offensive-security

01 前言 Front Matter

name

offensive-security

retry

{ "delays": [ 2000, 4000, 8000 ], "enabled": true, "strategy": "exponential_backoff", "max_attempts": 3, "retryable_errors": [ "E_NETWORK_TIMEOUT", "E_CONNECTION_RESET", "E_RATE_LIMITED" ], "non_retryable_errors": [ "E_NO_AUTHORIZATION", "E_SCOPE_VIOLATION", "E_TARGET_BLOCKED" ] }

errors

{ "E_WAF_BLOCKED": { "code": 2003, "message": "Web Application Firewall blocking requests", "recovery": "Modify payloads, use evasion techniques" }, "E_RATE_LIMITED": { "code": 2002, "message": "Target is rate limiting requests", "recovery": "Apply exponential backoff, reduce scan intensity" }, "E_INVALID_TARGET": { "code": 1001, "message": "Invalid target format", "recovery": "Verify target URL or IP format" }, "E_NETWORK_TIMEOUT": { "code": 2001, "message": "Network connection timed out", "recovery": "Check network connectivity, retry with backoff" }, "E_SCOPE_VIOLATION": { "code": 1003, "message": "Target outside authorized scope", "recovery": "Update scope definition or select valid target" }, "E_NO_AUTHORIZATION": { "code": 1002, "message": "Authorization proof not provided", "recovery": "Provide written authorization before testing" } }

bond_type

PRIMARY_BOND

operations

{ "test_injection": { "input": { "endpoint": { "type": "string", "required": true }, "payloads": { "type": "array", "default": "standard_set" }, "injection_type": { "type": "enum", "values": [ "sql", "xss", "command", "ldap" ], "required": true } }, "atomic": true, "output": { "evidence": "string", "vulnerable": "boolean", "payload_used": "string" }, "description": "Test for injection vulnerabilities (SQLi, XSS, Command)" }, "enumerate_services": { "input": { "host": { "type": "string", "required": true }, "port_range": { "type": "string", "default": "1-65535" } }, "atomic": true, "output": { "services": "array<Service>", "os_detection": "string" }, "description": "Enumerate running services and versions" }, "scan_vulnerability": { "input": { "depth": { "type": "enum", "values": [ "quick", "standard", "deep" ], "default": "standard" }, "target": { "type": "string", "required": true }, "scan_type": { "type": "enum", "values": [ "web", "network", "api" ], "default": "web" } }, "atomic": true, "output": { "coverage": "float", "scan_time": "integer", "vulnerabilities": "array<Vulnerability>" }, "description": "Scan target for known vulnerabilities" }, "test_authentication": { "input": { "target": { "type": "string", "required": true }, "test_type": { "type": "enum", "values": [ "brute", "session", "token", "mfa_bypass" ], "required": true } }, "atomic": true, "output": { "findings": "array<Finding>", "weak_creds": "array<Credential>" }, "description": "Test authentication mechanisms" } }

validation

{ "rules": [ { "name": "target_format", "error": "E_INVALID_TARGET", "pattern": "^(https?://|\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|[a-zA-Z0-9.-]+)$" }, { "name": "port_range_format", "error": "E_INVALID_PORT_RANGE", "pattern": "^\\d+-\\d+$|^\\d+(,\\d+)*$" }, { "name": "authorization_required", "check": "authorization_proof != null", "error": "E_NO_AUTHORIZATION" } ], "sanitization": [ { "strip_dangerous_chars": true }, { "validate_url_encoding": true }, { "check_path_traversal": true } ] }

description

Penetration testing, ethical hacking, and vulnerability assessment techniques for authorized security testing

bonded_agent

01-offensive-security

last_updated

2025-01-01

bond_strength

1

observability

{ "logging": { "level": "info", "fields": [ "timestamp", "operation", "target", "result", "duration_ms" ], "format": "structured_json", "sensitive_fields": [ "credentials", "tokens", "payloads" ] }, "metrics": [ { "name": "scan_duration", "type": "histogram", "labels": [ "scan_type", "target_type" ] }, { "name": "vulnerabilities_found", "type": "counter", "labels": [ "severity", "category" ] }, { "name": "operations_total", "type": "counter", "labels": [ "operation", "status" ] } ], "tracing": { "enabled": true, "sample_rate": 0.1 } }

sasmp_version

1.3.0

production_grade

true

02 资源文件 3

• 资产文件assets/pentest_config.yaml374 B
• 参考文档references/PENTEST_GUIDE.md389 B
• 脚本scripts/vuln_scanner.py398 B

03 SKILL.md 正文

┌─────────────────────────────────────────────────────────────────┐
│                    SKILL OPERATIONS                             │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐     │
│  │scan_vuln    │  │test_inject  │  │enumerate_services   │     │
│  │             │  │             │  │                     │     │
│  │ Input:      │  │ Input:      │  │ Input:              │     │
│  │  - target   │  │  - endpoint │  │  - host             │     │
│  │  - type     │  │  - type     │  │  - port_range       │     │
│  │  - depth    │  │  - payloads │  │                     │     │
│  │             │  │             │  │ Output:             │     │
│  │ Output:     │  │ Output:     │  │  - services[]       │     │
│  │  - vulns[]  │  │  - vuln     │  │  - os_detect        │     │
│  │  - time     │  │  - evidence │  │                     │     │
│  └─────────────┘  └─────────────┘  └─────────────────────┘     │
│                                                                 │
│  ┌─────────────────────────────────────────┐                   │
│  │ test_authentication                      │                   │
│  │                                          │                   │
│  │ Input: target, test_type                 │                   │
│  │ Output: findings[], weak_creds[]         │                   │
│  └─────────────────────────────────────────┘                   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Scan Failed
    │
    ├─► E_NETWORK_TIMEOUT
    │   ├── Check: ping/traceroute target
    │   ├── Action: Increase timeout, use retry
    │   └── Escalate: If persistent, check firewall
    │
    ├─► E_RATE_LIMITED
    │   ├── Check: Response headers for rate info
    │   ├── Action: Apply exponential backoff
    │   └── Escalate: Reduce concurrency
    │
    ├─► E_WAF_BLOCKED
    │   ├── Check: Response body for WAF signature
    │   ├── Action: Modify payloads, encoding
    │   └── Escalate: Document WAF presence
    │
    └─► E_NO_AUTHORIZATION
        └── STOP: Cannot proceed without authorization

# tests/test_offensive_skill.py
import pytest
from skills.offensive import OffensiveSecurity

class TestVulnerabilityScan:
    def test_valid_web_target(self):
        skill = OffensiveSecurity()
        result = skill.scan_vulnerability(
            target="http://testsite.local",
            scan_type="web",
            depth="quick"
        )
        assert result.status == "success"
        assert isinstance(result.vulnerabilities, list)

    def test_invalid_target_format(self):
        skill = OffensiveSecurity()
        with pytest.raises(ValidationError) as exc:
            skill.scan_vulnerability(target="invalid!!!")
        assert exc.value.code == "E_INVALID_TARGET"

    def test_authorization_required(self):
        skill = OffensiveSecurity(authorization=None)
        with pytest.raises(AuthorizationError) as exc:
            skill.scan_vulnerability(target="http://target.com")
        assert exc.value.code == "E_NO_AUTHORIZATION"