From pentest-framework
Tests target web apps for advanced vulnerabilities: HTTP request smuggling, race conditions, cache poisoning, subdomain takeover. Reports exploits, impacts, remediations via pentest tool.
How this skill is triggered — by the user, by Claude, or both
Slash command
/pentest-framework:pentest-advancedThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Test a target application for advanced attack vectors including HTTP request smuggling, race conditions, cache poisoning, and subdomain takeover vulnerabilities.
Test a target application for advanced attack vectors including HTTP request smuggling, race conditions, cache poisoning, and subdomain takeover vulnerabilities.
The target URL is provided via $ARGUMENTS. If no URL is provided, ask the user for one.
Parse the target URL from $ARGUMENTS.
Delegate to advanced-agent using the Agent tool. The agent must run all advanced attack commands:
pentest -k -j -o ./findings advanced smuggle --active --yes <url>
pentest -k -j -o ./findings advanced race --active --yes <url>
pentest -k -j -o ./findings advanced cache --active --yes <url>
pentest -k -j -o ./findings advanced takeover --active --yes <url>
Read the JSON outputs from ./findings/ to gather all results.
Present findings with detailed exploitation scenarios:
For each confirmed vulnerability, include:
-k to skip SSL verification for targets with self-signed certs.-j for machine-readable JSON output.-o ./findings to persist results for later reporting.npx claudepluginhub sabania/pentest-cli --plugin pentest-frameworkGuides authorized pentests for web cache poisoning by discovering unkeyed headers/parameters with Burp Suite Param Miner and testing cache keys via curl on CDNs like Cloudflare/Nginx.
Speed-optimized offensive checklist for rapid vulnerability assessment: quick-win patterns, fast recon shortcuts, automated scanner configs, and triage. Use for time-boxed assessments, CTF-speed engagements, or initial surface mapping.
Exploits web cache mechanisms to poison cached responses via unkeyed headers and parameters during authorized security tests.