BB probe

• low Risky intent intent-offensive-security reference/api-dast.md:51
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | PyRIT (Microsoft) | Multi-turn / multi-modal LLM red teaming (crescendo, TAP) | Integrates with Azure AI Foundry; pairs with Burp for hybrid API + LLM tests |

• low Risky intent intent-offensive-security reference/pentest-methodology-pitfalls.md:1
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)

  # Penetration Testing Methodology Pitfalls

  fixture
• low Risky intent intent-offensive-security reference/pentest-methodology-pitfalls.md:22
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)

  | `PT-06` | Skip post-exploitation thinking | Lateral movement risk stays hidden | Assess privilege escalation and impact paths safely |

  fixture
• low Risky intent intent-offensive-security reference/pentest-methodology-pitfalls.md:41
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)

  | `PTES` | Lifecycle management and end-to-end pentest structure | 2014 baseline still widely cited; supplement with newer guides |

  fixture
• low Risky intent intent-offensive-security reference/pentest-methodology-pitfalls.md:57
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)

  | AI / LLM / Agent integrations | Wallarm: 2,185 AI-related vulns in 2025, **36% overlap with API vulns**; **315 MCP-related vulns** with 270% Q2→Q3 growth. Prompt injection (LLM01), indirect injectio

  detectorfixture
• low Risky intent intent-offensive-security reference/recon.md:9
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Probe `recon`**: passive / low-touch recon. Output is an inventory (assets, tech, exposures, leaked secrets) — not a penetration test. No exploitation, no credential spraying, no active scanning o

• low Risky intent intent-offensive-security reference/recon.md:10
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Breach**: full red-team engagement including initial access, lateral movement, and objective achievement. `recon` is the first phase Breach would run, broken out as an explicit standalone delivera

• low Risky intent intent-offensive-security reference/recon.md:12
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  - **Other Probe recipes** (`zap`/`burp`/`nuclei`/`api`/`mobile`/`pentest`): active DAST. `recon` feeds them a target list; it never attacks.

  detector
• low Risky intent intent-offensive-security reference/recon.md:64
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  →  recommend next: `pentest` / `zap` / `api` / `mobile` for prioritized active follow-up

  detector
• low Risky intent intent-offensive-security reference/recon.md:92
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  - Recommend org-side rotation and MFA rollout; defer authenticated validation to a scoped `pentest` engagement.

  detector
• low Risky intent intent-offensive-security reference/vulnerability-testing-patterns.md:121
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file; quoted — discussed, not commanded)

  - `pentest`: Full PLAN→REPORT engagement. Scope, authorization, threat model, attack-path chaining. Output is a complete assessment report with CVSS v4.0, SLAs, and agent handoffs.

  fixturequoted
• low Risky intent intent-offensive-security reference/vulnerability-testing-patterns.md:124
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)

  - `recon`: Passive-by-default external attack-surface mapping. Output is an inventory, NOT a pentest — no exploitation, no auth attempts, no active vuln scans without separate written scope. Subfinder

  fixture
• low Risky intent intent-offensive-security SKILL.md:23
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Breach -> Probe: Red team scenarios requiring DAST validation

• low Risky intent intent-offensive-security SKILL.md:39
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  Probe is the dynamic security testing specialist. Use it to prove exploitability in running systems, validate static findings from Sentinel, design penetration test plans, and produce actionable DAST 

• low Risky intent intent-offensive-security SKILL.md:45
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - ZAP (v2.17.0), Burp Suite, Nuclei (v3.8.0 — pin against CVE-…405 and its GHSA follow-ups), DAST, pentesting, or runtime exploit verification. Version/tooling detail -> `reference/zap-scanning-

• low Risky intent intent-offensive-security SKILL.md:51
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Attack-path analysis — chaining identity abuse, misconfigurations, and privilege escalation into full compromise proof

• low Risky intent intent-offensive-security SKILL.md:59
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Red team scenario design or threat modeling → **Breach**

A further 1 matches are quotations in this security skill's documentation and are not counted as findings.