Do I need permission before running a test?

Yes. Only test systems you own or have explicit permission to assess.

What should I run first?

Start with `recon`. It maps the attack surface and creates the session used by the later tests.

What kinds of issues does it look for?

It covers injection, XSS, SSRF, authentication problems, misconfigurations, and related web app weaknesses.

How do I get a readable report?

Use `generate_report` at the end of the workflow. You can choose markdown for reading or JSON for structured output.

Penetration Testing

Penetration Testing is a black-box web application security testing tool that crawls your app's attack surface, scans for misconfigurations, and tests for the most common and damaging vulnerability classes — all powered by AI-generated payloads. It produces a structured report with severity ratings, proof-of-concept evidence, and remediation guidance.

The tool follows the standard penetration testing workflow: reconnaissance first to map endpoints and input surfaces, then targeted testing for injection, XSS, authentication bypass, and SSRF. AI reasoning is used to generate context-aware payloads rather than generic pattern matching, which means it finds vulnerabilities that signature-based scanners miss.

Important: Only use this tool on systems you own or have explicit written permission to test. Unauthorised security testing is illegal.

What you can do

Crawl any web app to map its full attack surface — endpoints, forms, auth flows, tech stack
Scan for security headers, exposed paths, server disclosure, and TLS issues
Test for SQL injection, NoSQL injection, and command injection with AI-generated payloads
Test for reflected and stored Cross-Site Scripting in HTML, attribute, and JavaScript contexts
Test for authentication bypass, IDOR, and privilege escalation
Test URL-accepting parameters for Server-Side Request Forgery
Generate a structured report with executive summary, severity breakdown, and remediation steps

Who it's for

Security engineers, developers, bug bounty hunters, and DevSecOps teams who need to validate their applications against real attack vectors before release or as part of ongoing security reviews.

How to use it

Start with recon to map the attack surface — this returns a session object for all subsequent skills
Run scan_vulnerabilities to check headers, exposed paths, and TLS configuration
Use test_injection, test_xss, test_auth, and test_ssrf — each requires authorized: true
Finish with generate_report to compile all findings into a readable report