Skip to content

README.md

Latest commit

 

History

History
277 lines (220 loc) · 9.96 KB

README.md

File metadata and controls

277 lines (220 loc) · 9.96 KB
Raw

Claude Pentesting Configuration

Complete suite for penetration testing and bug bounty hunting with Claude Code. Includes project management wrappers, specialized skills, security automation hooks, and professional templates.

Quick Start

git clone https://github.com/tostolaza/Claude-pentesting-config.git
cd Claude-pentesting-config
bash install.sh

# HTB machine
htb Keeper 10.10.11.227

# Bug bounty program  
bb hackerone-shopify

Repository Structure

Claude-pentesting-config/
├── bin/                       # Wrapper commands
│   ├── htb                    # HTB project manager
│   └── bb                     # Bug bounty project manager
├── skills/                    # Claude Code skills library
│   ├── htb-methodology/       # Complete HTB/CTF methodology
│   ├── caveman/              # Token-efficient communication mode
│   ├── bb-recon/             # Bug bounty reconnaissance
│   ├── bb-web-hunting/       # Web vulnerability testing
│   └── bb-reporting/         # Professional report writing
├── templates/                 # Project templates
│   └── bb-project/           # Bug bounty project structure
├── hooks/                    # Security automation
├── commands/                 # Slash commands
├── agents/                   # Specialized agents  
├── install.sh                # Installation script
├── sync-config.sh            # Configuration sync
├── CLAUDE.md                 # Global configuration
├── settings.json             # Claude Code settings
└── README.md                 # Documentation

Wrapper Commands

HTB Wrapper (htb)

Command Description Example
htb <machine> <ip> [comments] Create new HTB project htb Keeper 10.10.11.227 "Windows with Keepass"
htb <machine> Resume existing project htb Keeper
htb auto <machine> <ip> Autonomous mode (no prompts until root) htb auto Lame 10.10.10.3
htb list List all machines with status htb list
htb help Show usage information htb help

Bug Bounty Wrapper (bb)

Command Description Example
bb <program> [comments] Create/resume BB project bb hackerone-shopify "E-commerce platform"
bb auto <program> Autonomous nocturnal mode bb auto bugcrowd-tesla
bb list List all projects bb list
bb help Show usage information bb help

Skills

Skills are automatically invoked by Claude when appropriate contexts are detected:

htb-methodology

  • Trigger: Working on HTB/CTF/pentest
  • Content: Complete enumeration methodology, service-by-service testing guides, privilege escalation checklists, Active Directory attacks
  • Reference: Reverse shells, file transfer, hash cracking, port forwarding

caveman

  • Trigger: User says "caveman", "modo caveman", "save tokens"
  • Content: Ultra-compressed communication mode for long sessions
  • Purpose: Drop articles/pleasantries, use fragments, preserve technical accuracy

bb-recon

  • Trigger: Starting bug bounty reconnaissance
  • Content: Passive → Active reconnaissance pipeline, subdomain enumeration, technology detection, continuous monitoring
  • Tools: subfinder, httpx, katana, nuclei, waybackurls

bb-web-hunting

  • Trigger: Web application security testing
  • Content: Systematic testing by bounty value (RCE > Auth bypass > IDOR > SQLi > XSS), OWASP Top 10 techniques, evidence collection
  • Priority: High-impact vulnerabilities first

bb-reporting

  • Trigger: Writing vulnerability reports
  • Content: HackerOne template, CVSS 3.1 scoring, evidence requirements, quality checklist
  • Output: Professional submission-ready reports

Project Structure

HTB Projects (~/labs/htb/<machine>/)

machine-name/
├── MACHINE.md                 # Target info and status tracking
├── CLAUDE.md                 # Project-specific instructions
├── README.md                 # Quick reference
├── notes/                    # Notes funnel
│   ├── timeline.md           # Chronological activity log
│   ├── leads.md              # Discovered assets and observations
│   ├── hypotheses.md         # Attack vector theories
│   ├── findings.md           # Confirmed vulnerabilities
│   ├── creds.md              # Credentials and hashes
│   └── todo.md               # Task prioritization
├── scans/                    # Automated scan results
│   ├── nmap/                 # Network scans
│   ├── web/                  # Web enumeration
│   └── smb/                  # SMB enumeration
├── loot/                     # Collected data
├── scripts/                  # Automation scripts
└── report/                   # Final writeup

Bug Bounty Projects (~/bb-lab/projects/<program>/)

program-name/
├── PROJECT.md                # Program metadata and statistics
├── CLAUDE.md                # Project-specific instructions  
├── scope/                   # Program boundaries
│   ├── policy.md            # Program rules and rewards
│   ├── in-scope.txt         # Allowed assets
│   └── out-of-scope.txt     # Forbidden assets
├── notes/                   # Bug bounty funnel
│   ├── timeline.md          # Activity chronology
│   ├── leads.md             # Asset discovery
│   ├── primitives.md        # Low-level attack capabilities
│   ├── hypotheses.md        # Testing theories
│   ├── findings.md          # Validated vulnerabilities
│   └── creds.md             # Test accounts and discoveries
├── recon/                   # Reconnaissance data
│   ├── subdomains.txt       # Discovered subdomains
│   ├── live-hosts.txt       # Active services
│   └── urls.txt             # Collected endpoints
├── evidence/                # Screenshots and proof
├── reports/                 # Final submissions
└── scripts/                 # Automation tools

Resource Management

Performance Limits

  • Concurrent tools: Maximum 2 heavy tools simultaneously
  • nmap: Always use -T3 (never -T4 or -T5 on real targets)
  • nuclei: Rate-limit 3-5, bulk-size 25
  • ffuf/feroxbuster: Maximum 10 threads
  • Sub-agents: Maximum 2-3 (prevents compaction failures)

Load Monitoring

  • Pause automated scans if load average > 6
  • Check with uptime before launching resource-intensive tools
  • Use more aggressive rate limiting on VPS/containers

Memory Management

  • Limit command outputs: head -10000 for long results
  • Compress old scan data: tar -czf old_scans_$(date +%Y%m%d).tar.gz
  • Clean temporary files every 24 hours

Installation Options

Standard Installation

git clone https://github.com/tostolaza/Claude-pentesting-config.git
cd Claude-pentesting-config
bash install.sh

Options

  • --yolo: bypassPermissions mode (autonomous execution)
  • --skip-tools: Skip Go/pip tool installation
  • --with-burp-mcp: Configure Burp Suite MCP integration
  • --uninstall: Complete removal of configuration

Security Tools

The installer optionally installs security tools from claude-bug-bounty:

  • subfinder, httpx, katana, nuclei (Go tools)
  • crackmapexec, bloodhound, netexec (Python tools)
  • chisel (proxy/tunnel binary)

Playwright MCP

Optional installation for interactive web testing:

npm install -g @playwright/mcp
npx playwright install chromium

Automation Hooks

Security Hooks

  • block-dangerous.sh: Prevents destructive commands
  • scope-check.sh: Blocks out-of-scope requests (BB projects)
  • evidence-gate.sh: Requires minimum evidence for reports
  • report-gate.sh: Prevents incomplete report submission

Workflow Hooks

  • session-context.sh: Loads relevant playbook sections
  • auto-timeline.sh: Automatic command logging with secret scrubbing
  • time-budget.sh: Vector time tracking (30/60 minute alerts)
  • pre-compact-backup.sh: Protects notes before compaction

Synchronization

Keep configuration current with active environment:

# Manual sync with review
./sync-config.sh

# Automatic commit and push
./sync-config.sh --auto

Syncs: CLAUDE.md, playbooks, settings, hooks, commands, skills

Uninstall

bash install.sh --uninstall

Removes:

  • ~/.claude/ directory (with backup)
  • htb/bb wrapper commands
  • PATH modifications from shell configs
  • Prompts for confirmation before removal

Playbook System

Structured lessons learned format:

## 2026-05-20 — <Target/Machine> — #tag1 #tag2
**Contexto:** Situation description and why it was interesting
**Lección:** What worked, what failed, what to do differently  
**Comando/PoC:**
```bash
exact command that worked

Aplicabilidad: HTB | BB | both


**Available Tags**: `#web` `#ad` `#linux-priv` `#windows-priv` `#xss` `#ssrf` `#sqli` `#idor` `#oauth` `#recon`

## Autonomous Operation

Full autonomous mode for security testing:

### HTB Mode
- No prompts until user.txt AND root.txt obtained
- Automatic exploitation of discovered vulnerabilities
- Complete writeup generation with lessons learned
- Sub-agent coordination for complex attacks

### Bug Bounty Mode  
- Autonomous reconnaissance → hunting → validation → reporting
- Scope-aware testing with automatic boundary enforcement
- Evidence collection and impact assessment
- Professional report generation

### Critical Rules
1. **5-minute rule**: Empty target → next target
2. **1-hour rule**: No progress → change vector/context  
3. **Impact focus**: "Can attacker do this NOW against real user?"
4. **Chain hunting**: Look for A→B→C combinations (3-10x bounty)

## License

MIT License - See [LICENSE](LICENSE) for details.

## Contributing

Issues and improvements welcome. This is actively maintained production configuration.