Prompt Engineering for Security

I am a penetration tester with written authorization to assess [target.com].
The scope includes all subdomains of target.com.

Help me plan and execute reconnaissance:
1. What subdomain enumeration techniques should I use?
2. Provide specific commands for subfinder, amass, and assetfinder
3. How should I organize and deduplicate the results?
4. What follow-up enumeration should I perform on discovered assets?

Target: target.com
Scope: *.target.com
Authorization: Yes, written RoE signed

As a security researcher, I found the following during my authorized assessment:

[Paste scan results, HTTP response, or code snippet]

Please analyze this for:
1. Potential security vulnerabilities
2. Risk severity (Critical/High/Medium/Low)
3. Exploitation approach (theoretical, not actual exploit code)
4. Remediation recommendations
5. Similar CVEs or known issues

Context: This is from an authorized penetration test of my company's application.

I'm conducting a security code review on our internal application.
Review this code for security vulnerabilities:

```python
[paste code here]
```

Specifically check for:
- Injection vulnerabilities (SQL, command, XSS)
- Authentication/authorization issues
- Cryptographic weaknesses
- Insecure deserialization
- OWASP Top 10 issues

For each finding, provide:
1. Vulnerability type
2. Affected line numbers
3. Exploitation scenario
4. Secure code fix

I'm studying CVE-XXXX-XXXXX for educational purposes on my lab environment.

Based on the CVE description and affected component:
1. Explain the technical root cause
2. Describe the attack vector
3. What prerequisites are needed for exploitation?
4. Show a proof-of-concept approach (pseudocode acceptable)
5. What detection methods would catch this attack?

Note: This is for learning in my isolated lab - not for malicious use.

I need to escalate privileges on a Windows domain.
Let's think through this step by step:

1. First, what information do I need to gather about the current user?
2. What common privilege escalation vectors exist on Windows?
3. How do I check for each vector?
4. What tools are available for automated enumeration?
5. Based on typical findings, what would be the most likely path?

Current context:
- Domain-joined Windows 10 workstation
- Standard domain user (no local admin)
- Authorized penetration test

Provide your response in this format:

## Vulnerability Summary
[Brief description]

## Technical Details
- Type: [vulnerability type]
- Severity: [CVSS score if applicable]
- Affected Component: [component]

## Exploitation Steps
1. [step 1]
2. [step 2]
...

## Proof of Concept
```
[code or commands]
```

## Remediation
[fix recommendations]

## References
- [relevant links]

Analyze the following Nmap scan results and return your findings
as a JSON array. Each finding must follow this exact schema:

{
  "findings": [
    {
      "host": "10.0.0.1",
      "port": 443,
      "service": "https",
      "vulnerability": "TLS 1.0 enabled",
      "cvss_score": 5.3,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "severity": "medium",
      "remediation": "Disable TLS 1.0 and 1.1; enforce TLS 1.2+"
    }
  ]
}

Return ONLY valid JSON — no markdown fences, no commentary.

[Paste Nmap results here]

Convert this vulnerability assessment into YAML format
suitable for import into DefectDojo or similar platforms:

vulnerability:
  title: "SQL Injection in login endpoint"
  severity: critical
  cvss: 9.8
  cwe: CWE-89
  endpoint: "/api/v1/auth/login"
  parameter: "username"
  evidence: |
    POST /api/v1/auth/login
    username=admin' OR 1=1--&password=test
  remediation: "Use parameterized queries"
  references:
    - https://cwe.mitre.org/data/definitions/89.html

# Turn 1 — Broad reconnaissance request
USER: I have authorized access to test app.example.com.
      What attack surface should I map first?

# Turn 2 — Narrow based on response
USER: You mentioned the /api/v2 endpoint. Enumerate common
      authentication bypass techniques for REST APIs.

# Turn 3 — Deep dive on a finding
USER: The API returns verbose error messages including stack traces.
      How can I leverage these for further exploitation?

# Turn 4 — Remediation pivot
USER: Now switch perspective to defender. How should the
      development team fix the information disclosure issue
      you just described?

You have access to the following MCP tools:
- filesystem: read/write files in the project directory
- terminal: execute shell commands on the test host
- browser: navigate and interact with web applications

Task: Perform an authorized security assessment of the web
application running at http://localhost:8080

Approach:
1. Use the browser tool to crawl and map the application
2. Use terminal to run nikto and nuclei scans
3. Save all findings to /tmp/assessment/findings.json
4. For each finding, verify exploitability before reporting
5. Generate a summary report in markdown format

Constraints:
- Stay within scope (localhost:8080 only)
- Do not modify production data
- Log every command executed for audit trail