pentest-cli
Professional security testing CLI for deployed web applications. No Python required - download a single binary and run.
40+ commands covering OWASP WSTG, PTES, and modern attack vectors. Integrates with Kali Linux tools (nmap, sqlmap, hydra, nikto, nuclei).
Quick Install
Linux/macOS:
curl -fsSL https://raw.githubusercontent.com/sabania/pentest-cli/main/install.sh | bash
Windows (PowerShell):
irm https://raw.githubusercontent.com/sabania/pentest-cli/main/install.ps1 | iex
Or download directly from Releases.
Uninstall
Linux/macOS:
rm ~/.local/bin/pentest
Windows (PowerShell):
Remove-Item "$env:USERPROFILE\.local\bin\pentest.exe"
Claude Code Plugin
This repo also ships a Claude Code plugin with 12 skills and 8 AI agents that use the CLI as their backend. The plugin turns Claude Code into a full security testing platform.
Install the plugin:
/plugin marketplace add sabania/pentest-cli
Then run:
/setup # Install CLI + verify environment
/pentest-full https://your-app.com # Complete security audit
See the full plugin documentation: Plugin README
Plugin Skills
| Skill | Type | Description |
|---|
/setup | Utility | Install pentest-cli and verify environment |
/cli-reference | Utility | Show all 40+ CLI commands |
/pentest-recon <url> | Passive | Subdomains, DNS, ports, OSINT, tech stack |
/pentest-scan <url> | Passive | Headers, SSL/TLS, CORS, WAF |
/pentest-discover <url> | Passive | JS bundles, APIs, secrets, BaaS backends |
/pentest-auth <url> | Passive | JWT, OAuth, session management |
/pentest-cloud <url> | Passive | S3/Azure/GCS misconfig, email security |
/business-logic <url> | Passive | IDOR, privilege escalation, payment bypass |
/pentest-inject <url> | Active | SQLi, XSS, SSTI, SSRF, XXE, LFI |
/pentest-advanced <url> | Active | Request smuggling, race conditions, cache poisoning |
/pentest-full <url> | Full | All scans combined + PDF report |
/pentest-report | Utility | Generate PDF report from findings |
Plugin Agents
8 specialized AI agents work as your security testing team:
| Agent | Model | Role |
|---|
recon-agent | sonnet | Attack surface mapping |
scanner-agent | sonnet | Configuration & hardening |
discovery-agent | sonnet | Secrets, APIs, BaaS probing |
injection-agent | sonnet | Injection vulnerability testing |
auth-agent | sonnet | Authentication & session security |
advanced-agent | opus | Request smuggling, race conditions |
logic-agent | opus | Business logic & authorization flaws |
report-agent | haiku | Report generation |
CLI Usage
# Passive scans (safe, no payloads sent)
pentest scan headers https://example.com
pentest scan ssl example.com
pentest scan cors https://example.com
pentest recon subdomains example.com
pentest discover bundle https://example.com
pentest cloud email example.com
# Active scans (sends payloads - requires --active flag)
pentest --active --yes inject sqli https://example.com
pentest --active --yes discover fuzz https://example.com
# Full pentest
pentest full https://example.com
# JSON output (for CI/CD or Claude Code agents)
pentest --json scan headers https://example.com
# Generate PDF report
pentest report ./findings/
CLI Commands
Reconnaissance & OSINT (pentest recon)
| Command | Description |
|---|
recon subdomains | Subdomain enumeration (crt.sh, dnsrecon, DNS brute) |
recon ports | Port scanning (nmap integration) |
recon dns | DNS records, zone transfer, SPF/DMARC, DNSSEC |
recon whois | WHOIS lookup |
recon crawl | Web crawling & URL discovery |
recon osint | Google dorks, Wayback Machine, email harvesting |
Vulnerability Scanning (pentest scan)
| Command | Description |
|---|
scan headers | HTTP security headers (CSP, HSTS, X-Frame-Options, SRI) |
scan ssl | SSL/TLS protocols, ciphers, certificate analysis |
scan cors | CORS misconfiguration (origin reflection, null, wildcards) |
scan nikto | Nikto web server scanner |
scan nuclei | Nuclei vulnerability scanner (9000+ templates) |
Discovery (pentest discover)
| Command | Description |
|---|
discover bundle | JS bundle reverse engineering (source maps, API keys, secrets) |
discover api | API endpoint discovery, GraphQL, error disclosure |
discover graphql | GraphQL introspection & attack testing |
discover fuzz | Content discovery / directory fuzzing |
discover tech | Deep technology fingerprinting (whatweb) |
sabania