🛡️ Security Testing & Assessment Toolkit

• Un inventaire des assets exposés.
• Une liste de ports ouverts et justifiés.
• Une table des findings avec preuve courte.
• Un plan de correction priorisé.
• Un re-test après patch.
• Des contrôles CI/CD pour éviter la régression.

Une bonne évaluation augmente l’intrusivité par paliers. On arrête dès que la preuve suffit. L’objectif est de prouver et corriger, pas de maximiser l’impact.

1. Valider le périmètre.
2. Faire OSINT/DNS/CT logs.
3. Scanner ports externes depuis une machine hors cloud.
4. Énumérer seulement les services exposés.
5. Lancer TLS/headers.
6. Lancer ZAP baseline/Nikto/Nuclei contrôlé.
7. Faire SAST/SCA/secrets localement.
8. Analyser AWS/security groups/IAM/S3.
9. Créer le rapport et corriger.
10. Re-tester les mêmes commandes.

# Minimal run directory
                    mkdir -p security-audit/{recon,scan,tls,web,cloud,code,report}
                    cd security-audit

                    # Keep every raw output
                    # Do not overwrite evidence files during retest

• Installer Nmap pour Windows depuis le site officiel.
• Utiliser Docker Desktop si possible pour ZAP, Juice Shop, DVWA.
• Utiliser WSL2/Ubuntu pour les outils Linux.
• Garder les rapports dans un dossier de travail versionné.

# WSL2 Ubuntu example
                    sudo apt update
                    sudo apt install -y nmap git curl python3-pip docker.io
                    python3 -m pip install --user bandit pip-audit semgrep

                    # Windows PowerShell idea
                    # Use WSL for Linux-native commands and browser proxy for Burp/ZAP.

# OWASP Juice Shop practice target
                    docker run --rm -p 3000:3000 bkimminich/juice-shop

                    # DVWA practice target
                    docker run --rm -p 8080:80 vulnerables/web-dvwa

                    # ZAP baseline via Docker
                    docker run --rm -t ghcr.io/zaproxy/zaproxy:stable   zap-baseline.py -t http://host.docker.internal:3000

# Passive enumeration
                    amass enum -passive -d example.com -o recon/subdomains_amass.txt
                    subfinder -d example.com -all -o recon/subdomains_subfinder.txt

                    # Merge and resolve
                    cat recon/subdomains_*.txt | sort -u > recon/subdomains.txt
                    cat recon/subdomains.txt | httpx -silent -status-code -title -tech-detect > recon/live_http.txt

                    # Certificate Transparency check
                    # Search: %.example.com in crt.sh web UI

• Rechercher le domaine, les IPs, les certificats.
• Comparer les ports indexés aux ports attendus.
• Vérifier les bannières de versions exposées.
• Créer un ticket pour tout service non justifié.

# RustScan discovery, then nmap service detection
                    rustscan -a example.com -- -sV -sC -oN scan/rustscan_nmap.txt

                    # masscan should be rate-limited and used only on owned ranges
                    sudo masscan 203.0.113.0/24 -p1-65535 --rate 1000 -oG scan/masscan.gnmap

# HTTP security headers and methods
                    nmap -p 443 --script http-security-headers,http-methods example.com

                    # SSH algorithms
                    nmap -p 22 --script ssh2-enum-algos example.com

                    # DNS zone transfer test against an authoritative NS
                    nmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=example.com -p 53 ns1.example.com

sslscan example.com
                    sslyze --regular example.com
                    sslyze --json_out tls/sslyze.json example.com

                    curl -sI https://example.com | grep -iE 'strict-transport|content-security|x-frame|x-content|referrer|permissions'

# Example only, adapt to your Nginx baseline
                    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
                    add_header X-Content-Type-Options "nosniff" always;
                    add_header X-Frame-Options "SAMEORIGIN" always;
                    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
                    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Passive baseline scan, suitable for first CI checks
                    docker run --rm -t ghcr.io/zaproxy/zaproxy:stable   zap-baseline.py -t https://example.com -r zap_baseline.html

                    # Active full scan, staging only
                    docker run --rm -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable   zap-full-scan.py -t https://staging.example.com -r zap_full.html

                    # API scan from OpenAPI
                    docker run --rm -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable   zap-api-scan.py -t https://staging.example.com/openapi.json -f openapi -r zap_api.html

sudo apt install -y nikto
                    nikto -h https://example.com -o web/nikto.html -Format htm

# Fast manual checks
                    curl -I https://example.com/.git/HEAD
                    curl -I https://example.com/.env
                    curl -I https://example.com/backup.zip
                    curl -I https://example.com/config.php.bak
                    curl -I https://example.com/admin/
                    curl -I https://example.com/debug/

dirsearch -u https://example.com -e php,html,json
                    arjun -u https://example.com/api/endpoint
                    wfuzz -c -w wordlist.txt -d 'user=demo&pass=FUZZ' https://staging.example.com/login

# WordPress example
                    wpscan --url https://blog.example.com --enumerate vp,u --api-token TOKEN

                    # Drupal example
                    droopescan scan drupal -u https://example.com

                    # CMS detection
                    cmseek -u https://example.com

• Confirmer que le CMS est bien dans le périmètre.
• Exporter la liste plugins/thèmes/versions.
• Prioriser CVE exploitables publiquement.
• Mettre à jour hors heures de pointe.
• Tester régression fonctionnelle après patch.

# Capture a request from staging into request.txt first
                    # Then run against staging only
                    sqlmap -r request.txt --batch --risk=1 --level=1 --current-db

                    # Stop after proof. Do not dump data unless explicitly authorized.

• Utiliser des payloads inoffensifs en lab.
• Capturer request/response avant/après.
• Ne pas voler cookies, tokens ou données réelles.
• Documenter la source, le sink, et la correction.
• Re-tester après patch avec le même cas.

searchsploit nginx 1.24
                    searchsploit --nmap scan/nmap_full_tcp.xml

• Comparer version détectée et version réellement patchée.
• Lire l’exploit pour comprendre préconditions.
• Chercher si la configuration locale est vulnérable.
• Ne jamais exécuter un exploit inconnu sans lab isolé.

# Staging only, against a dedicated test account
                    hydra -l testuser -P small_test_wordlist.txt ssh://staging.example.com -t 2 -W 5

                    # Goal: confirm lockout/rate-limit, not crack accounts.

# Inspect cookie flags
                    curl -sI https://example.com/login | grep -i set-cookie

                    # Expected examples
                    # Secure; HttpOnly; SameSite=Lax or SameSite=Strict

# Manual role test idea
                    # 1. Login as user_a and capture token_a
                    # 2. Login as user_b and capture object_id_b
                    # 3. Call object_id_b using token_a
                    # 4. Expected: 403 or 404, never 200

# Inspect a JWT header/payload without trusting it
                    python3 - <<'PY'
                    import base64, json, sys
                    jwt = sys.argv[1]
                    for part in jwt.split('.')[:2]:
                    part += '=' * (-len(part) % 4)
                    print(json.dumps(json.loads(base64.urlsafe_b64decode(part)), indent=2))
                    PY '<JWT_TOKEN>'

# Trivy image scan
                    trivy image your-registry/your-app:latest

                    # Trivy filesystem scan
                    trivy fs .

                    # Grype image scan
                    grype your-registry/your-app:latest

                    # Docker Bench, host hardening
                    docker run --rm --net host --pid host --userns host --cap-add audit_control   -v /etc:/etc:ro -v /usr/bin/containerd:/usr/bin/containerd:ro   -v /usr/bin/runc:/usr/bin/runc:ro -v /var/lib:/var/lib:ro   -v /var/run/docker.sock:/var/run/docker.sock:ro   docker/docker-bench-security

python -m pip install pip-audit
                    pip-audit
                    pip-audit -r requirements.txt

                    # Trivy also scans local projects
                    trivy fs --scanners vuln,secret,misconfig .

# Gitleaks scan current repo and history
                    gitleaks detect --source . -v

                    # TruffleHog deep git history scan
                    trufflehog git file://./your-repo

# Start proxy
                    mitmproxy -p 8080

                    # Browser or client proxy points to 127.0.0.1:8080
                    # Install the mitmproxy CA only in the test profile.

• Créer une VM dédiée.
• Snapshot avant modification majeure.
• Pas de secrets personnels dans la VM.
• Réseau NAT par défaut.
• VPN si besoin.
• Dossier partagé seulement pour rapports.

# Suggested folders inside the VM
                    mkdir -p ~/audits/example/{recon,scan,tls,web,cloud,code,pcap,report}

# On the server: check listeners
                    sudo ss -tlnp | grep -E '8810|8820|3306|6379'

                    # Desired for internal services
                    # 127.0.0.1:8810
                    # 127.0.0.1:8820
                    # 127.0.0.1:3306 or private interface only

                    # Bad for internal services
                    # 0.0.0.0:8810
                    # 0.0.0.0:3306

# From outside the cloud
                    nmap -p 80,443,22,3306,6379,8810,8820 example.com

                    # TLS
                    ./testssl.sh example.com

                    # Web passive
                    nikto -h https://example.com

                    # Code/local
                    bandit -r ./app -ll
                    pip-audit -r requirements.txt

                    gitleaks detect --source . -v

                    # AWS
                    prowler aws --services ec2 s3 iam

• Rejouer exactement la même commande.
• Comparer diff de sortie.
• Conserver ancienne et nouvelle preuve.
• Fermer le ticket seulement si le risque disparaît.
• Ajouter un contrôle CI/CD quand possible.

# Example diff
                    nmap -p 22,3306,8810,8820 example.com -oN scan/retest_sensitive.txt
                    diff -u scan/nmap_sensitive.txt scan/retest_sensitive.txt || true

# radamsa mutation
                    radamsa sample.json > fuzzed.json
                    echo 'GET /api/example' | radamsa

                    # AFL++ for native parser targets
                    afl-cc -o target target.c
                    afl-fuzz -i seeds/ -o findings/ -- ./target @@

# Web passive and discovery
                    nikto -h https://example.com
                    ffuf -u https://example.com/FUZZ -w common.txt -mc 200,301,302,403
                    docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://example.com

                    # Code and dependencies
                    bandit -r ./app -ll
                    semgrep --config=auto ./app
                    pip-audit -r requirements.txt
                    gitleaks detect --source . -v

                    # Cloud and containers
                    prowler aws --services ec2 s3 iam
                    trivy fs .
                    trivy image your-registry/your-app:latest

# Staging only examples
                    sqlmap -r request.txt --batch --risk=1 --level=1 --current-db
                    hydra -l testuser -P small_test_wordlist.txt ssh://staging.example.com -t 2 -W 5

                    docker run --rm -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable   zap-full-scan.py -t https://staging.example.com -r zap_full.html