Security Testing Skill

Pi sub-agent for professional security assessments. Uses nmap NSE, CVE databases, and proper exploit workflows.

Methodology

Phase 1: Reconnaissance & Scanning

Always use nmap NSE scripts first — they detect known vulnerabilities automatically before manual probing.

# Step 1: Host discovery
nmap -sn <target_network>/24 -oG - | grep "Up"

# Step 2: Version detection + NSE vuln scan (THE MOST IMPORTANT STEP)
nmap -sV --script=vuln -p- <target_ip>

# Step 3: Specific service scanning with targeted NSE scripts
nmap -sV --script="http-enum,http-headers,http-title,http-webdav-scan" -p 80,443,8080,8443 <target_ip>
nmap -sV --script="smb-enum*,smb-vuln*" -p 445 <target_ip>
nmap -sV --script="ssh-auth-methods,ssh2-enum-algos" -p 22 <target_ip>
nmap -sV --script="ftp-anon,ftp-brute,ftp-vsftpd-backdoor" -p 21 <target_ip>
nmap -sV --script="mysql-enum,mysql-vuln*" -p 3306 <target_ip>

# Step 4: Full port scan with service version
nmap -sT -sV -p- --min-rate=1000 <target_ip>

Phase 2: Service Enumeration

For each discovered service, use the appropriate tool:

# HTTP/HTTPS
curl -sI http://<target>/
curl -s http://<target>/robots.txt
nmap --script=http-enum,http-title,http-headers,http-config-backup -p 80,443 <target>

# For web apps: directory brute-force
# For APIs: check common endpoints (/api, /v1, /graphql, /swagger)

# For network shares
smbclient -L //<target> -N

# For databases
# Check default credentials

Phase 3: CVE Research

When you find a service/version, search for known exploits:

# Use code_search/web_search for CVEs
# /search <product> <version> CVE exploit
# /code_search <product> <version> vulnerability poc

For each CVE found:

1. Check if the service version matches the affected range
2. Search GitHub for PoC/exploit code
3. Test the exploit against the target

Phase 4: Exploit Validation

When testing exploits:

1. Understand the exploit first — Read the PoC code, understand what it does
2. Test non-destructively first — Prefer info leaks over crashes
3. Document findings — What worked, what didn't, what's the impact

Tool Usage Reference

nmap NSE Categories

vuln              — Check for known vulnerabilities
exploit           — Attempt exploitation
auth              — Authentication bypass detection
brute             — Brute force credentials
intrusive         — May crash services (use with caution)
safe              — Won't crash services
default           — Default scripts
discovery         — Service/network discovery
dos               — Denial of service (DESTRUCTIVE!)

Quick Scan Profiles

# Quick vulnerability scan
nmap-vulns() { nmap -sV --script=vuln --min-rate=500 "$@"; }

# Full service enumeration
nmap-full() { nmap -sT -sV -p- --min-rate=1000 "$@" -oN "$1.nmap"; }

# Web server deep scan
nmap-web() { nmap -sV --script="http-*,ssl-*,html-*" -p 80,443,8080,8443 "$@"; }

# Quick check all common ports
nmap-quick() { nmap -sT -sV -p 21,22,23,53,80,443,445,631,8080,8443,3306,5432,6379,27017 "$@"; }

Protocol-Specific Checks

# SNMP
nmap -sU -p 161 --script=snmp-* <target>

# DNS
nmap -sU -p 53 --script=dns-* <target>

# RDP (Windows)
nmap -p 3389 --script=rdp-* <target>

# SMB (Windows)
nmap -p 445 --script=smb-* <target>

Important Notes

1. Always check if the service version is in the affected range — Don't just try exploits blindly
2. Use web_search/code_search for CVE details — The model doesn't know all CVEs by heart
3. Prefer nmap NSE scripts over manual probing — They're pre-verified and non-destructive
4. For complex exploit chains, use deepseek-reasoner — Switch with /model deepseek-reasoner
5. Document findings in ~/pi_learnings.md — So you learn from each assessment