---
name: shadd0wtaka/zen-pentesting-workflow-skill
source: https://app.decimal.ai/s/shadd0wtaka-zen-pentesting-workflow-skill@1/SKILL.md
source_sha256: 13e876dc74a5
---

# Zen Pentesting Workflow Skill

Complete end-to-end pentesting workflow using the Zen-Ai-Pentest platform.

## Quick Start

```bash
# 1. Start all services
docker compose up -d
# or: ./scripts/start-zen.sh

# 2. Run full audit via CLI
deep-audit --target example.com --phases recon,scan,exploit,report

# 3. View dashboard at http://localhost:8501
# 4. Export report: deep-report --scan-id wf-abc123 --format pdf
```

## Multi-Phase Workflow

### Phase 1: Reconnaissance
```bash
deep-recon --target example.com --output recon.json

# What happens:
# - Subdomain enumeration (subfinder, amass, dnsx)
# - Port scanning (nmap, masscan)
# - Technology fingerprinting (whatweb, wappalyzer)
# - Screenshot (gowitness, aquatone)
# - OSINT (shodan, censys integration)
```

### Phase 2: Scanning & Vulnerability Detection
```bash
deep-audit --target example.com --phases scan

# Tools engaged:
# - nuclei (community + custom templates)
# - web vulnerability (sqlmap, nikto, zap)
# - network (netexec, crackmapexec)
# - cloud (scoutsuite, prowler)
```

### Phase 3: Exploitation (requires --force)
```bash
deep-audit --target example.com --phases exploit

# Metasploit: auto-match CVEs to modules
# Custom payload generation (msfvenom)
# Credential testing via netexec
```

### Phase 4: Reporting
```bash
deep-report --scan-id YOUR-ID --format pdf
deep-report --scan-id YOUR-ID --format html
```

## Custom Workflow Script

```bash
#!/usr/bin/env bash
# custom-audit.sh
set -euo pipefail

TARGET="$1"
WORKSPACE="./workspace/${TARGET}"

mkdir -p "$WORKSPACE"

echo "=== Phase 1: Network Discovery ==="
nmap -sV -sC -oA "$WORKSPACE/nmap" "$TARGET"

echo "=== Phase 2: Web Recon ==="
gobuster dir -u "https://$TARGET" -w wordlist.txt -o "$WORKSPACE/gobuster.txt"

echo "=== Phase 3: Vulnerability Scan ==="
nuclei -u "https://$TARGET" -o "$WORKSPACE/nuclei.txt"

echo "=== Phase 4: AI Analysis ==="
python -c "
from agents.react_agent import ReActAgent
agent = ReActAgent(max_iterations=5)
print(agent.run(target='$TARGET', objective='Analyze findings in $WORKSPACE'))
"
```

## Docker Service Architecture

```
┌──────────────────────────────────────────────────┐
│                   Zen Network                    │
│  ┌──────────┐  ┌──────────────┐  ┌───────────┐ │
│  │ Terminal  │  │ WhatsApp Bot │  │ OmniRoute │ │
│  │ :23000   │  │ :23001       │  │ :20128    │ │
│  └──────────┘  └──────────────┘  └───────────┘ │
│  ┌──────────┐  ┌──────────────┐  ┌───────────┐ │
│  │ Hermes   │  │ VPN Proxy    │  │ WG Proxy  │ │
│  │ :23002   │  │ :23003       │  │ :23004    │ │
│  └──────────┘  └──────────────┘  └───────────┘ │
└──────────────────────────────────────────────────┘
```

## Runbook: Web Application Pentest

1. **Scope definition**: `agent_coordinator.create_workflow(target, phases=["recon"])`
2. **Passive recon**: WHOIS, DNS, Shodan, certificate transparency
3. **Active recon**: subdomain brute-force, port scan, tech fingerprint
4. **Vulnerability scan**: nuclei, custom template matching
5. **Manual testing**: ReAct agent-driven follow-up on findings
6. **Exploitation**: Metasploit + custom payloads (--force + admin approval)
7. **Reporting**: risk_engine scoring → PDF/HTML report generation
8. **Remediation**: CVSS-prioritized fix recommendations