---
description: Red-team adversarial security audit to find and remediate vulnerabilities. Produces a quantified "Hacker Score" and implementation guide.
---

# 🕵️‍♂️ Hacker's Audit (Pentest)

> **Goal**: Adopt a red-team mindset to find exploitable vulnerabilities. Deliver a quantified **Hacker Score (0-100)** and a phased remediation guide.

---

## Step 1 — Target & Reconnaissance

Identify the tech stack, public entry points, and hidden routes.

```bash
# Detect framework and entry points
ls -F
cat package.json 2>/dev/null || cat pubspec.yaml 2>/dev/null
grep -rE "@(Get|Post|Put|Delete|Patch|Route)" .
```

---

## Step 2 — Vulnerability Scan (The "One Hole" Search)

Load `common-security-audit`, `common-owasp`, and `common-llm-security`. Scan for:

- **Hardcoded Secrets**: Keys, tokens, or passwords in source.
- **Sensitive Logs**: PII or credentials being printed.
- **Injection Surfaces**: Raw string concatenation in SQL or system commands.

---

## Step 3 — Dynamic Probes (DAST)

Load `common-dast-tooling`. If a server is running, perform targeted `curl` probes or advise on running:

- **ZAP-CLI**: Depth scan for web vulnerabilities.
- **Nuclei**: Fast CVE and misconfiguration scan.
- **Nikto**: Web server configuration audit.

---

## Step 4 — Breach Analysis

Verify if a finding is actually reachable. Look for:

- **Missing Auth Guards**: Can I reach an internal API without a token?
- **BOLA/IDOR**: Can I access another user's data by changing a UUID?
- **Path Traversal**: Can I read `/etc/passwd` via a file-download route?

---

## Step 5 — Hacker Report & Remediation

**Hacker Score Calculation**: Start at 100. Deduct per finding:

- 🔴 Critical (RCE, SQLi, BOLA): -25 (Caps score at 40)
- 🟠 High (SSRF, Path Traversal, Secrets): -15
- 🟡 Medium (CVE, N+1, Info Leak): -5

### 📊 Report Template

| Dimension | Findings         | Impact                        |
| --------- | ---------------- | ----------------------------- |
| Recon     | [Entry points]   | [Surface area]                |
| Breach    | [Confirmed flaw] | [Exploit path]                |
| **Score** | **X / 100**      | [Status: Vulnerable/Hardened] |

### 🛠 Remediation Guide (Phased)

1. **Phase 1: Critical Fixes** (Immediate: Patching RCE, SQLi).
2. **Phase 2: Hardening** (Adding Auth Guards, sanitizing inputs).
3. **Phase 3: Observability** (Securing logs, adding audit trials).
