---
name: pentest-methodology-ebca043ebe9b
description: Ethical security testing methodology - 5-phase pipeline, OWASP checklist, proof levels, structured findings
---

# Pentest Methodology

Etik guvenlik testi metodolojisi. Shannon framework'unden adapte.

**ONEMLI**: Bu skill sadece YETKILI guvenlik testleri icin kullanilir. Bug bounty, pentest anlasmasi, veya kendi sisteminiz olmali.

## 5-Faz Pipeline

```
Phase 1: Recon ──▶ Phase 2: Vuln Analysis ──▶ Phase 3: Exploitation
                                                        │
Phase 5: Report ◀── Phase 4: Verification ◀────────────┘
```

### Phase 1: Reconnaissance (Kesfetme)

| Adim | Arac/Yontem | Cikti |
|------|-------------|-------|
| Subdomain enum | DNS brute, certificate transparency | Subdomain listesi |
| Port scan | nmap, masscan | Acik portlar |
| Tech stack | Wappalyzer, HTTP headers | Teknoloji listesi |
| Directory enum | ffuf, gobuster | Endpoint listesi |
| API discovery | Swagger/OpenAPI, sitemap | API endpoint'leri |
| Source review | JS dosyalari, comments | Hardcoded info |

### Phase 2: Vulnerability Analysis

OWASP Top 10 kontrol matrisi:

| # | Vuln | Test Yontemi |
|---|------|-------------|
| A01 | Broken Access Control | IDOR, privilege escalation, path traversal |
| A02 | Cryptographic Failures | SSL config, weak ciphers, plaintext storage |
| A03 | Injection | SQLi, XSS, command injection, template injection |
| A04 | Insecure Design | Business logic flaws, race conditions |
| A05 | Security Misconfiguration | Default creds, verbose errors, CORS |
| A06 | Vulnerable Components | CVE scan, outdated dependencies |
| A07 | Auth Failures | Brute force, session fixation, JWT attacks |
| A08 | Data Integrity | Deserialization, CI/CD pipeline attacks |
| A09 | Logging Failures | Log injection, insufficient audit trail |
| A10 | SSRF | Internal service access, cloud metadata |

### Phase 3: Exploitation (Dogrulama)

Her bulgu icin:
1. **Reproduce**: Tekrarlanabilir adimlar yaz
2. **Proof**: Etkiyi goster (ekran goruntusu, response)
3. **Impact**: Gercek etki ne? (Data leak, RCE, account takeover)
4. **Scope**: Etki alani ne kadar genis?

### Phase 4: Verification

Bulgunun gercek oldugunu dogrula:
- False positive degil mi? Farkli kosullarda tekrarla
- Scope dogru mu? Sadece bir endpoint mi, yoksa sistemik mi?
- Severity dogru mu? Etkiyi abartma, kucumseme

### Phase 5: Report

Yapilandirilmis bulgu formati (asagida)

## Proof Levels

| Level | Tanim | Ornek |
|-------|-------|-------|
| L1 - Theoretical | Potansiyel risk, exploit edilmemis | "Bu endpoint input validate etmiyor" |
| L2 - Demonstrated | Bypass/leak gosterildi | "SQL injection ile hata mesaji leak etti" |
| L3 - Exploited | Tam exploit, veri erisimi | "Admin panel'e yetkisiz erisim saglandi" |
| L4 - Chained | Birden fazla vuln zincirlendi | "XSS + CSRF = Account takeover" |

## Structured Finding Format

```markdown
## [SEVERITY] Finding Title

**ID**: FINDING-001
**Severity**: Critical / High / Medium / Low / Informational
**Proof Level**: L1 / L2 / L3 / L4
**CVSS**: X.X (hesapla: cvss.org)
**CWE**: CWE-XXX

### Description
Ne bulundu, tek paragraf.

### Impact
Exploit edilirse ne olur?

### Steps to Reproduce
1. [Adim 1]
2. [Adim 2]
3. [Adim 3]

### Proof
[Screenshot, HTTP request/response, veya kod]

### Remediation
Nasil duzeltilir?

### References
- [OWASP link]
- [CWE link]
```

## Source-to-Sink Taint Tracing

Kullanici input'unun tehlikeli bir fonksiyona ulasip ulasamadigini kontrol et:

```
Source (Input)        ──▶  Transform/Sanitize?  ──▶  Sink (Tehlikeli fonksiyon)
req.body.username     ──▶  Validation var mi?    ──▶  db.query(...)
req.query.redirect    ──▶  URL whitelist var mi?  ──▶  res.redirect(...)
req.headers.host      ──▶  Sanitize var mi?      ──▶  fetch(...)
```

**Source'lar**: req.body, req.query, req.params, req.headers, cookies, file uploads
**Sink'ler**: SQL query, eval(), exec(), redirect(), innerHTML, dangerouslySetInnerHTML

## Agent Entegrasyonu

- **security-analyst**: Bu pipeline'i kullanarak tam guvenlik auditi yapar
- **security-reviewer**: Code review sirasinda vuln pattern'lerini kontrol eder
- **code-reviewer**: Security-relevant code degisikliklerinde flag kaldirir

## Kurallar

- Yetki olmadan test YAPMA
- Rate limiting'e uy, sistemi cokertme
- Buldugun seyi raporla, exploit etme (beyond PoC)
- Hassas verileri rapordan cikar (maskeleme)
- Remediation onerisi ZORUNLU


---
Source attribution: vibeeval
Original project: https://github.com/vibeeval/vibecosystem/blob/3b763b1fb288f57bfa3cce76ef18184b96461a78/skills/pentest-methodology/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2026 vibeeval

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: vibeeval
Original project: https://github.com/vibeeval/vibecosystem/blob/3b763b1fb288f57bfa3cce76ef18184b96461a78/skills/pentest-methodology/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering
Roles: DevOps / SRE, QA / Test Engineer, Security Engineer
Specialties: Testing
Tools: Owasp
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 5385d56031bc000d8fbee467f302979434fd8e2acb71510dea3804b0fa4f66b7