light and dark themes, and colour that holds in both: tokens with a value per theme, and what each kind of content needs to stay visible (icons, SVG drawings and line art, logos, photos, screenshots, charts, code, maps, borders, shadows, focus, form controls), switching without a flash, and checking both. Read before building a second theme or a theme toggle, and before any drawing, logo or chart on a page that has two themes.
ui-structure
Structure before styling: the blueprint written before any interface code (the screen's job, the regions its kind of page needs, their order and why, the layout skeleton in numbers, the components and their states), the anatomy and order of a homepage, a dashboard, a list, a detail page, settings, a form, sign-in, pricing, docs, an article and a checkout, and how to turn the blueprint into code (tokens, layout primitives, components, sections, page). Read first, before building or rebuilding any page or screen.
ui-stack-vue
Building interfaces in Vue 3 and Nuxt: project layout, script setup with typed defineProps, defineEmits and defineModel, attribute fallthrough, slots and scoped slots, template refs, ref, reactive and computed, watch versus watchEffect, composables and VueUse, provide and inject, Pinia, keyed v-for, transitions, Nuxt 4 (app directory, pages, layouts, useFetch and useAsyncData keys, $fetch in handlers, server routes, runtime config, useSeoMeta, NuxtImg, middleware), VeeValidate forms, Reka UI and Nuxt UI, testing, vue-tsc, and the traps. Read when the project uses Vue or Nuxt.