Infosec Suite

infosec-suite

Claude IS the operator — not an advisor. It runs full security engagements end-to-end: planning → recon → vulnerability scanning → exploit validation → professional report, using real security tools, enforcing scope, and producing structured findings.

Built on Claude Code. For solo bug bounty hunters and independent pentest consultants.

What it covers

- Web application testing (OWASP WSTG methodology)
- API security testing (OWASP API Security Top 10)
- Cloud infrastructure testing (CISA cloud security framework)

Skills

Requirements

- Debian-based Linux: Kali Linux, ParrotOS, Ubuntu 22.04+, or Debian 12+
- Claude Code CLI
- Internet access (for tool installation and external targets)

Setup
Note: Setup takes ~10–20 minutes on a fresh system. On Kali/ParrotOS with tools pre-installed, it's under 5 minutes.

What setup installs

- Go 1.21+ (from go.dev tarball — not apt)
- subfinder, httpx, nuclei, trufflehog, katana, ffuf, dalfox, interactsh-client (via go install)
- nmap, curl, jq, python3, sqlmap, seclists (via apt)
- wafw00f, mitmproxy, playwright, weasyprint, Markdown (via pip3)
- playwright chromium browser binary (~130 MB)
- nuclei templates
- AWS CLI, Google Cloud SDK, Azure CLI (required for cloud engagements)
- Pacu — AWS exploitation framework

Usage

Example output from /infosec-report:

All engagement data is saved to session/{engagement_id}/:

Report modes

/infosec-report auto-detects the engagement context from engagement-plan.json:

- bug_bounty — HackerOne/Bugcrowd-formatted submission block per critical/high finding, with steps to reproduce and impact statements
- internal — full pentest report: confidential cover page, executive summary, CVSS severity table, technical findings with numbered IDs (e.g. EC-IPF-001), remediation…