<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: security-testing
description: >-
  Comprehensive security testing methodologies including black-box and white-box
  assessments, red team and purple team engagements, assumed breach testing, bug
  bounty program management, cloud penetration testing, configuration audits,
  social engineering and physical penetration testing, continuous security testing
  pipelines, and security testing automation frameworks.
domain: cybersecurity
subdomain: security-testing
tags:
  - penetration-testing
  - red-team
  - purple-team
  - bug-bounty
  - assumed-breach
  - configuration-audit
  - cloud-pentest
  - social-engineering
  - physical-security
  - continuous-testing
  - automation
  - security-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1566", "T1078", "T1053", "T1059", "T1021", "T1098", "T1548"]
  frameworks: ["PTES", "OWASP Testing Guide", "NIST SP 800-115", "CREST", "OSSTMM"]
  standards: ["PCI DSS 11.3", "ISO 27001 A.12.6", "SOC 2 CC7.1"]
---

# Security Testing

## When to Use

Activate when the operator asks about penetration testing methodology, red
team planning, security assessment scoping, bug bounty programs, assumed
breach exercises, cloud security testing, configuration audits, social
engineering tests, physical security assessments, purple team operations,
continuous security testing, or security test automation.

Mode: `[MODE: RED]` for offensive testing; `[MODE: BLUE]` for defensive validation;
`[MODE: PURPLE]` for detection coverage mapping; `[MODE: ARCHITECT]` for test program design.

## Prerequisites

- Written authorization and rules of engagement (ROE)
- Defined scope including in-scope targets and exclusions
- Communication plan and emergency contacts
- Testing tools appropriate to engagement type
- Secure data handling procedures for findings

## Quick Reference

| Methodology | Use Case | Standard |
|-------------|----------|----------|
| Black-box pentest | External attacker simulation, no prior knowledge | PTES, OWASP |
| White-box assessment | Full-knowledge code + infra review | NIST 800-115 |
| Red team engagement | Adversary emulation against detection capability | MITRE ATT&CK |
| Bug bounty management | Crowdsourced vulnerability discovery | ISO 29147 |
| Assumed breach | Internal attacker simulation from compromised position | NIST CSF |
| Configuration audit | Baseline compliance against hardening standards | CIS Benchmarks |
| Cloud pentest | Cloud-native attack surface testing | CSA CCM |
| Continuous testing | Automated recurring security validation | DevSecOps |
| Social engineering | Human-layer attack simulation | PTES SE |
| Physical pentest | Facility access and physical control testing | OSSTMM |
| Purple team | Collaborative offense-defense detection tuning | MITRE ATT&CK |
| Test automation | Scripted and pipeline-integrated security testing | CI/CD |

## Workflow

### Phase 1: Engagement Scoping

```bash
# Define scope document structure
cat <<'EOF'
ENGAGEMENT SCOPE
================
Client:          [Organization Name]
Type:            [Black-box | White-box | Red Team | ...]
Duration:        [Start Date] — [End Date]
Testing Window:  [Business hours | After hours | 24/7]
Targets:         [IP ranges, domains, applications, facilities]
Exclusions:      [Systems, networks, or methods out of scope]
Authorization:   [Signed ROE reference number]
Contacts:        [Primary, Secondary, Emergency]
Deconfliction:   [SOC notification | Blind test]
Data Handling:   [Encryption, retention, destruction timeline]
EOF
```

### Phase 2: Methodology Selection

```
Assessment Type Decision Matrix:
├── External exposure? → Black-box penetration test
├── Source code available? → White-box security assessment
├── Testing detection capability? → Red team engagement
│   └── With defender collaboration? → Purple team assessment
├── Internal threat scenario? → Assumed breach testing
├── Cloud infrastructure? → Cloud penetration test
├── Compliance requirement? → Configuration audit
├── Human attack surface? → Social engineering test
├── Physical access controls? → Physical penetration test
├── Ongoing program? → Continuous security testing
├── Crowdsourced discovery? → Bug bounty program
└── Pipeline integration? → Security testing automation
```

### Phase 3: Execution Framework

```bash
# Standard pentest phases (PTES)
# 1. Pre-engagement Interactions — scope, ROE, authorization
# 2. Intelligence Gathering — passive and active recon
# 3. Threat Modeling — identify attack paths and priorities
# 4. Vulnerability Analysis — discover and validate weaknesses
# 5. Exploitation — controlled exploitation with evidence
# 6. Post-Exploitation — assess impact and pivot potential
# 7. Reporting — findings, risk ratings, remediation guidance
```

### Phase 4: Evidence Collection

```bash
# Screenshot with timestamp
scrot -q 95 "evidence_%Y%m%d_%H%M%S.png"

# Terminal session recording
script -t 2>timing.log session.log

# Network traffic capture
tcpdump -i eth0 -w "capture_$(date +%Y%m%d_%H%M%S).pcap" \
  host $TARGET_IP

# Hash evidence files for integrity
sha256sum evidence_* > evidence_checksums.sha256
```

### Phase 5: Reporting

```bash
# Finding severity classification
cat <<'EOF'
SEVERITY MATRIX
===============
Critical — Remote code execution, authentication bypass, data breach
High     — Privilege escalation, sensitive data exposure, SSRF
Medium   — Stored XSS, CSRF, information disclosure
Low      — Missing headers, verbose errors, clickjacking
Info     — Best practice deviations, configuration notes
EOF
```

## Techniques

| Technique | Description |
|-----------|-------------|
| [performing-black-box-penetration-testing](techniques/performing-black-box-penetration-testing/) | External zero-knowledge penetration testing |
| [conducting-white-box-security-assessment](techniques/conducting-white-box-security-assessment/) | Full-knowledge source code and infrastructure review |
| [performing-red-team-engagement](techniques/performing-red-team-engagement/) | Adversary emulation and TTP-based attack simulation |
| [implementing-bug-bounty-program-management](techniques/implementing-bug-bounty-program-management/) | Bug bounty platform setup, triage, and lifecycle |
| [performing-assumed-breach-testing](techniques/performing-assumed-breach-testing/) | Internal threat simulation from compromised position |
| [conducting-configuration-audit](techniques/conducting-configuration-audit/) | Hardening baseline assessment and compliance checks |
| [performing-cloud-penetration-testing](techniques/performing-cloud-penetration-testing/) | Cloud-native attack surface enumeration and exploitation |
| [implementing-continuous-security-testing](techniques/implementing-continuous-security-testing/) | Automated recurring security validation pipelines |
| [performing-social-engineering-penetration-test](techniques/performing-social-engineering-penetration-test/) | Human-layer attack simulation and awareness testing |
| [conducting-physical-penetration-testing](techniques/conducting-physical-penetration-testing/) | Facility access control and physical security testing |
| [performing-purple-team-assessment](techniques/performing-purple-team-assessment/) | Collaborative offense-defense detection engineering |
| [implementing-security-testing-automation](techniques/implementing-security-testing-automation/) | CI/CD integrated and scripted security test frameworks |

## Verification

- [ ] Written authorization and ROE signed before testing
- [ ] Scope boundaries respected throughout engagement
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] All findings classified with severity and CVSS scores
- [ ] Remediation guidance provided for each finding
- [ ] Report delivered within agreed timeline
- [ ] Debrief conducted with stakeholders
- [ ] Retest scheduled for critical and high findings

## References

- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [OWASP Testing Guide v4.2](https://owasp.org/www-project-web-security-testing-guide/)
- [NIST SP 800-115 — Technical Guide to Information Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
- [CREST Penetration Testing Guide](https://www.crest-approved.org/)
- [OSSTMM — Open Source Security Testing Methodology Manual](https://www.isecom.org/OSSTMM.3.pdf)
- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
