[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DC8A3NPH1BW9PC4G414WNM":3,"skill-same:01M6DC8A3NPH1BW9PC4G414WNM":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6DC8A3NPH1BW9PC4G414WNM","web-pentest",null,"Authorized web pentest: recon, proof-based exploits, report.","zapabob\u002FSkills","zapabob","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130830376?v=4","01M6DBMYZAGRTFQDSQYW3W764P","峯岸 亮","01M6DBMZ3GKDSJ01NZ9XTZD7JD",2,"MIT","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Farchive\u002Fskill-md-reviewed\u002Fsha256\u002F0e\u002F0e2e199e97fe0145ea7d4ff70166755438c6491d9900793a13f1a64ff400a498\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"web pentest","pentest","web","browser","web app","app","find","hermes agent","hermes","owasp","file","macos","delegation","report","test","vulnerabilities","security","linux","terminal","2026-11-10 10:12:30",false,"---\nname: web-pentest\ndescription: \"Authorized web pentest: recon, proof-based exploits, report.\"\nversion: 1.0.0\nauthor: Teknium (teknium1), Hermes Agent\nlicense: MIT\nplatforms: [linux, macos]\ncategory: security\ntriggers:\n  - \"pentest [URL]\"\n  - \"pentest this app\"\n  - \"penetration test [URL]\"\n  - \"security test this web app\"\n  - \"test [URL] for vulnerabilities\"\n  - \"find vulns in [URL]\"\n  - \"OWASP test [URL]\"\ntoolsets:\n  - terminal\n  - web\n  - browser\n  - file\n  - delegation\nmetadata:\n  hermes:\n    tags: [Security, Pentest, Web, Recon]\n    related_skills: []\n---\n\n# Web Application Penetration Testing\n\nA phased pentesting workflow for running web applications. Adapted from\nShannon's pipeline (Keygraph, AGPL — concepts only, no code borrowed).\nBuilt around three rules:\n\n1. No exploit, no report — every finding requires reproducible evidence.\n2. Bounded scope — every active request goes against a target the operator\n   pre-declared. Off-scope hosts are refused.\n3. Bypass exhaustion before false-positive dismissal — a \"blocked\" payload\n   is not a clean bill of health until you've tried the bypass set.\n\n---\n\n## ⚠️ Hard Guardrails — Read Before Every Engagement\n\nViolating any of these invalidates the engagement and may be illegal.\n\n1. **Authorization gate.** Before the first active scan in a session, you\n   MUST confirm with the user, in writing, that they own or have written\n   authorization to test the target. Record the acknowledgement in\n   `engagement\u002Fauthorization.md` (see template). No acknowledgement → no\n   active scanning. Reading public pages with `curl` is fine; sending\n   payloads is not.\n\n2. **Scope allowlist.** Maintain `engagement\u002Fscope.txt` — one hostname or\n   CIDR per line. Every `nmap`, `curl`, `whatweb`, browser navigation, or\n   payload-bearing request MUST be against an entry in scope. If a target\n   redirects you off-scope (3xx to a different host, a link in HTML),\n   STOP and confirm with the user before following.\n\n3. **No production systems without paper.** If the user hasn't told you\n   \"yes, prod is in scope and I have written sign-off,\" assume not. Default\n   targets are staging, local docker, dedicated test instances.\n\n4. **Cloud metadata is off by default.** Do not probe `169.254.169.254`,\n   `metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or\n   equivalent unless the engagement explicitly includes SSRF-to-metadata\n   as a goal AND the target is one you control. The agent's browser tool\n   can reach these from inside your own infrastructure — don't.\n\n5. **Destructive payloads need approval.** SQLi payloads that DROP\u002FDELETE,\n   filesystem-write SSTI, command injection with `rm`\u002F`shutdown`\u002F`mkfs`,\n   anything that mutates beyond a single test row → ASK FIRST. The\n   `approval.py` system catches some; don't rely on it alone.\n\n6. **Aux-client leakage risk (Hermes-specific).** This skill produces\n   sessions full of SQLi\u002FXSS\u002FRCE payloads, captured credentials, JWT\n   tokens. Hermes' compression and title-generation paths replay history\n   through the auxiliary client (often the main model). Anything sensitive\n   you write to the conversation can leave the box on the next compress.\n   Mitigation:\n   - Redact captured tokens\u002Fcredentials to the LAST 6 CHARS before logging\n     them in any message. Full values go to `engagement\u002Fevidence\u002F` files,\n     never into chat history.\n   - If the engagement is sensitive, set `auxiliary.title_generation.enabled: false`\n     in `~\u002F.hermes\u002Fconfig.yaml` for the session.\n\n7. **Rate limit yourself.** Default 200ms between active requests against\n   any single host. The recon-scan.sh script enforces this. Don't bypass\n   it without operator approval.\n\n8. **Authority of the report.** This skill produces a security\n   assessment, not a \"PASS.\" Even a clean run is \"no exploitable issues\n   FOUND in scope X within time T using methods Y\" — not \"the application\n   is secure.\" Mirror that language in the report.\n\n---\n\n## Phase 0: Engagement Setup\n\nBefore any scanning happens, create the engagement directory and\nauthorization acknowledgement.\n\n```bash\nENGAGEMENT=engagement-$(date +%Y%m%d-%H%M%S)\nmkdir -p \"$ENGAGEMENT\"\u002F{evidence,findings,reports}\ncd \"$ENGAGEMENT\"\n```\n\n1. **Ask the user (verbatim):**\n   > \"Confirm: (a) the target URL is [X], (b) you own this application\n   > or have written authorization to test it, and (c) the engagement\n   > may run for up to [N] hours starting now. Reply 'authorized' to\n   > proceed.\"\n\n2. **Wait for explicit `authorized` response.** Any other answer means STOP.\n\n3. **Record authorization** to `engagement\u002Fauthorization.md` using the\n   template in `templates\u002Fauthorization.md`. Include:\n   - Target URL(s) and IP(s)\n   - Authorization basis (ownership \u002F written authz from $name)\n   - Engagement window\n   - Out-of-scope items (production, third-party services, etc.)\n   - Operator name (the user driving this session)\n\n4. **Build scope.txt:**\n   ```\n   localhost\n   127.0.0.1\n   staging.example.com\n   192.168.1.0\u002F24    # internal lab only, with operator OK\n   ```\n\n5. **Read** `references\u002Fscope-enforcement.md` before issuing the first\n   active request — that doc has the host-extraction rules you apply\n   to every command\u002FURL before it goes out.\n\n---\n\n## Phase 1: Pre-Recon (Code Analysis, optional)\n\nSkip if no source access (black-box engagement).\n\nIf you have read access to the application source:\n\n1. **Map the architecture** — framework, routing, middleware stack\n2. **Inventory sinks** — every `execute(`, `os.system(`, `eval(`,\n   template render, file read\u002Fwrite, redirect target\n3. **Map auth** — session cookie vs JWT, OAuth flows, password reset,\n   privileged endpoints\n4. **Identify trust boundaries** — what's authenticated, what's not,\n   what comes from `request.*`\n5. **Backward taint** from each sink to a request source. Early-terminate\n   when proper sanitization is found (parameterized queries, allowlists,\n   `shlex.quote`, well-known escapers).\n\nOutput: `evidence\u002Fpre-recon.md` — architecture map, sink inventory,\nsuspected vulnerable code paths.\n\nThis is OFFLINE work. No traffic to the target.\n\n---\n\n## Phase 2: Recon (Live, Read-Only)\n\nMaps the attack surface. All requests are GETs of public pages, no\npayloads yet. Still scope-bounded.\n\n1. **Verify scope.** Resolve every target hostname → IP. Confirm IPs are\n   in scope (avoids the \"DNS points somewhere unexpected\" trap).\n\n2. **Network surface** (only if scope permits port scanning):\n   ```bash\n   nmap -sT -T3 --top-ports 100 -oN evidence\u002Fnmap.txt $TARGET\n   ```\n   Use `-T3` (default), not `-T4\u002F-T5`. Stealthier and avoids tripping\n   IDS\u002FIPS in shared environments.\n\n3. **Tech fingerprint:**\n   ```bash\n   whatweb -v $TARGET_URL > evidence\u002Fwhatweb.txt\n   curl -sIk $TARGET_URL > evidence\u002Fheaders.txt\n   ```\n\n4. **Endpoint discovery:**\n   - Crawl the app with the browser tool (`browser_navigate`,\n     `browser_get_images`, follow links).\n   - Inspect `robots.txt`, `sitemap.xml`, `.well-known\u002F*`.\n   - Use the developer tools network panel via browser tool to capture\n     XHR\u002Ffetch calls.\n\n5. **Auth surface:** Identify login, registration, password reset,\n   session cookie names, token formats. Do NOT send credentials yet —\n   just observe.\n\n6. **Correlate with pre-recon** (if you have source). For each\n   `evidence\u002Fpre-recon.md` finding, mark whether the live surface\n   confirms it's reachable.\n\nOutput: `evidence\u002Frecon.md` — endpoints, technologies, auth model,\ninput vectors.\n\n---\n\n## Phase 3: Vulnerability Analysis\n\nOne delegate_task per vulnerability class. Each agent reads\n`evidence\u002Frecon.md` (+ `evidence\u002Fpre-recon.md` if present), produces\n`findings\u002F\u003Cclass>-queue.json` using `templates\u002Fexploitation-queue.json`.\n\nUse `delegate_task` with these focused subagents (parallel where possible):\n\n| Class | Goal | Reference |\n|-------|------|-----------|\n| `injection` | SQLi, command, path traversal, SSTI, LFI\u002FRFI, deserialization | `references\u002Fvuln-taxonomy.md` (slot types) |\n| `xss` | Reflected, stored, DOM-based | `references\u002Fvuln-taxonomy.md` (render contexts) |\n| `auth` | Login bypass, JWT confusion, session fixation, OAuth flaws | `references\u002Fexploitation-techniques.md` |\n| `authz` | IDOR, vertical\u002Fhorizontal escalation, business logic | `references\u002Fexploitation-techniques.md` |\n| `ssrf` | Internal reachability, metadata, protocol smuggling | Skip metadata unless explicitly authorized |\n| `infra` | Misconfig, info disclosure, default creds, exposed admin | `references\u002Fexploitation-techniques.md` |\n\nEach queue entry has: id, vuln class, source (file:line if known),\nendpoint, parameter, slot type, suspected defense, verdict\n(`identified` \u002F `partial` \u002F `confirmed` \u002F `critical`), witness payload,\nconfidence (0-1), notes.\n\nThe analysis phase doesn't send malicious payloads yet — it stages them.\nThe exploitation phase actually fires them.\n\n---\n\n## Phase 4: Exploitation (Proof-Based, Conditional)\n\nOnly run a sub-agent per class where the analysis queue has actionable\nentries (`identified` or `partial`).\n\nFor each candidate:\n\n1. **Pre-send check** — host in scope? auth gate satisfied? payload\n   approved if destructive?\n2. **Send the witness payload** — minimal proof. SQLi: `' AND 1=1--`\n   then `' AND 1=2--`. XSS: a benign marker like\n   `\u003Csvg\u002Fonload=console.log(\"HERMES-PENTEST-XSS\")>`. Never `alert(1)` in\n   stored XSS — it'll fire for other users in shared environments.\n3. **Verify the witness fires** — for blind injection, use a sleep\n   probe (`SLEEP(5)`) and time the response. For SSRF, use a\n   tester-controlled callback host you own (NOT a public service like\n   webhook.site for sensitive engagements — exfil paths).\n4. **Promote level:**\n   - **L1 Identified** — pattern matched, no behavior change\n   - **L2 Partial** — sink reached, but defense in place\n   - **L3 Confirmed** — payload changed app behavior in observable way\n   - **L4 Critical** — data extracted, code executed, access escalated\n5. **Bypass exhaustion before classifying as FP.** For each candidate\n   that blocks: try at least the bypass set in\n   `references\u002Fbypass-techniques.md` for that class. Only after the set\n   is exhausted may you write `verdict: false_positive`.\n6. **Record evidence** for every L3\u002FL4:\n   - Full request (method, URL, headers, body)\n   - Response (status, headers, relevant body excerpt)\n   - Reproducer command (curl one-liner)\n   - Impact statement\n\nOutput: `findings\u002Fexploitation-evidence.md`\n\n**Redact in evidence files:**\n- Any captured credentials\u002Ftokens → last 6 chars only in chat;\n  full value to `findings\u002Fsecrets-vault.md` (gitignored).\n- Other users' PII → redact.\n- Your test credentials → fine to keep.\n\n---\n\n## Phase 5: Reporting\n\nGenerate the final report using `templates\u002Fpentest-report.md`. Sections:\n\n1. Executive summary\n2. Engagement scope (from `engagement\u002Fscope.txt`)\n3. Authorization (from `engagement\u002Fauthorization.md`)\n4. Findings (L3\u002FL4 only — proof-required). Per finding:\n   - Title, severity (CVSS 3.1), CWE\n   - Affected endpoint(s)\n   - Proof (request + response excerpt)\n   - Reproduction steps\n   - Impact\n   - Remediation\n5. Not-exploited candidates (L1\u002FL2 with notes on what blocked them)\n6. Out-of-scope observations\n7. Methodology \u002F tools used\n8. Limitations and what was NOT tested\n\n**Severity policy:** CVSS only for L3\u002FL4. L1\u002FL2 are \"candidates pending\nverification\" — don't assign CVSS to unverified findings.\n\n---\n\n## When to Stop\n\n- The user revokes authorization.\n- A candidate finding clearly impacts production data and you don't have\n  approval for destructive testing — STOP and ask.\n- The target starts returning 503\u002F429 storms — back off, reconvene with\n  the operator.\n- You discover something *outside* the contracted scope (e.g. an exposed\n  customer database while testing an unrelated endpoint). STOP, document,\n  report to the operator. Do not pivot without explicit approval — that\n  pivot is what makes pentesting illegal.\n\n---\n\n## What This Skill Does NOT Cover\n\n- Network-layer pentesting beyond port scanning (no Metasploit,\n  Cobalt Strike, AD attacks, network protocol fuzzing).\n- Reverse engineering \u002F binary analysis (see issue #383).\n- Source-only static analysis (see issue #382).\n- Active social engineering \u002F phishing.\n- Anything against systems the operator hasn't pre-authorized.\n\nIf the engagement needs any of these, escalate to a professional\npentester. This skill complements professional pentesting; it does\nnot replace it.\n\n---\n\n## Further Reading\n\n- `references\u002Fscope-enforcement.md` — how to bound every active request\n- `references\u002Fvuln-taxonomy.md` — slot types, render contexts, OWASP map\n- `references\u002Fexploitation-techniques.md` — per-class payload patterns\n- `references\u002Fbypass-techniques.md` — common WAF\u002Ffilter bypasses\n- `templates\u002Fauthorization.md` — engagement authorization template\n- `templates\u002Fpentest-report.md` — final report template\n- `templates\u002Fexploitation-queue.json` — per-class finding queue schema\n- `scripts\u002Frecon-scan.sh` — rate-limited nmap+whatweb+headers wrapper\n","# Web Application Penetration Testing\n\nA phased pentesting workflow for running web applications. Adapted from\nShannon's pipeline (Keygraph, AGPL — concepts only, no code borrowed).\nBuilt around three rules:\n\n1. No exploit, no report — every finding requires reproducible evidence.\n2. Bounded scope — every active request goes against a target the operator\n   pre-declared. Off-scope hosts are refused.\n3. Bypass exhaustion before false-positive dismissal — a \"blocked\" payload\n   is not a clean bill of health until you've tried the bypass set.\n\n---\n\n## ⚠️ Hard Guardrails — Read Before Every Engagement\n\nViolating any of these invalidates the engagement and may be illegal.\n\n1. **Authorization gate.** Before the first active scan in a session, you\n   MUST confirm with the user, in writing, that they own or have written\n   authorization to test the target. Record the acknowledgement in\n   `engagement\u002Fauthorization.md` (see template). No acknowledgement → no\n   active scanning. Reading public pages with `curl` is fine; sending\n   payloads is not.\n\n2. **Scope allowlist.** Maintain `engagement\u002Fscope.txt` — one hostname or\n   CIDR per line. Every `nmap`, `curl`, `whatweb`, browser navigation, or\n   payload-bearing request MUST be against an entry in scope. If a target\n   redirects you off-scope (3xx to a different host, a link in HTML),\n   STOP and confirm with the user before following.\n\n3. **No production systems without paper.** If the user hasn't told you\n   \"yes, prod is in scope and I have written sign-off,\" assume not. Default\n   targets are staging, local docker, dedicated test instances.\n\n4. **Cloud metadata is off by default.** Do not probe `169.254.169.254`,\n   `metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or\n   equivalent unless the engagement explicitly includes SSRF-to-metadata\n   as a goal AND the target is one you control. The agent's browser tool\n   can reach these from inside your own infrastructure — don't.\n\n5. **Destructive payloads need approval.** SQLi payloads that DROP\u002FDELETE,\n   filesystem-write SSTI, command injection with `rm`\u002F`shutdown`\u002F`mkfs`,\n   anything that mutates beyond a single test row → ASK FIRST. The\n   `approval.py` system catches some; don't rely on it alone.\n\n6. **Aux-client leakage risk (Hermes-specific).** This skill produces\n   sessions full of SQLi\u002FXSS\u002FRCE payloads, captured credentials, JWT\n   tokens. Hermes' compression and title-generation paths replay history\n   through the auxiliary client (often the main model). Anything sensitive\n   you write to the conversation can leave the box on the next compress.\n   Mitigation:\n   - Redact captured tokens\u002Fcredentials to the LAST 6 CHARS before logging\n     them in any message. Full values go to `engagement\u002Fevidence\u002F` files,\n     never into chat history.\n   - If the engagement is sensitive, set `auxiliary.title_generation.enabled: false`\n     in `~\u002F.hermes\u002Fconfig.yaml` for the session.\n\n7. **Rate limit yourself.** Default 200ms between active requests against\n   any single host. The recon-scan.sh script enforces this. Don't bypass\n   it without operator approval.\n\n8. **Authority of the report.** This skill produces a security\n   assessment, not a \"PASS.\" Even a clean run is \"no exploitable issues\n   FOUND in scope X within time T using methods Y\" — not \"the application\n   is secure.\" Mirror that language in the report.\n\n---\n\n## Phase 0: Engagement Setup\n\nBefore any scanning happens, create the engagement directory and\nauthorization acknowledgement.\n\n```bash\nENGAGEMENT=engagement-$(date +%Y%m%d-%H%M%S)\nmkdir -p \"$ENGAGEMENT\"\u002F{evidence,findings,reports}\ncd \"$ENGAGEMENT\"\n```\n\n1. **Ask the user (verbatim):**\n   > \"Confirm: (a) the target URL is [X], (b) you own this application\n   > or have written authorization to test it, and (c) the engagement\n   > may run for up to [N] hours starting now. Reply 'authorized' to\n   > proceed.\"\n\n2. **Wait for explicit `authorized` response.** Any other answer means STOP.\n\n3. **Record authorization** to `engagement\u002Fauthorization.md` using the\n   template in `templates\u002Fauthorization.md`. Include:\n   - Target URL(s) and IP(s)\n   - Authorization basis (ownership \u002F written authz from $name)\n   - Engagement window\n   - Out-of-scope items (production, third-party services, etc.)\n   - Operator name (the user driving this session)\n\n4. **Build scope.txt:**\n   ```\n   localhost\n   127.0.0.1\n   staging.example.com\n   192.168.1.0\u002F24    # internal lab only, with operator OK\n   ```\n\n5. **Read** `references\u002Fscope-enforcement.md` before issuing the first\n   active request — that doc has the host-extraction rules you apply\n   to every command\u002FURL before it goes out.\n\n---\n\n## Phase 1: Pre-Recon (Code Analysis, optional)\n\nSkip if no source access (black-box engagement).\n\nIf you have read access to the application source:\n\n1. **Map the architecture** — framework, routing, middleware stack\n2. **Inventory sinks** — every `execute(`, `os.system(`, `eval(`,\n   template render, file read\u002Fwrite, redirect target\n3. **Map auth** — session cookie vs JWT, OAuth flows, password reset,\n   privileged endpoints\n4. **Identify trust boundaries** — what's authenticated, what's not,\n   what comes from `request.*`\n5. **Backward taint** from each sink to a request source. Early-terminate\n   when proper sanitization is found (parameterized queries, allowlists,\n   `shlex.quote`, well-known escapers).\n\nOutput: `evidence\u002Fpre-recon.md` — architecture map, sink inventory,\nsuspected vulnerable code paths.\n\nThis is OFFLINE work. No traffic to the target.\n\n---\n\n## Phase 2: Recon (Live, Read-Only)\n\nMaps the attack surface. All requests are GETs of public pages, no\npayloads yet. Still scope-bounded.\n\n1. **Verify scope.** Resolve every target hostname → IP. Confirm IPs are\n   in scope (avoids the \"DNS points somewhere unexpected\" trap).\n\n2. **Network surface** (only if scope permits port scanning):\n   ```bash\n   nmap -sT -T3 --top-ports 100 -oN evidence\u002Fnmap.txt $TARGET\n   ```\n   Use `-T3` (default), not `-T4\u002F-T5`. Stealthier and avoids tripping\n   IDS\u002FIPS in shared environments.\n\n3. **Tech fingerprint:**\n   ```bash\n   whatweb -v $TARGET_URL > evidence\u002Fwhatweb.txt\n   curl -sIk $TARGET_URL > evidence\u002Fheaders.txt\n   ```\n\n4. **Endpoint discovery:**\n   - Crawl the app with the browser tool (`browser_navigate`,\n     `browser_get_images`, follow links).\n   - Inspect `robots.txt`, `sitemap.xml`, `.well-known\u002F*`.\n   - Use the developer tools network panel via browser tool to capture\n     XHR\u002Ffetch calls.\n\n5. **Auth surface:** Identify login, registration, password reset,\n   session cookie names, token formats. Do NOT send credentials yet —\n   just observe.\n\n6. **Correlate with pre-recon** (if you have source). For each\n   `evidence\u002Fpre-recon.md` finding, mark whether the live surface\n   confirms it's reachable.\n\nOutput: `evidence\u002Frecon.md` — endpoints, technologies, auth model,\ninput vectors.\n\n---\n\n## Phase 3: Vulnerability Analysis\n\nOne delegate_task per vulnerability class. Each agent reads\n`evidence\u002Frecon.md` (+ `evidence\u002Fpre-recon.md` if present), produces\n`findings\u002F\u003Cclass>-queue.json` using `templates\u002Fexploitation-queue.json`.\n\nUse `delegate_task` with these focused subagents (parallel where possible):\n\n| Class | Goal | Reference |\n|-------|------|-----------|\n| `injection` | SQLi, command, path traversal, SSTI, LFI\u002FRFI, deserialization | `references\u002Fvuln-taxonomy.md` (slot types) |\n| `xss` | Reflected, stored, DOM-based | `references\u002Fvuln-taxonomy.md` (render contexts) |\n| `auth` | Login bypass, JWT confusion, session fixation, OAuth flaws | `references\u002Fexploitation-techniques.md` |\n| `authz` | IDOR, vertical\u002Fhorizontal escalation, business logic | `references\u002Fexploitation-techniques.md` |\n| `ssrf` | Internal reachability, metadata, protocol smuggling | Skip metadata unless explicitly authorized |\n| `infra` | Misconfig, info disclosure, default creds, exposed admin | `references\u002Fexploitation-techniques.md` |\n\nEach queue entry has: id, vuln class, source (file:line if known),\nendpoint, parameter, slot type, suspected defense, verdict\n(`identified` \u002F `partial` \u002F `confirmed` \u002F `critical`), witness payload,\nconfidence (0-1), notes.\n\nThe analysis phase doesn't send malicious payloads yet — it stages them.\nThe exploitation phase actually fires them.\n\n---\n\n## Phase 4: Exploitation (Proof-Based, Conditional)\n\nOnly run a sub-agent per class where the analysis queue has actionable\nentries (`identified` or `partial`).\n\nFor each candidate:\n\n1. **Pre-send check** — host in scope? auth gate satisfied? payload\n   approved if destructive?\n2. **Send the witness payload** — minimal proof. SQLi: `' AND 1=1--`\n   then `' AND 1=2--`. XSS: a benign marker like\n   `\u003Csvg\u002Fonload=console.log(\"HERMES-PENTEST-XSS\")>`. Never `alert(1)` in\n   stored XSS — it'll fire for other users in shared environments.\n3. **Verify the witness fires** — for blind injection, use a sleep\n   probe (`SLEEP(5)`) and time the response. For SSRF, use a\n   tester-controlled callback host you own (NOT a public service like\n   webhook.site for sensitive engagements — exfil paths).\n4. **Promote level:**\n   - **L1 Identified** — pattern matched, no behavior change\n   - **L2 Partial** — sink reached, but defense in place\n   - **L3 Confirmed** — payload changed app behavior in observable way\n   - **L4 Critical** — data extracted, code executed, access escalated\n5. **Bypass exhaustion before classifying as FP.** For each candidate\n   that blocks: try at least the bypass set in\n   `references\u002Fbypass-techniques.md` for that class. Only after the set\n   is exhausted may you write `verdict: false_positive`.\n6. **Record evidence** for every L3\u002FL4:\n   - Full request (method, URL, headers, body)\n   - Response (status, headers, relevant body excerpt)\n   - Reproducer command (curl one-liner)\n   - Impact statement\n\nOutput: `findings\u002Fexploitation-evidence.md`\n\n**Redact in evidence files:**\n- Any captured credentials\u002Ftokens → last 6 chars only in chat;\n  full value to `findings\u002Fsecrets-vault.md` (gitignored).\n- Other users' PII → redact.\n- Your test credentials → fine to keep.\n\n---\n\n## Phase 5: Reporting\n\nGenerate the final report using `templates\u002Fpentest-report.md`. Sections:\n\n1. Executive summary\n2. Engagement scope (from `engagement\u002Fscope.txt`)\n3. Authorization (from `engagement\u002Fauthorization.md`)\n4. Findings (L3\u002FL4 only — proof-required). Per finding:\n   - Title, severity (CVSS 3.1), CWE\n   - Affected endpoint(s)\n   - Proof (request + response excerpt)\n   - Reproduction steps\n   - Impact\n   - Remediation\n5. Not-exploited candidates (L1\u002FL2 with notes on what blocked them)\n6. Out-of-scope observations\n7. Methodology \u002F tools used\n8. Limitations and what was NOT tested\n\n**Severity policy:** CVSS only for L3\u002FL4. L1\u002FL2 are \"candidates pending\nverification\" — don't assign CVSS to unverified findings.\n\n---\n\n## When to Stop\n\n- The user revokes authorization.\n- A candidate finding clearly impacts production data and you don't have\n  approval for destructive testing — STOP and ask.\n- The target starts returning 503\u002F429 storms — back off, reconvene with\n  the operator.\n- You discover something *outside* the contracted scope (e.g. an exposed\n  customer database while testing an unrelated endpoint). STOP, document,\n  report to the operator. Do not pivot without explicit approval — that\n  pivot is what makes pentesting illegal.\n\n---\n\n## What This Skill Does NOT Cover\n\n- Network-layer pentesting beyond port scanning (no Metasploit,\n  Cobalt Strike, AD attacks, network protocol fuzzing).\n- Reverse engineering \u002F binary analysis (see issue #383).\n- Source-only static analysis (see issue #382).\n- Active social engineering \u002F phishing.\n- Anything against systems the operator hasn't pre-authorized.\n\nIf the engagement needs any of these, escalate to a professional\npentester. This skill complements professional pentesting; it does\nnot replace it.\n\n---\n\n## Further Reading\n\n- `references\u002Fscope-enforcement.md` — how to bound every active request\n- `references\u002Fvuln-taxonomy.md` — slot types, render contexts, OWASP map\n- `references\u002Fexploitation-techniques.md` — per-class payload patterns\n- `references\u002Fbypass-techniques.md` — common WAF\u002Ffilter bypasses\n- `templates\u002Fauthorization.md` — engagement authorization template\n- `templates\u002Fpentest-report.md` — final report template\n- `templates\u002Fexploitation-queue.json` — per-class finding queue schema\n- `scripts\u002Frecon-scan.sh` — rate-limited nmap+whatweb+headers wrapper\n",{"name":5,"author":48,"license":15,"version":49,"category":40,"metadata":50,"toolsets":58,"triggers":59,"platforms":67,"description":7},"Teknium (teknium1), Hermes Agent","1.0.0",{"hermes":51},{"tags":52,"related_skills":57},[53,54,55,56],"Security","Pentest","Web","Recon",[],[42,26,27,34,36],[60,61,62,63,64,65,66],"pentest [URL]","pentest this app","penetration test [URL]","security test this web app","test [URL] for vulnerabilities","find vulns in [URL]","OWASP test [URL]",[41,35],"main","0d1434f89f4bc6b07e9d272accd8c1013768820f","archive\u002Fskill-md-reviewed\u002Fsha256\u002F0e\u002F0e2e199e97fe0145ea7d4ff70166755438c6491d9900793a13f1a64ff400a498",0,"https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills","https:\u002F\u002Fgithub.com\u002Fzapabob","The Open University of JAPAN　2019-now\r\n\r\nTokyo University of Science　2007-2010","2026-10-26 16:29:01",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add zapabob\u002FSkills --skill web-pentest",{"tool":82,"command":83},"bunx","bunx skills add zapabob\u002FSkills --skill web-pentest",{"tool":85,"command":86},"pnpm","pnpm dlx skills add zapabob\u002FSkills --skill web-pentest","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Farchive\u002Fskill-md-reviewed\u002Fsha256\u002F0e\u002F0e2e199e97fe0145ea7d4ff70166755438c6491d9900793a13f1a64ff400a498\u002FSKILL.md",true,[],[91,123,158,185,212,228],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":108,"publishedAt":43},"01M6GJTE1GESGGF9K028Y7753E","xurl","X\u002FTwitter via xurl CLI: post, search, DM, media, v2 API.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fxurl\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[97,100,103],{"categoryNo":98,"categoryName":99,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":101,"categoryName":102,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":104,"categoryName":105,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[93,109,35,110,111,41,112,113,114,115,116,117,118,32,31,119,68,120,121,122],"openclaw","cli","github","windows","official","search","https","social-media","api","Media","twitter","social","via","post",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":140,"publishedAt":43},"01M6GJT8S1PXQ8WPXT1HSNBWH2","writing-plans","Write implementation plans: bite-sized tasks, paths, code.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwriting-plans\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[129,132,135,136,137],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":101,"categoryName":102,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":104,"categoryName":105,"taxonomyType":106,"taxonomyTypeDesc":107},{"categoryNo":138,"categoryName":139,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000036","内容创作者",[141,142,143,144,35,145,41,146,112,147,148,149,150,151,152,153,154,155,156,157],"writing","writing plans","plans","design","review","workflow","documentation","tasks","development","code","planning","code-review","subagent","write","superpowers","paths","test-driven-development",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":167,"publishedAt":43},"01M6GJST0H5X7WHBJ3BZK0DVKH","whisper","OpenAI's general-purpose speech recognition model. Supports 99 languages, transcription, translation to English, and language identification. Six model sizes from tiny (39M params) to large (1550M params). Use for speech-to-text, podcast transcription, or multilingual audio processing. Best for robust, multilingual ASR.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwhisper\u002Fvariants\u002Fhermes-agent-optional\u002FSKILL.md",[164],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[160,35,41,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184],"openai","speech","multimodal","Transformers","ASR","Audio","text","model","speech recognition","use","general","multilingual","translation","english","identification","processing","Audio Processing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":194,"publishedAt":43},"01M6GJSMRQ8EETZTYMG72P70EA","weights-and-biases","W&B: log ML experiments, sweeps, model registry, dashboards.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fweights-and-biases\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[191],{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化",[195,35,196,197,112,198,199,200,201,202,203,175,204,205,206,207,208,209,210,211],"weights and biases","tensorflow","experiments","pytorch","visualization","registry","real-time","tuning","dashboards","experiment","log","time","Experiment Tracking","Model Registry","Hyperparameter Tuning","WandB","Real-Time Visualization",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":43},"01M6GJS19KDPRY112JTR326S06","watchers","Poll RSS, JSON APIs, and GitHub with watermark dedup.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwatchers\u002Fvariants\u002Fhermes-agent-optional\u002FSKILL.md",[218],{"categoryNo":101,"categoryName":102,"taxonomyType":21,"taxonomyTypeDesc":22},[214,35,42,111,41,220,221,222,223,224,225,32,31,226,227],"automation","http","monitoring","cron","json","rss","devops","with",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":236,"publishedAt":43},"01M6GJRHJD2A6Q830SWF9W48BC","serving-llms-vllm","vLLM: high-throughput LLM serving, OpenAI API, quantization.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fvllm\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[234,235],{"categoryNo":98,"categoryName":99,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":104,"categoryName":105,"taxonomyType":106,"taxonomyTypeDesc":107},[237,238,239,41,240,168,241,242,243,171,244,117,245,246,247,248,249,250,251,252],"llms","vLLM","serving llms vllm","research","openai api","tensor","Inference Serving","Production","llm serving","High Throughput","PagedAttention","Continuous Batching","Quantization","Tensor Parallelism","high-throughput","throughput"]