Imported from CaptainStinkRat/projectManagerBreakout (profiles/ethical-pen-tester/skills/vulnerability-assessment/SKILL.md). Install upstream with npx skills add CaptainStinkRat/projectManagerBreakout --skill vulnerability-assessment. Copyright stays with the author (MIT).

Vulnerability Assessment Skill

Systematically identify vulnerabilities in applications and infrastructure. Prioritize high-confidence findings with clear remediation.

When This Skill Activates

Use this skill when the user:

• Asks to "find security vulnerabilities"
• Wants to scan for known issues (CVE, misconfigurations)
• Needs to prioritize which vulnerabilities to fix first
• Wants to understand the impact of a vulnerability
• Asks for vulnerability scoring/severity assessment

Vulnerability Assessment Process

Step 1: Define Scope & Methodology

Questions to Answer:

• What system(s) are being tested?
• What's the authorization? (written scope + test date range)
• What tools can be used? (automated scanning? manual testing? load testing?)
• What's off-limits? (production data? payment processing? specific systems?)
• Timeline: How much time for testing?

Document:

• Scope statement (what's in, what's out)
• Rules of engagement (off-limits systems, times, contacts)
• Methodology (tools, techniques used)
• Point of contact for issues or emergencies

Step 2: Reconnaissance

Passive Information Gathering:

• DNS records: nslookup, dig
• Whois information: whois example.com
• Public documentation: API docs, GitHub, job listings
• SSL/TLS certificates: ssllabs.com
• Search engines: site:example.com to find public URLs

Active Scanning:

# Network scanning (what ports/services are exposed?)
nmap -sV example.com

# Web application scanning (automated vulnerability check)
burpsuite --scan example.com
owasp-zap --scan example.com

Step 3: Vulnerability Identification

Automated Scanning

Burp Suite / OWASP ZAP:

• SQL injection detection
• Cross-site scripting (XSS) detection
• Cross-site request forgery (CSRF) detection
• Security misconfiguration
• Weak SSL/TLS configuration
• Directory traversal
• Insecure deserialization

Dependency Scanning:

# Check for vulnerable libraries
npm audit
pip audit
safety check (Python)
dependabot (GitHub)
snyk (multi-language)

Infrastructure Scanning:

# Check for open ports, vulnerable services
nmap -sV example.com
nessus
qualys

Manual Testing

Authentication Testing:

• Can you bypass login? (SQL injection, weak password reset)
• Can you access other users' accounts?
• Do sessions expire properly?

Authorization Testing:

• Can a user access admin functions?
• Can a user view other users' data?
• Can you escalate privileges?

Input Validation Testing:

• SQL injection: ' OR '1'='1
• XSS: <script>alert('xss')</script>
• Command injection: ; ls -la
• XXE: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>

Business Logic Testing:

• Can you purchase items for $0?
• Can you apply the same coupon twice?
• Can you withdraw more money than you have?
• Can you access orders before paying?

Step 4: Vulnerability Verification & Prioritization

Confirm Real Issues (not false positives):

• Reproduce the vulnerability multiple times
• Verify it's not a misunderstanding of intended behavior
• Document exact reproduction steps

Assess Severity:

Use CVSS (Common Vulnerability Scoring System) or simplified severity:

Scoring Example:

Vulnerability: SQL Injection in /api/search

Impact: High (can extract all user data)
Likelihood: High (unauthenticated attacker, easy to exploit)
Severity: CRITICAL

Fix Effort: Low (use parameterized queries)
Timeline: ASAP, within 7 days

Step 5: Document Findings

Report Template:

# Vulnerability Assessment Report: [System]

## Executive Summary
- Scope: [What was tested]
- Test Date: [When]
- Total Vulnerabilities: [N]
- Critical: [N] | High: [N] | Medium: [N] | Low: [N]
- Percentage Vulnerable: [X% of endpoints/systems]

## Critical Findings

### Finding 1: SQL Injection in Search Endpoint
**Severity:** CRITICAL
**Location:** GET /api/search?q=...
**Description:** User input in 'q' parameter is concatenated directly into SQL query without sanitization.

**Technical Details:**
- Vulnerable code: `SELECT * FROM posts WHERE title = '{q}'`
- Attack: `q=' OR '1'='1` returns all posts
- Impact: Unauthenticated access to all user data

**Proof of Concept:**
\`\`\`
curl "http://api.example.com/api/search?q=' OR '1'='1"
# Returns: [all user posts in database]
\`\`\`

**Remediation:**
Use parameterized queries:
\`\`\`python
query = "SELECT * FROM posts WHERE title = ?"
db.execute(query, (user_input,))
\`\`\`

**Risk if Not Fixed:** 
- Attacker can steal all user data
- Compliance violation (data breach)
- Potential legal liability

**Timeline:** Fix before next production deploy

---

### Finding 2: Hardcoded API Keys
**Severity:** CRITICAL
**Location:** /config/settings.py, line 42
**Description:** AWS credentials hardcoded in source code (visible in Git history)

**Remediation:** 
1. Rotate credentials immediately
2. Move to environment variables
3. Remove from Git history: `git-filter-repo`

**Timeline:** Within 24 hours

---

## High Findings

### Finding 3: Missing Authentication on Admin Endpoint
**Severity:** HIGH
**Location:** GET /admin/dashboard
**Description:** Admin dashboard accessible without authentication

**Remediation:** Require admin login before accessing endpoint

**Timeline:** Within 7 days

---

## Medium Findings

### Finding 4: Weak Password Policy
**Severity:** MEDIUM
**Location:** User registration endpoint
**Description:** Allows weak passwords (e.g., "123", "password")

**Remediation:** Enforce min 12 characters, require complexity

**Timeline:** Within 14 days

---

## Scan Results Summary

| Category | Critical | High | Medium | Low |
|----------|----------|------|--------|-----|
| Authentication | 0 | 1 | 0 | 2 |
| Authorization | 1 | 0 | 0 | 0 |
| Input Validation | 1 | 2 | 3 | 5 |
| Data Protection | 1 | 1 | 2 | 0 |
| Configuration | 0 | 1 | 1 | 1 |

## Remediation Roadmap

| Severity | Finding | Owner | Due Date | Status |
|----------|---------|-------|----------|--------|
| Critical | SQL Injection | Backend | 2024-01-25 | Not started |
| Critical | API Keys | DevOps | 2024-01-20 | Not started |
| High | Missing Auth | Backend | 2024-02-01 | Not started |
| Medium | Password Policy | Backend | 2024-02-15 | Not started |

## Re-Testing

After fixes are applied, re-test to confirm:
- Critical finding is resolved
- No new vulnerabilities introduced
- All related endpoints tested

## Methodology & Tools

- Burp Suite Community (web app scanning)
- OWASP ZAP (web app scanning)
- Nmap (network scanning)
- Manual testing (business logic, authorization)
- Dependency scanning (npm audit, pip audit)

## Limitations & Scope

- Tested within scope: [API endpoints, web UI]
- Not tested (out of scope): [Mobile app, legacy admin panel]
- Time spent: X hours
- Systems: Development environment only (not production)

Vulnerability Scoring (Simplified)

Tools & Techniques

Automated Scanning:

• Burp Suite Community
• OWASP ZAP
• Nmap
• Nikto
• SQLMap (SQL injection specific)
• npm audit / pip audit / safety

Manual Testing:

• Burp Repeater (modify requests manually)
• Browser dev tools (inspect network, modify cookies/headers)
• Authentication testing (bypass attempts)
• API testing (Postman, curl)

Common Pitfalls

• ❌ Reporting false positives (high noise, low signal)
• ❌ Not confirming findings (might not be exploitable)
• ❌ Reporting without remediation guidance
• ❌ Testing outside authorized scope
• ❌ Not documenting reproduction steps
• ❌ Breaking the system during testing (DoS attacks)