SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsessential-tools

essential-tools

General & other

View repository

Updated 10-15 23:25

About this skill

Essential Tools

Core tools, methodology, and reporting standards for penetration testing.

Components

Component Purpose
Burp Suite Proxy, scanner, intruder, repeater, sequencer
Playwright Browser automation, evidence capture, SPA testing
Binary Analysis Static analysis, reverse engineering, string extraction
Nuclei Templated exposure & misconfiguration scanning
sslscan TLS posture (protocols, ciphers, cert)
Methodology PTES, OWASP WSTG, attack prioritization
Reporting Professional report templates, PDF generation

Reference

  • reference/essential-skills*.md - Burp Suite techniques and web security testing methodology
  • reference/playwright-automation.md - Playwright MCP usage for pentesting
  • reference/binary-analysis-quickstart.md - Static analysis for executable files and reverse engineering
  • reference/web-application-attacks.md - Web application attack methodology
  • formats/transilience-report-style/pentest-report.md - Finding quality standards, compliance mapping, and pre-delivery checklist

Required-at-start tooling (web/API engagements)

Run an availability check before declaring recon complete:

command -v subfinder nuclei sslscan httpx; curl -s "https://crt.sh/?q=%25.${DOMAIN}&output=json" | head -c1

  • Subdomain/CT enum: subfinder, certspotter, crt.sh
  • TLS posture: sslscan
  • Templated exposure: nuclei

If a tool-class is unavailable, record it as an explicit limitation — NEVER declare recon COMPLETE having skipped a whole class. Hand-rolled urllib is not a substitute (see skills/coordination/reference/principles.md 'Real tools before hand-rolled HTTP').