guest@geearr:~/services$ man geearr-pentest
NAME
geearr-pentest — penetration testing by George Rios
Penetration Testing: Penetration testing that finds what scanners miss.
SYNOPSIS
geearr pentest [--web] [--api] [--perimeter] [--cloud] [--retest] <scope>DESCRIPTION
Automated scanners find the obvious. Real attackers chain small weaknesses — a verbose error, a predictable ID, a forgotten staging host — into a breach. A geearr penetration test is hands-on: map the real attack surface, think like an adversary, and prove impact with safe, controlled exploitation so you fix what actually matters.
OPTIONS — WHAT GETS TESTED
--web · Web applications
- Authentication, session & MFA bypass
- Broken access control / IDOR
- Injection: SQL, NoSQL, command, template
- XSS, CSRF, SSRF & request smuggling
- Business-logic abuse & race conditions
--api · APIs & mobile backends
- REST, GraphQL & gRPC
- OWASP API Top 10: BOLA, BFLA, mass assignment
- OAuth 2.0 / OIDC & JWT handling
- Rate limiting & resource exhaustion
- Webhook & integration trust boundaries
--perimeter · External perimeter & cloud
- Attack-surface & subdomain discovery
- Exposed services, admin panels & storage
- TLS, DNS & subdomain takeover
- Cloud metadata & IAM escalation paths
- Secrets in repos, builds and buckets
OUTPUT — WHAT YOU GET
- 01Executive summary written for leadership, auditors and insurers
- 02Technical findings with CVSS scoring, evidence and reproduction steps
- 03Prioritized remediation guidance mapped to your stack
- 04Live readout with your engineering team
- 05Retest of fixed findings and an updated attestation letter
EXAMPLES
$ geearr pentest --web --api --role tenant-user --role admin app.example.com 14 findings · 1 critical · 3 high critical: BOLA chain → cross-tenant invoice access (CVSS 9.1)
$ geearr pentest --retest --findings all 13/14 closed · 1 accepted risk documented attestation letter issued
# illustrative output
CONFORMING TO
- OWASP WSTG
- OWASP ASVS
- OWASP API Security Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
FAQ
[+][-]What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated: it matches software versions and configurations against known issues and produces a long, noisy list. A penetration test is performed by a human who validates findings, chains weaknesses together, tests business logic, and demonstrates real impact. Scans are useful hygiene; a pen test tells you what an attacker could actually do.
[+][-]How long does a penetration test take?
Most web application or API penetration tests take one to three weeks of testing depending on the number of user roles, endpoints and integrations in scope, followed by reporting and a readout. A focused external perimeter test can be shorter. Scope and timeline are agreed during a free scoping call.
[+][-]Is penetration testing safe to run against production?
Yes, when it is scoped properly. Testing follows agreed rules of engagement, avoids destructive payloads and denial-of-service, uses dedicated test accounts, and coordinates timing with your team. A production-equivalent staging environment is an equally valid target.
SEE ALSO
guides: Penetration test vs. vulnerability scan: what’s the difference?
glossary: attack-surface(7), penetration-test(7), vulnerability-scan(7), cvss(7), bola(7), ssrf(7)
shipped: engrave(8) — The black box recorder for AI agents., authnznet(8) — OAuth 2.0 + OIDC server in three commands.
services: geearr-appsec(1), geearr-email(1), geearr-cloud(1), geearr-ai(1)
EXIT STATUS
0 when every finding is closed and retested. Anything else means we keep going.
BUGS
None known. That’s what retests are for. Found one in this site? security.txt