Loading...
Loading...
Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.
Reference Questions:
| Type | Purpose | Scope | |------|---------|-------| | External Pentest | Assess external attack surface | Public-facing systems | | Internal Pentest | Assess insider threat risk | Internal network | | Web Application | Find application vulnerabilities | Specific applications | | Social Engineering | Test human security | Employees, processes | | Red Team | Full adversary simulation | Entire organization |
| Factor | Consideration | |--------|---------------| | Asset Value | Higher value = higher investment | | Complexity | More systems = more time | | Depth Required | Thorough testing costs more | | Reputation Value | Brand-name firms cost more |
Budget Reality Check:
Environment Options:
Production - Realistic but risky
Staging - Safer but may differ from production
Clone - Ideal but resource-intensive
Common Pre-Scan Tools:
# Network vulnerability scan
nmap -sV --script vuln TARGET
# Web vulnerability scan
nikto -h http://TARGET
Cloud Provider Policies:
Evaluation Criteria:
| Factor | Questions to Ask | |--------|------------------| | Experience | Years in field, similar projects | | Methodology | OWASP, PTES, custom approach | | Reporting | Sample reports, detail level | | Communication | Availability, update frequency |
Testing Approaches:
| Type | Access Level | Simulates | |------|-------------|-----------| | Black Box | No information | External attacker | | Gray Box | Partial access | Insider with limited access | | White Box | Full access | Insider/detailed audit |
Report Should Include:
Monitoring Tools:
# Check security logs
tail -f /var/log/auth.log
tail -f /var/log/apache2/access.log
# Monitor network
tcpdump -i eth0 -w capture.pcap
Key Logs to Monitor:
Testing Frequency Factors:
□ Scope defined and documented
□ Authorization obtained
□ Environment prepared
□ Hosting provider notified
□ Team briefed
□ Monitoring enabled
□ Backups verified
□ Report received and reviewed
□ Findings prioritized
□ Remediation assigned
□ Fixes implemented
□ Verification testing scheduled
□ Environment cleaned up
□ Next test scheduled
**Target:** Corporate web application (app.company.com)
**Type:** Gray box web application pentest
**Duration:** 5 business days
**Excluded:** DoS testing, production database access
**Access:** Standard user account provided
# Enable comprehensive logging
sudo systemctl restart rsyslog
sudo systemctl restart auditd
# Start packet capture
tcpdump -i eth0 -w /tmp/pentest_capture.pcap &
| Issue | Solution | |-------|----------| | Scope creep | Document and require change approval | | Testing impacts production | Schedule off-hours, use staging | | Findings disputed | Provide detailed evidence, retest | | Remediation delayed | Prioritize by risk, set deadlines | | Budget exceeded | Define clear scope, fixed-price contracts |
Pentest Checklist is an expert AI persona designed to improve your coding workflow. This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements. It provides senior-level context directly within your IDE.
To install the Pentest Checklist skill, download the package, extract the files to your project's .cursor/skills directory, and type @pentest-checklist in your editor chat to activate the expert instructions.
Yes, the Pentest Checklist AI persona is completely free to download and integrate into compatible Agentic IDEs like Cursor, Windsurf, Github Copilot, and Anthropic MCP servers.
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.
Download Skill Package.cursor/skills@pentest-checklist in editor chat.Copy the instructions from the panel on the left and paste them into your custom instructions setting.
"Adding this Pentest Checklist persona to my Cursor workspace completely changed the quality of code my AI generates. Saves me hours every week."
Developers who downloaded Pentest Checklist also use these elite AI personas.
Expert in building 3D experiences for the web - Three.js, React Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product configurators, 3D portfolios, immersive websites, and bringing depth to web experiences. Use when: 3D website, three.js, WebGL, react three fiber, 3D experience.
Structured guide for setting up A/B tests with mandatory gates for hypothesis, metrics, and execution readiness.
You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance.
Explore our most popular utilities designed for the modern Indian creator.