web-pentest
starsforks
How to install web-pentest?
hypnguyen1209/offensive-claude/web-pentest
$npx -y skills add hypnguyen1209/offensive-claude --skill web-pentestUse when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race
SKILL.md
| 1 | # Web Application Penetration Testing |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Web application security assessment (black/grey/white box) |
| 6 | - API security testing (REST, GraphQL, WebSocket) |
| 7 | - Authentication & session management testing (JWT, OAuth/OIDC, SAML) |
| 8 | - Business-logic and race-condition hunting |
| 9 | - WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache) |
| 10 | - Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud |
| 11 | metadata, prototype-pollution->RCE, SSTI sandbox escapes |
| 12 | |
| 13 | ## Input-Signal Routing (what to test when you see X) |
| 14 | |
| 15 | Fast test selection — map an observed parameter/behavior to the right deep-dive: |
| 16 | |
| 17 | | Input signal you observe | Test for | Go to | |
| 18 | |--------------------------|----------|-------| |
| 19 | | `id`, `uid`, `order_id`, `account`, GUID/sequential ref | IDOR/BOLA, access control | references/auth-api-access-control.md | |
| 20 | | `url`, `next`, `callback`, `dest`, `webhook`, `image_url` | SSRF + cloud metadata, open redirect, OAuth chain | references/ssrf-cloud-metadata.md | |
| 21 | | `price`, `qty`, `coupon`, `balance`, `status`, state change | business logic + single-packet race | references/http-desync-cache.md (race) | |
| 22 | | template/preview/name reflected in output | SSTI -> RCE, reflected XSS | references/ssti-deserialization.md | |
| 23 | | search/filter/sort reflected; `q=`, error echoes input | SQLi, XSS, command injection | references/injection-sqli-cmdi.md | |
| 24 | | `token`, `jwt`, `Authorization`, `Cookie`, OAuth `state` | JWT forgery, session/OAuth flaws | references/auth-api-access-control.md | |
| 25 | | serialized blob / base64 object / `__proto__` | deserialization, prototype pollution | references/ssti-deserialization.md | |
| 26 | | behind CDN/cache; `X-Forwarded-*`; keyed params | desync (0.CL/TE.0), cache poisoning | references/http-desync-cache.md | |
| 27 | |
| 28 | ## Technique Map |
| 29 | |
| 30 | | Technique | ATT&CK | CWE | Reference | Script | |
| 31 | |-----------|--------|-----|-----------|--------| |
| 32 | | SQL injection (UNION/blind/NoSQL) | T1190 | CWE-89 | references/injection-sqli-cmdi.md | scripts/ssrf_toolkit.py (probe pattern) / sqlmap | |
| 33 | | OS command / argument injection | T1059 | CWE-78 / CWE-88 | references/injection-sqli-cmdi.md | - | |
| 34 | | Reflected/stored/DOM XSS | T1059.007 | CWE-79 | references/xss-csp-clientside.md | scripts/xss_csp_forge.py | |
| 35 | | CSP bypass / script gadgets | T1059.007 | CWE-1021 | references/xss-csp-clientside.md | scripts/xss_csp_forge.py | |
| 36 | | Client-side prototype pollution -> XSS | T1059.007 | CWE-1321 | references/xss-csp-clientside.md | scripts/xss_csp_forge.py | |
| 37 | | SSRF + cloud metadata theft | T1552.005 | CWE-918 | references/ssrf-cloud-metadata.md | scripts/ssrf_toolkit.py | |
| 38 | | IMDSv2 bypass (Axios gadget) | T1552.005 | CWE-113 | references/ssrf-cloud-metadata.md | scripts/proto_ssti_gadgets.py | |
| 39 | | HTTP request smuggling / desync | T1190 | CWE-444 | references/http-desync-cache.md | scripts/desync_probe.py | |
| 40 | | Web cache poisoning / deception | T1557 | CWE-525 | references/http-desync-cache.md | scripts/desync_probe.py | |
| 41 | | SSTI -> RCE (Jinja2/Twig/FM/...) | T1059 | CWE-1336 | references/ssti-deserialization.md | scripts/proto_ssti_gadgets.py | |
| 42 | | Server-side prototype pollution -> RCE | T1059 | CWE-1321 | references/ssti-deserialization.md | scripts/proto_ssti_gadgets.py | |
| 43 | | Insecure deserialization (Java/.NET/PHP) | T1059 | CWE-502 | references/ssti-deserialization.md | ysoserial / ysoserial.net | |
| 44 | | JWT forgery (none/confusion/jku/jwk/kid) | T1078 | CWE-347 | references/auth-api-access-control.md | scripts/jwt_forge.py | |
| 45 | | OAuth/OIDC/SAML auth bypass | T1078 | CWE-287 | references/auth-api-access-control.md | scripts/jwt_forge.py | |
| 46 | | GraphQL abuse (batc |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
