web-assessment

This skill activates when the user mentions "XSS", "cross-site scripting", "reflected XSS", "stored XSS", "DOM XSS", "blind XSS", "SQL injection", "SQLi", "blind SQLi", "union injection", "error-based injection", "time-based injection", "stacked queries", "second-order injection", "SSRF", "server-side request forgery", "cloud metadata", "IMDS", "internal service access", "IDOR", "insecure direct object reference", "broken access control", "horizontal privilege", "vertical privilege", "BOLA", "BFLA", "object-level authorization", "LFI", "local file inclusion", "RFI", "remote file inclusion", "path traversal", "directory traversal", "file read", "arbitrary file read", "dot dot slash", "command injection", "OS command injection", "RCE", "remote code execution", "code injection", "code execution", "reverse shell", "web shell", "SSTI", "server-side template injection", "template injection", "Jinja2 injection", "Twig injection", "Freemarker injection", "Velocity injection", "Pebble injection", "XXE", "XML external entity", "XML injection", "DTD injection", "XML parser", "NoSQL injection", "NoSQLi", "MongoDB injection", "operator injection", "authentication bypass", "auth bypass", "login bypass", "password reset", "account takeover", "session fixation", "session hijacking", "JWT attack", "JWT forgery", "token manipulation", "brute force login", "credential stuffing", "web vulnerability", "web application testing", "web pentest", "web assessment", "injection testing", "parameter fuzzing", "input validation", "OWASP", "OWASP Top 10", "A01 broken access", "A03 injection", "API testing", "REST API", "GraphQL injection", "parameter tampering", "mass assignment", "rate limiting", "race condition", "TOCTOU", "open redirect", "CRLF injection", "HTTP header injection", "deserialization", "insecure deserialization", "object injection", "file upload", "unrestricted upload", "web shell upload", "CORS misconfiguration", "CSP bypass", "clickjacking", "subdomain takeover", "host header injection", "nuclei scan", "sqlmap", "dalfox", "ffuf", "burp", "web scanner", "vulnerability scanner", "web fuzzing", "parameter discovery", or discusses testing web application security, exploiting web vulnerabilities, or performing web application penetration testing.