# security-testing

**Repository Path**: mowenqwq/security-testing

## Basic Information

- **Project Name**: security-testing
- **Description**: 已授权网站渗透测试手册 agent skill——漏洞发现、提权、隐蔽纪律、报告
- **Primary Language**: Unknown
- **License**: MIT
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-09-06
- **Last Updated**: 2026-09-06

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# security-testing

**已授权网站的系统性渗透测试手册——漏洞发现、提权尝试、隐蔽纪律、报告生成，全流程可复用。**
**A systematic penetration-testing playbook for authorized targets — vulnerability discovery, privilege escalation, stealth discipline, and report generation.**

[中文](#中文) | [English](#english)

---

## 中文

### 这是什么

一套从真实授权测试中打磨出来的五阶段流程：**前期准备 → 信息收集 → 漏洞扫描 → 提权尝试 → 报告生成**。特色是"隐蔽测试纪律"作为硬性规则贯穿全程：

- **扫描向量全景**：注入（数组参数 / 时间盲注 / 布尔盲注）、XSS、文件上传（polyglot / 后缀绕过）、HTTP 走私、SSRF、原型污染、CORS、WebSocket
- **提权手法**：Mass assignment、管理端点探测、验证码逻辑绕过、JWT 爆破、竞态条件
- **隐蔽铁律**：不批量触发外部副作用（邮件/短信单次 1-2 封）、不改生产数据、不留测试痕迹、可逆性优先
- **踩坑实录**：乱发验证码打草惊蛇、缓存污染误判"提权成功"、token 过期中断利用链

### 适用前提

⚠️ 仅用于**已获得明确授权**的目标。本手册默认你已具备授权、知晓当地法律边界。

### 安装

```bash
git clone https://github.com/mowenQWQ/security-testing.git
cp -r security-testing /path/to/your/agent/skills/
```

---

## English

### What is this

A five-phase flow refined through real authorized engagements: **preparation → recon → scanning → privilege escalation → reporting**, with "stealth testing discipline" as hard rules throughout:

- **Scan vectors**: injection (array params / time-based & boolean blind), XSS, file upload (polyglots / extension bypass), HTTP request smuggling, SSRF, prototype pollution, CORS, WebSocket
- **Escalation**: mass assignment, admin endpoint probing, captcha logic bypass, JWT cracking, race conditions
- **Stealth rules**: no bulk external side effects (1-2 emails/SMS max per round), no production data mutation, no test artifacts left behind, reversibility first
- **War stories**: spamming verification codes alerts the owner, cache pollution fakes a successful escalation, token expiry breaks an exploitation chain mid-way

### Prerequisite

⚠️ **Authorized targets only.** The playbook assumes you hold explicit permission and know your local legal boundaries.

### Install

```bash
git clone https://github.com/mowenQWQ/security-testing.git
cp -r security-testing /path/to/your/agent/skills/
```

---

## License

MIT-0（MIT No Attribution）— 详见 [LICENSE](LICENSE)。任何人可自由使用、修改、再分发，无需署名。

MIT No Attribution — see [LICENSE](LICENSE). Free to use, modify, and redistribute with no attribution required.

---

## 🤖 AI 使用声明 / AI Usage Disclosure

本项目在开发与维护过程中使用了 AI 编程助手（Claude / Anthropic）辅助代码编写、文档整理与问题排查；核心决策、内容审核与最终发布由维护者完成。

This project was developed and maintained with the assistance of an AI coding assistant (Claude / Anthropic) for coding, documentation, and troubleshooting. Core decisions, content review, and final releases are made by the maintainer.