Penetration Testing Planner
Generate structured penetration testing plans aligned with OWASP methodology
by myriadprotocolConsulting & Professional ServicesTechnology ConsultingCybersecurity ConsultantPen TestingWhat You Can Do
You can generate formal penetration testing plans that transform vague security testing requests into actionable documents. The skill defines clear scope boundaries, maps test cases to OWASP Top 10 and industry frameworks, recommends appropriate tools and methodologies, and specifies deliverable formats—ensuring consistent, defensible testing approaches that stakeholders and development teams can understand and act on.
Features
Establish in/out of scope targets, testing windows, constraints, and business objectives
Generate specific attack vectors mapped to OWASP Top 10, CVSS scoring, and industry standards
Recommend tools, techniques, and testing phases (reconnaissance, scanning, exploitation, reporting)
Tailor plans to PCI-DSS, HIPAA, SOC 2, and other compliance requirements
Define proof-of-concept requirements, remediation timelines, and report structure
Map test cases to identified threats and business risks
Create sign-off templates and risk-rating frameworks for non-technical audiences
Example Output
Example 1: Web Application Penetration Test Plan
Scope: E-commerce platform (web UI, REST API, authentication system)
Out of Scope: Third-party payment processors, legacy batch systems
Test Window: 2 weeks, off-peak hours (11 PM–6 AM EST)
Phase 1: Reconnaissance & Enumeration
- Identify entry points, tech stack, API endpoints
- Tools: Burp Suite, OWASP ZAP
Phase 2: Vulnerability Testing
- OWASP A01:2021 Broken Access Control → Test privilege escalation, horizontal/vertical access
- OWASP A03:2021 Injection → SQL/NoSQL/LDAP injection payloads
- OWASP A07:2021 Cross-Site Scripting → Stored/reflected XSS vectors
Deliverables: Executive summary, detailed findings (CVSS scored), remediation roadmap, raw evidence (screenshots, logs, payloads)
Example 2: API Security Test Plan
Target: RESTful GraphQL API (v2.1)
Test Focus: Authentication bypass, rate limiting, data exposure, business logic flaws
Test Cases:
- Missing authentication on /admin endpoints
- JWT token manipulation and expiration bypass
- GraphQL query depth exploitation (DoS)
- Unauthorized cross-tenant data access
Expected Output: API security report with exploit proof-of-concepts and remediation priority matrix
What's Included
- penetration-testing-planner.md: Core skill instructions and prompt templates
- Penetration Test Plan Template: Structured markdown outline with scope, methodology, and deliverable sections
- OWASP Test Case Checklist: Pre-built mapping of OWASP Top 10 to specific test cases and tools
- Scope Definition Worksheet: Questions to clarify in/out of scope, stakeholder requirements, and regulatory drivers
- Risk Rating & Remediation Matrix: CVSS scoring framework and prioritization for reporting
Who It's For
- Security Engineers & Penetration Testers — Structure engagements and ensure consistent, defensible methodologies
- QA/Test Engineers — Plan security-focused test phases alongside functional testing
- Security Consultants — Generate formal scope documents and statements of work for client sign-off
- AppSec & DevSecOps Leads — Define internal security testing programs aligned with compliance requirements
- Development Managers — Understand what's being tested, why, and what remediation looks like
Best For
- Planning new penetration test engagements for web applications or APIs
- Defining scope and methodology for regulatory compliance assessments (PCI-DSS, HIPAA, SOC 2)
- Creating actionable test plans from high-level security requirements
- Documenting testing rationale and evidence requirements for stakeholder sign-off
- Standardizing penetration testing approaches across internal security teams or consulting practices
You might also like
You can accelerate your entire antenna design workflow—from initial concept to optimized specifications—by leveraging Claude's knowledge of electromagnetic theory, antenna types, and design trade-offs. Claude helps you parameterize designs, identify optimal configurations for your frequency band and application, and prepare detailed briefs for simulation and manufacturing. You'll generate design reviews, impedance-matching solutions, and validation checklists without context-switching to multiple tools.
Rapidly analyze production incidents by correlating observability signals—logs, metrics, traces, and events—to identify the true root cause instead of symptoms. You'll reconstruct incident timelines, quantify impact scope, and generate both immediate remediation steps and long-term prevention measures.
This skill guides you through designing Kalman filters for your specific state estimation and sensor fusion problems. You'll learn to diagnose filter divergence, tune covariance matrices (Q and R), and validate observability—turning mathematical theory into production-ready filters. The skill provides step-by-step workflows, diagnostic tools, and practical templates for common applications like GPS/IMU fusion, SLAM, and aircraft navigation.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You'll transform high-level feature requirements into a complete development plan covering API design, frontend implementation, testing strategy, and documentation. The skill helps you identify dependencies, parallelize work across frontend and backend teams, and establish quality gates that ensure features ship bug-free with proper error handling and logging.
Transform schema and data changes into production-ready migration packages that protect data integrity and minimize downtime. You can handle column additions, renames, type conversions, and backfills using proven patterns like expand-contract and shadow tables. The skill generates explicit rollback scripts, validation checklists, and phased execution plans that keep applications stable throughout the migration.
You can design end-to-end NGS pipelines tailored to your experiment type (WGS, WES, RNA-seq, targeted), troubleshoot pipeline failures by analyzing QC metrics and logs, and optimize performance by fine-tuning parameters and identifying bottlenecks. This skill handles the full workflow from raw sequencing data quality assessment through variant interpretation and annotation.
You can rapidly design, optimize, and validate chromatographic and LC-MS/MS methods for analyzing drugs and metabolites in biological matrices. This skill guides you through analytical method development workflows—including parameter selection, sensitivity optimization, and regulatory strategy—while ensuring ICH Q2(R2) and FDA compliance throughout the development process.