What problem does it solve? Security testing of web applications and APIs requires a structured methodology and a full toolchain, which is time-consuming to set up and easy to execute inconsistently. This Skill provides a ready-to-use Kali Linux Docker environment plus systematic testing checklists, attack patterns, and reporting templates. ## Core Features & Use Cases - Dockerized Kali Environment: One-command setup of a pentest-kali container pre-loaded with Burp Suite, Nikto, SQLMap, Gobuster, Hydra, Nmap, and HTTPie, with results persisted to a mounted folder. - Systematic Testing Methodology: Phased workflow covering reconnaissance, authentication, authorization (IDOR/BOLA), injection, mass assignment, and business logic testing, aligned with the OWASP API Security Top 10. - Rails-Specific Guidance: Dedicated reference for Devise enumeration, Pundit/CanCanCan policy bypass, strong parameters bypass, unsafe deserialization, and file upload attacks. - Structured Reporting: Finding templates with severity ratings, CVSS/CWE mapping, proof-of-concept format, and executive summary structure. - Use Case: Given a staging API, spin up the Kali container, enumerate endpoints, test each one for IDOR and injection using the provided curl patterns, and produce a severity-ranked findings report. ## Quick Start Ask the agent to start the Kali container and run a security assessment of your API's authentication and authorization controls, then report findings by severity.
