webapp-exploit-hunter

Name: webapp-exploit-hunter
Author: Orizon-eu

18stars4forks

How to install webapp-exploit-hunter?

orizon-eu/claude-code-pentest/webapp-exploit-hunter

$npx -y skills add Orizon-eu/claude-code-pentest --skill webapp-exploit-hunter

Installs into the current project.

Summary

Automated web application vulnerability scanner and exploit generator starting from domains or URLs. Tests for SQLi, XSS, SSRF, IDOR, SSTI, authentication bypass, file upload bypass, and race conditions. Generates working PoC for each finding. Use when user asks to "find vulnerab

Files · 1

View on GitHub

SKILL.md

1	# Webapp Exploit Hunter
2
3	Intelligent web application vulnerability scanner. Context-aware testing that adapts to the target's technology stack.
4
5	## Important
6
7	CRITICAL: Only test web applications you have explicit authorization to test (pentest agreement, bug bounty program, or own infrastructure).
8
9	## Instructions
10
11	### Step 1: Target Setup
12	Accept input as:
13	1. Single domain or URL
14	2. List of domains/URLs (from recon-dominator output or manual list)
15	3. Specific endpoint to test
16
17	For each target, determine:
18	- Is it in scope?
19	- What technology stack is it running? (use tech_fingerprint.py from recon-dominator or fingerprint inline)
20	- Are there any testing restrictions (rate limits, no automated scanning, etc.)?
21
22	### Step 2: Crawling and Endpoint Discovery
23
24	```bash
25	python scripts/crawler.py --target {url} --depth 3
26	```
27
28	Intelligent crawling:
29	1. Spider all linked pages up to configured depth
30	2. Extract forms and input parameters
31	3. Identify API endpoints from JavaScript files
32	4. Parse robots.txt and sitemap.xml for hidden paths
33	5. Fuzz for common hidden endpoints
34
35	Output: Structured map of all endpoints with parameters.
36
37	### Step 3: Parameter Classification
38
39	For each discovered parameter, classify:
40	- Input type: string, numeric, email, URL, file path, JSON, XML
41	- Reflection: Is input reflected in response? Where? (HTML body, attribute, JS, header)
42	- Sink type: Database query, file system, HTTP request, template, command, redirect
43	- Authentication: Does the endpoint require auth?
44
45	This classification determines which vulnerability tests are relevant.
46
47	### Step 4: Vulnerability Testing
48
49	Run tests based on parameter classification. Order by severity:
50
51	#### 4a. SQL Injection
52
53	```bash
54	python scripts/sqli_tester.py --target {url} --params {param_file}
55	```
56
57	Test types:
58	- Error-based: Single quote, double quote, comment injection
59	- Boolean-based blind: True/false condition comparison
60	- Time-based blind: SLEEP/WAITFOR/pg_sleep injection
61	- UNION-based: Column count detection + data extraction
62	- Second-order: Stored input used later in queries
63
64	For each finding: extract DBMS type, confirm exploitability, extract sample data as PoC.
65
66	#### 4b. Cross-Site Scripting (XSS)
67
68	```bash
69	python scripts/xss_tester.py --target {url} --params {param_file}
70	```
71
72	Context-aware payloads:
73	- HTML body: `<script>`, `<img onerror>`, `<svg onload>`
74	- HTML attribute: Event handlers, attribute breaking
75	- JavaScript context: String breaking, template literals
76	- URL context: javascript: protocol, data: URIs
77	- CSS context: expression(), url()
78
79	Test for:
80	- Reflected XSS (immediate response)
81	- Stored XSS (submit then check display page)
82	- DOM-based XSS (analyze client-side JS)
83
84	Bypass techniques: encoding, case variation, tag alternatives, WAF bypass patterns.
85
86	#### 4c. Server-Side Request Forgery (SSRF)
87
88	```bash
89	python scripts/ssrf_tester.py --target {url} --params {param_file}
90	```
91
92	Test URL/redirect parameters for:
93	- Internal network access: 127.0.0.1, 0.0.0.0, localhost
94	- Cloud metadata: 169.254.169.254 (AWS), metadata.google.internal (GCP)
95	- Internal services: common ports on internal IPs
96	- Protocol smuggling: file://, gopher://, dict://
97	- Bypass techniques: decimal IP, hex IP, DNS rebinding, URL parsing tricks
98
99	#### 4d. Insecure Direct Object Reference (IDOR)
100
101	```bash
102	python scripts/idor_tester.py --target {url} --endpoints {endpoint_file}
103	```
104
105	For endpoints with IDs (numeric, UUID, sequential):
106	- Test horizontal access: Change ID to access other users' resources
107	- Test vertical access: Access admin-only endpoints with regular user
108	- Test with different HTTP methods (GET vs POST vs PUT vs DELETE)
109	- Pattern detection: Sequential IDs, predictable UUIDs, encoded IDs
110
111	#### 4e. Server-Side Template Injection (SSTI)
112
113	```bash
114	python scripts/ssti_tester.py --target {url} --params {param_file}
115	```
116
117	Template engine detection and exploitation:
118	- Jinja2: `{{7*7}}`, `{{config}}`, `{{''.__class__.__mro__}}`
119	- Twig: `{{7*7}}`, `{{_self.env.registerUndefinedFilterCallback("system")}}`
120	- Freemarker: `${7*7}`, `<#assign ex="freemarker.template.utility.Execute"?new()>`
121	- ERB: `<%= 7*7 %>`, `<%= system('id') %>`
122	- Smarty: `{php}system('id');{/php}`
123
124	Polyglot detection: `${{<%[%'"}}%\.`
125
126	#### 4f. Authentication and Session Testing
127
128	```bash
129	python scripts/auth_tester.py --target {url}
130	```
131
132	Test for:
133	- Default credentials (based on detected technology)
134	- Password reset flaws (token prediction, no rate limit

People who liked this also viewed

6 picks

Type

webapp-exploit-hunter

18stars4forks

View on GitHub

How to install webapp-exploit-hunter?

orizon-eu/claude-code-pentest/webapp-exploit-hunter

$npx -y skills add Orizon-eu/claude-code-pentest --skill webapp-exploit-hunter

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Webapp Exploit Hunter
2
3	Intelligent web application vulnerability scanner. Context-aware testing that adapts to the target's technology stack.
4
5	## Important
6
7	CRITICAL: Only test web applications you have explicit authorization to test (pentest agreement, bug bounty program, or own infrastructure).
8
9	## Instructions
10
11	### Step 1: Target Setup
12	Accept input as:
13	1. Single domain or URL
14	2. List of domains/URLs (from recon-dominator output or manual list)
15	3. Specific endpoint to test
16
17	For each target, determine:
18	- Is it in scope?
19	- What technology stack is it running? (use tech_fingerprint.py from recon-dominator or fingerprint inline)
20	- Are there any testing restrictions (rate limits, no automated scanning, etc.)?
21
22	### Step 2: Crawling and Endpoint Discovery
23
24	```bash
25	python scripts/crawler.py --target {url} --depth 3
26	```
27
28	Intelligent crawling:
29	1. Spider all linked pages up to configured depth
30	2. Extract forms and input parameters
31	3. Identify API endpoints from JavaScript files
32	4. Parse robots.txt and sitemap.xml for hidden paths
33	5. Fuzz for common hidden endpoints
34
35	Output: Structured map of all endpoints with parameters.
36
37	### Step 3: Parameter Classification
38
39	For each discovered parameter, classify:
40	- Input type: string, numeric, email, URL, file path, JSON, XML
41	- Reflection: Is input reflected in response? Where? (HTML body, attribute, JS, header)
42	- Sink type: Database query, file system, HTTP request, template, command, redirect
43	- Authentication: Does the endpoint require auth?
44
45	This classification determines which vulnerability tests are relevant.
46
47	### Step 4: Vulnerability Testing
48
49	Run tests based on parameter classification. Order by severity:
50
51	#### 4a. SQL Injection
52
53	```bash
54	python scripts/sqli_tester.py --target {url} --params {param_file}
55	```
56
57	Test types:
58	- Error-based: Single quote, double quote, comment injection
59	- Boolean-based blind: True/false condition comparison
60	- Time-based blind: SLEEP/WAITFOR/pg_sleep injection
61	- UNION-based: Column count detection + data extraction
62	- Second-order: Stored input used later in queries
63
64	For each finding: extract DBMS type, confirm exploitability, extract sample data as PoC.
65
66	#### 4b. Cross-Site Scripting (XSS)
67
68	```bash
69	python scripts/xss_tester.py --target {url} --params {param_file}
70	```
71
72	Context-aware payloads:
73	- HTML body: `<script>`, `<img onerror>`, `<svg onload>`
74	- HTML attribute: Event handlers, attribute breaking
75	- JavaScript context: String breaking, template literals
76	- URL context: javascript: protocol, data: URIs
77	- CSS context: expression(), url()
78
79	Test for:
80	- Reflected XSS (immediate response)
81	- Stored XSS (submit then check display page)
82	- DOM-based XSS (analyze client-side JS)
83
84	Bypass techniques: encoding, case variation, tag alternatives, WAF bypass patterns.
85
86	#### 4c. Server-Side Request Forgery (SSRF)
87
88	```bash
89	python scripts/ssrf_tester.py --target {url} --params {param_file}
90	```
91
92	Test URL/redirect parameters for:
93	- Internal network access: 127.0.0.1, 0.0.0.0, localhost
94	- Cloud metadata: 169.254.169.254 (AWS), metadata.google.internal (GCP)
95	- Internal services: common ports on internal IPs
96	- Protocol smuggling: file://, gopher://, dict://
97	- Bypass techniques: decimal IP, hex IP, DNS rebinding, URL parsing tricks
98
99	#### 4d. Insecure Direct Object Reference (IDOR)
100
101	```bash
102	python scripts/idor_tester.py --target {url} --endpoints {endpoint_file}
103	```
104
105	For endpoints with IDs (numeric, UUID, sequential):
106	- Test horizontal access: Change ID to access other users' resources
107	- Test vertical access: Access admin-only endpoints with regular user
108	- Test with different HTTP methods (GET vs POST vs PUT vs DELETE)
109	- Pattern detection: Sequential IDs, predictable UUIDs, encoded IDs
110
111	#### 4e. Server-Side Template Injection (SSTI)
112
113	```bash
114	python scripts/ssti_tester.py --target {url} --params {param_file}
115	```
116
117	Template engine detection and exploitation:
118	- Jinja2: `{{7*7}}`, `{{config}}`, `{{''.__class__.__mro__}}`
119	- Twig: `{{7*7}}`, `{{_self.env.registerUndefinedFilterCallback("system")}}`
120	- Freemarker: `${7*7}`, `<#assign ex="freemarker.template.utility.Execute"?new()>`
121	- ERB: `<%= 7*7 %>`, `<%= system('id') %>`
122	- Smarty: `{php}system('id');{/php}`
123
124	Polyglot detection: `${{<%[%'"}}%\.`
125
126	#### 4f. Authentication and Session Testing
127
128	```bash
129	python scripts/auth_tester.py --target {url}
130	```
131
132	Test for:
133	- Default credentials (based on detected technology)
134	- Password reset flaws (token prediction, no rate limit

People who liked this also viewed

6 picks

Type