Summary

Enhanced the Claude Playbook documentation with comprehensive task details, improved phase descriptions, and a new template selection guide. This update provides clearer execution guidance for each reconnaissance, scanning, and exploitation phase while adding a decision matrix to help users choose the right assessment template for their use case.

Key Changes

• Phase 1 (Recon): Converted task list to detailed table with specific instructions for subdomain enumeration, DNS intelligence, WHOIS lookups, OSINT harvesting, certificate transparency, infrastructure mapping, and AI-driven analysis. Added clarification that this phase uses passive techniques only.

• Phase 2 (Scanning): Enhanced with detailed guidance on high-speed port sweeps, service detection, WAF/CDN detection, NSE vulnerability scripts, exploit module searching, auxiliary scanning, and network traffic capture. Added note that this is the first active phase with packets sent to target.

• Phase 3A (Enumeration & Vulnerability Discovery): Expanded task descriptions to include technology fingerprinting, web vulnerability scanning, directory/content discovery, HTTP parameter discovery, XSS scanning, SQL injection testing, CMS-specific scanning, API endpoint enumeration, security header analysis, and web reconnaissance agents.

• Phase 3B (Active Exploitation): Added two new exploitation techniques to the mandatory testing table:

  • Server-Side Template Injection (SSTI) with RCE escalation guidance
  • NoSQL Injection with MongoDB operator testing

• Post-Exploitation Guidance: Enhanced lateral movement instructions to test credentials against ALL discovered services (SSH, FTP, admin panels, databases, APIs, Redis, MongoDB, MSSQL, PostgreSQL). Improved traffic capture and screenshot documentation requirements with specific guidance on element-level screenshots and annotation.

• Exploitation Decision Tree: Restructured the vulnerability exploitation flowchart to add a critical safety gate: destructive exploits (data deletion, ransomware, DoS) must be documented as Proof-of-Concept only without live execution, while non-destructive exploits proceed with full exploitation and data extraction.

• Template Reference: Completely redesigned the template section with:

  • Expanded table showing template name, use case, phases, and key differentiator
  • New "When to Use Which Template" decision matrix with 11 scenario-to-template mappings
  • Detailed descriptions of each template's workflow and capabilities
  • Guidance on scope handling, authentication support, and output formats

Notable Implementation Details

• All task tables now follow a consistent two-column format (Task | Details) for improved readability
• Added explicit safety guidance for destructive exploits to prevent accidental data loss
• Template descriptions include specific feature support (e.g., CIDR ranges, Swagger/OpenAPI, JWT attacks, scope compliance)
• Decision matrix helps users quickly identify the right template based on target type, engagement phase, and assessment goals

https://claude.ai/code/session_015HDuXoH7ZqS8wiuENg7A8e