pentest-playbook

1# Pentest Playbook Skill
2 
37-phase master pentest pipeline covering the full lifecycle from passive reconnaissance to exploitation and reporting. Distilled from 100+ targets across government, healthtech, fintech, e-commerce, ISP, and SMB sectors. This is the "meta-playbook" — it tells you what to do at each stage of an engagement and which skills to load for each phase.
4 
5## When to Use
6 
7- Starting a new pentest engagement with an unknown target.
8- You need the canonical workflow for any type of target.
9- After surface recon — this playbook tells you what to do next.
10- Training — understand the full lifecycle of a professional pentest.
11 
12## Prerequisites
13 
14- Explicit authorization, target boundaries, and rate limits for the target.
15- Tooling: `curl`, `httpx`, `jq`, `masscan`, `mysql`, `nmap`, `proxychains`, `rustscan`, `subfinder`.
16- A writable evidence directory: `export OUTPUT_DIR="${OUTPUT_DIR:-./output}" && mkdir -p "$OUTPUT_DIR"`.
17- For any state-changing step (writes, uploads, credential attempts), obtain explicit confirmation immediately before the command.
18 
19## How to Run
20 
21```bash
22# Set once per engagement; every step below uses these.
23TARGET="example.com"   # or the engagement target
24export OUTPUT_DIR="${OUTPUT_DIR:-./output}"
25 
26# 1. Subdomain enumeration
27subfinder -d $TARGET -silent | tee subs.txt
28curl --max-time 30 --connect-timeout 10 -s "https://crt.sh/?q=%.$TARGET&output=json" | jq -r '.[].name_value' >> subs.txt
29 
30# 2. Tech stack detection via response headers
31…