Shannon Pentest

Problem it solves

Pentest reports often list unverified guesses such as possible SQLi, possible XSS, or possible IDOR, making it hard for engineers to prioritize real work. shannon-pentest treats No Exploit, No Report as the rule, collapsing external footprinting, attack-surface mapping, vulnerability hypotheses, validation, and reporting into a five-phase pipeline. It only keeps findings that were practically exploited or validated.

How it works

The skill runs phases sequentially and writes each deliverable to .shannon/deliverables/:
- Pre-reconnaissance: read references/pre-recon.md; for live web apps or APIs, use tools such as nmap, subfinder, and whatweb to collect ports, subdomains, and tech-stack fingerprints; when source code is available, search for hardcoded API_KEY, SECRET, and token patterns and locate controllers, routes, and handlers.
- Reconnaissance: use Playwright or configured MCP browser automation to traverse forms, links, API endpoints, and URL parameters, capture screenshots of critical flows, and correlate dynamic behavior with static code signals.
- Vulnerability analysis: launch up to five parallel subtasks for injection, XSS, authentication, SSRF, and authorization/IDOR; each subtask emits a structured JSON queue matching references/schemas.md.
- Exploitation: validate non-empty hypotheses with focused subtasks, using curl, Playwright scripts, or Python to run payloads and preserve evidence such as HTTP responses, screenshots, and source diffs; unconfirmed hypotheses are dropped from the final report.
- Reporting: aggregate validated evidence and generate a Markdown report with an executive summary, risk ratings, reproduction steps, impact analysis, and remediation guidance.

Boundaries and notes

This is a process discipline for engineers rather than a one-click report generator. It fits live web applications, APIs, or analyzable source code; when login, TOTP, credentials, or specific tooling are required, the user must provide them or allow the workflow to retry. The pipeline prefers ordered execution, persistent deliverables, and failure tolerance: a single vulnerability-class subtask can be recorded and skipped without halting the whole run.