Offensive Security Skill

Purpose: Authorized security testing methodologies and techniques for identifying vulnerabilities.

Atomic Operations

┌─────────────────────────────────────────────────────────────────┐
│                    SKILL OPERATIONS                             │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐     │
│  │scan_vuln    │  │test_inject  │  │enumerate_services   │     │
│  │             │  │             │  │                     │     │
│  │ Input:      │  │ Input:      │  │ Input:              │     │
│  │  - target   │  │  - endpoint │  │  - host             │     │
│  │  - type     │  │  - type     │  │  - port_range       │     │
│  │  - depth    │  │  - payloads │  │                     │     │
│  │             │  │             │  │ Output:             │     │
│  │ Output:     │  │ Output:     │  │  - services[]       │     │
│  │  - vulns[]  │  │  - vuln     │  │  - os_detect        │     │
│  │  - time     │  │  - evidence │  │                     │     │
│  └─────────────┘  └─────────────┘  └─────────────────────┘     │
│                                                                 │
│  ┌─────────────────────────────────────────┐                   │
│  │ test_authentication                      │                   │
│  │                                          │                   │
│  │ Input: target, test_type                 │                   │
│  │ Output: findings[], weak_creds[]         │                   │
│  └─────────────────────────────────────────┘                   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Testing Methodology

OWASP Top 10 Coverage

Troubleshooting

Debug Decision Tree

Scan Failed
    │
    ├─► E_NETWORK_TIMEOUT
    │   ├── Check: ping/traceroute target
    │   ├── Action: Increase timeout, use retry
    │   └── Escalate: If persistent, check firewall
    │
    ├─► E_RATE_LIMITED
    │   ├── Check: Response headers for rate info
    │   ├── Action: Apply exponential backoff
    │   └── Escalate: Reduce concurrency
    │
    ├─► E_WAF_BLOCKED
    │   ├── Check: Response body for WAF signature
    │   ├── Action: Modify payloads, encoding
    │   └── Escalate: Document WAF presence
    │
    └─► E_NO_AUTHORIZATION
        └── STOP: Cannot proceed without authorization

Common Issues

Unit Test Template

# tests/test_offensive_skill.py
import pytest
from skills.offensive import OffensiveSecurity

class TestVulnerabilityScan:
    def test_valid_web_target(self):
        skill = OffensiveSecurity()
        result = skill.scan_vulnerability(
            target="http://testsite.local",
            scan_type="web",
            depth="quick"
        )
        assert result.status == "success"
        assert isinstance(result.vulnerabilities, list)

    def test_invalid_target_format(self):
        skill = OffensiveSecurity()
        with pytest.raises(ValidationError) as exc:
            skill.scan_vulnerability(target="invalid!!!")
        assert exc.value.code == "E_INVALID_TARGET"

    def test_authorization_required(self):
        skill = OffensiveSecurity(authorization=None)
        with pytest.raises(AuthorizationError) as exc:
            skill.scan_vulnerability(target="http://target.com")
        assert exc.value.code == "E_NO_AUTHORIZATION"

Version History