git clone https://github.com/frendysanusi/claude-pentest-skills.git
cd claude-pentest-skills

# Burp Suite MCP
cp .mcp.json.example .mcp.json
# Edit with your local paths

# PDF report generation
python3 -m venv .venv
.venv/bin/pip install markdown weasyprint

claude                          # Start Claude Code in the project dir

/scope target.com               # Define authorization (REQUIRED first step)
/recon target.com               # Map attack surface
/hunt injection                 # Test for SQLi, NoSQLi, CMDi, SSTI, XXE
/validate                       # 6-gate quality check
/report --full                  # Generate pentest report

                         YOU
                          |
                    ┌─────▼─────┐
                    │   Claude  │ <── Burp MCP (optional)
                    │   Code    │
                    └─────┬─────┘
                          |
          ┌───────────────┼───────────────┐
          |               |               |
    ┌─────▼──────┐  ┌──────▼─────┐  ┌─────▼─────┐
    │   Recon    │  │   Hunter   │  │ Validator │
    │   Agent    │  │   Agent    │  │   Agent   │
    └─────┬──────┘  └──────┬─────┘  └─────┬─────┘
          |                |              |
    curl / Burp       payloads/      6-gate check
    JS analysis                      PASS / REJECT
    tech fingerprint                 NEEDS-WORK
          |               |               |
    ┌─────▼───────────────▼───────────────▼──────┐
    │           engagements/<target>/            │
    │                                            │
    │  scope.md · findings.md · payload-log.md   │
    │  coverage.md · tech-stack.md · notes.md    │
    └────────────────────────────────────────────┘
                          |
                    ┌─────▼─────┐
                    │  /report  │ ──> Markdown + PDF
                    └───────────┘

/hunt injection        # SQLi, NoSQLi, CMDi, SSTI, XXE
/hunt auth-access      # IDOR, JWT, OAuth, privilege escalation
/hunt server-side      # SSRF, path traversal, file upload, deserialization
/hunt client-side      # XSS, CSRF, open redirect
/hunt session          # Session fixation, token weakness, cookie security
/hunt business-logic   # Race conditions, workflow bypass, logic flaws
/hunt config           # Headers, CORS, TLS, info disclosure
/hunt ai-llm           # Prompt injection, LLM tool abuse, system prompt leakage

# Or target specific sub-classes:
/hunt sqli             /hunt xss              /hunt ssrf
/hunt idor             /hunt jwt              /hunt prompt-injection

Finding ──> Gate 1: Reproducible PoC?
            Gate 2: HTTP evidence captured?
            Gate 3: Impact verified (not theoretical)?
            Gate 4: Target in scope?
            Gate 5: Real vulnerability (not informational)?
            Gate 6: Client can reproduce it?
                         │
              ┌──────────┼──────────┐
              │          │          │
          VALIDATED   REJECTED  NEEDS-WORK
          (→ report)  (killed)  (fix & retry)

claude-pentest-skills/
├── commands/
│   ├── scope.md            #   /scope — define target authorization
│   ├── recon.md            #   /recon — map attack surface
│   ├── hunt.md             #   /hunt — test vulnerability class
│   ├── validate.md         #   /validate — 6-gate quality check
│   ├── report.md           #   /report — generate pentest report
│   └── status.md           #   /status — engagement dashboard
│
├── agents/                 # Agent persona definitions
│   ├── recon-agent.md
│   ├── hunter-agent.md
│   └── validator-agent.md
│
├── skills/
│   ├── recon.md            #   Reconnaissance phases
│   ├── validate.md         #   6-gate validation process
│   ├── report.md           #   Report templates + CVSS guide
│   └── hunting/            #   Per-vuln-class methodology
│       ├── injection.md    │   auth-access.md  │  server-side.md
│       ├── client-side.md  │   session.md      │  business-logic.md
│       ├── config.md       │   ai-llm.md
│
├── payloads/               # Methodology + payload references
│   ├── sqli.md  │ xss.md  │ ssrf.md  │ ssti.md  │ xxe.md
│   ├── cmdi.md  │ idor.md │ jwt.md   │ oauth.md │ nosqli.md
│   ├── csrf.md  │ path-traversal.md   │ file-upload.md
│   ├── deserialization.md  │ open-redirect.md
│   ├── request-smuggling.md│ race-condition.md
│   └── prompt-injection.md
│
├── mcp/                    # MCP server integration docs
│   └── burp-suite/         #   Burp Suite proxy setup
│
├── tools/                  # Utilities
│   └── md2pdf.py           #   Markdown → styled PDF report
│
├── engagements/            # Per-target state (gitignored)
│   └── <target>/
│       ├── scope.md        │ findings.md    │ payload-log.md
│       ├── coverage.md     │ tech-stack.md  │ notes.md
│       └── report-*.md / report-*.pdf
│
├── local-payloads/         # Full curated payloads (gitignored)
├── CLAUDE.md               # Master config for Claude Code
└── .mcp.json.example       # MCP config template

mkdir local-payloads
# Add your curated .md files with full payloads here
# The hunt skills will reference both payloads/ and local-payloads/

 1. SCOPE FIRST         /scope must run before any other command
 2. CHECK EVERY REQUEST verify against scope.md before sending
 3. LOG BEFORE ANALYZE  write payload to log BEFORE reading response
 4. NO OUT-OF-SCOPE     refuse requests to excluded domains/paths
 5. ASK IF UNCERTAIN    stop and confirm with user when scope is ambiguous
 6. WARN ON DESTRUCTIVE get explicit approval for DELETE/data modification