## https://sploitus.com/exploit?id=7231B5D4-70F5-559A-B928-43340C24B81B
# External Penetration Test agents for Claude Code
**A Claude Code plugin that runs a full, methodology-driven external penetration test** —
working through the same phases a human tester would: scope, recon, enumeration, attack
planning, exploitation, and reporting. Aligned to **PTES** and the **OWASP Web Security
Testing Guide (WSTG)**, and built around the standard toolchain (nmap, the ProjectDiscovery
stack, testssl, nuclei, ffuf, and more).
> ⚠️ **Authorized engagements only.** Every phase reads `./ext-engagement/scope.md` and
> refuses to act outside it. The agents will not run DoS/stress tests, will not brute
> force in a way that risks lockouts, prefer the least-intrusive proof of a finding, and
> gate every intrusive or state-changing action behind explicit human confirmation. Use
> this only against systems you are **authorized in writing** to test.
## The flow
| Step | Command | What runs |
|---|---|---|
| 1. Scope | `/ext-scope ` | Record authorization, targets, out-of-scope, window, rate limits, forbidden actions. |
| 2. Recon + enum | `/ext-recon` | `ext-enumerator`: passive OSINT → active discovery → web/TLS/DNS → services → cloud/takeover → nuclei. **Read-only.** |
| 3. Attack plan | `/ext-attack-paths` | `ext-attack-planner`: correlate exposures → ranked footholds (CVSS). **Plan only.** |
| 4. Exploit | `/ext-exploit` | `ext-exploit-operator`: one approved step at a time, confirms before anything intrusive. |
| 5. Report | `/ext-report` | `ext-reporter`: severity-ranked findings + evidence + remediation (Markdown; HTML on request). |
## What's inside
**Agents** (focused sub-Claudes, scoped tool access)
- `ext-enumerator` · `ext-attack-planner` · `ext-exploit-operator` · `ext-reporter`
**Skills** (reference knowledge loaded on demand)
- `ext-methodology` — PTES phases + WSTG mapping, ordering rules
- `ext-passive-osint` — ASN/subdomains/cert-transparency/leaks, quiet surface mapping
- `ext-recon-enum` — the active command reference (ProjectDiscovery workflow, safe defaults)
- `ext-web-testing` — OWASP WSTG 12-category checklist, detection-vs-exploit line
- `ext-service-attacks` — SSH/FTP/SMB/RDP/mail/DB/VPN safe enumeration + CVE mapping
- `ext-cloud-and-takeover` — subdomain takeover + exposed S3/Azure/GCP storage
- `ext-opsec-reporting` — do-no-harm OPSEC + CVSS report structure
- `ext-tooling-setup` — preflight tool/wordlist check + install + substitutes
## Install
```bash
# in Claude Code:
/plugin marketplace add https://github.com/xcoy0te/Claude-ExternalPentest
/plugin install claude-extpt
# or from a local clone:
/plugin marketplace add /path/to/claude-extpt
```
No build step — everything is Markdown + a small JSON manifest. Edit any file and re-run.
## Requirements
The agents drive external tools; install what you can and the plugin will note/substitute
what's missing (see `ext-tooling-setup`): `nmap`, ProjectDiscovery
(`subfinder`/`dnsx`/`httpx`/`naabu`/`nuclei`/`katana`), `ffuf`/`feroxbuster`, `testssl`,
`sslscan`, `whatweb`, `wafw00f`, `smbclient`, `enum4linux-ng`, `gowitness`, `subzy`,
`amass`, `sqlmap`, `nikto`, and **SecLists**. A Kali/Parrot box has most of these.
## Quick start
```
/ext-scope 203.0.113.10 app.example.com
/ext-recon
/ext-attack-paths
# review the plan, approve a step:
/ext-exploit
/ext-report
```
Engagement artifacts land in `./ext-engagement/` (git-ignored — it holds client data and
secrets; never commit it).
## Safety & legal
This project is for **authorized** penetration testing and defensive security work. You
are responsible for having written permission for every target. The authors provide this
under the MIT license with no warranty; see `LICENSE`. See `docs/METHODOLOGY.md` for the
full methodology and `docs/EXAMPLE-ENGAGEMENT.md` for a walkthrough.
## Credits
Structure inspired by community Claude Code security plugins (e.g. `claude-ad` for
Active Directory). Methodology grounded in PTES and the OWASP WSTG. Contributions
welcome — see `CONTRIBUTING.md`.