Run any Skill in Manus with one click

web-app-security

Stars3

Forks1

UpdatedJune 25, 2026 at 18:14

Web application security testing following OWASP methodology, including injection testing, authentication bypass, XSS, CSRF, SSRF, IDOR, file upload attacks, API security testing, and web application firewalling. Use this skill whenever the user mentions web app testing, OWASP top 10, SQL injection, XSS, cross-site scripting, CSRF, SSRF, IDOR, insecure deserialization, file upload vulnerability, API security, JWT testing, session management testing, authentication bypass, authorization testing, Burp Suite, ZAP, OWASP testing guide, web app pentest, application security assessment, or any web-focused security testing task. Also trigger for: ffuf, gobuster, wfuzz, sqlmap, XSStrike, commix, directory brute force, parameter fuzzing, web fuzzing, cookie testing, header injection, HTTP verb tampering, CORS misconfiguration, clickjacking, content security policy, or "test this web application for vulnerabilities". Expert tools: sqlmap (SQLi), Burp Suite (intercepting proxy), ZAP (open-source proxy), ffuf (web fuzzer

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

az0307

az0307/Aurora-AI-Agency

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

More from this repository

same repository

active-directory

az0307/Aurora-AI-Agency

Active Directory and Windows domain attack techniques including domain enumeration, Kerberos attacks, credential relay, lateral movement, and domain privilege escalation for internal penetration testing engagements. Use this skill whenever the user mentions Active Directory, AD attacks, domain enumeration, BloodHound, Kerberoasting, AS-REP roasting, pass the hash, pass the ticket, overpass the hash, golden ticket, silver ticket, DCSync, DCShadow, NTDS.dit extraction, LDAP enumeration, domain controller, Group Policy abuse, ACL abuse, delegation abuse, constrained delegation, unconstrained delegation, resource-based constrained delegation, ADCS attacks, certificate abuse, LAPS, gMSA, domain trust attacks, forest trust, or any Windows domain-focused penetration testing activity. Also trigger for: impacket, crackmapexec, evil-winrm, bloodhound-python, kerbrute, responder, ntlmrelayx, petitpotam, certipy, rubeus, mimikatz, powerview, sharphound, enum4linux, smbclient, rpcclient, "enumerate the domain", "dump doma

2026-06-253

audit-logger

az0307/Aurora-AI-Agency

Security engagement audit logging, evidence chain management, and compliance trail for penetration testing. Use this skill whenever the user mentions audit log, audit trail, engagement logging, evidence collection, chain of custody, compliance logging, pentest logging, tool execution logging, JSONL log, activity log, forensic evidence, engagement timeline, or any request to log, track, or document security testing activities. Also trigger for: "log this action", "create audit trail", "evidence chain", "what did we do", "engagement timeline", "export activity log", or when any other security skill needs to record its actions for compliance. This skill is called BY other skills — it is the universal logging layer.

2026-06-253

credential-attack

az0307/Aurora-AI-Agency

Password cracking, credential brute force, hash analysis, and authentication testing for penetration testing engagements. Use this skill whenever the user mentions password cracking, hash cracking, brute force attack, credential spraying, password spray, dictionary attack, hashcat, john the ripper, hydra, medusa, credential stuffing, NTLM hash, NTHash, NetNTLMv2, Kerberos ticket cracking, AS-REP roasting, Kerberoasting, hash identification, rainbow tables, wordlist generation, custom wordlists, CeWL, crunch, cupp, password policy analysis, or any request to crack, guess, or test credentials. Also trigger for: "crack these hashes", "brute force this login", "test default credentials", "generate a wordlist", "what hash type is this", "password audit", or any credential-related testing activity. Expert tools: hashcat (GPU), john (CPU), hydra (online brute force), crackmapexec (network cred testing), medusa (parallel brute force).

2026-06-253

ctf-walkthrough

az0307/Aurora-AI-Agency

Generate structured CTF walkthrough writeups from engagement data, findings, and attack paths. Use this skill whenever the user mentions CTF writeup, walkthrough, write-up, CTF solution, box writeup, challenge writeup, HackTheBox writeup, TryHackMe writeup, "write up this box", "document how I solved", "create a walkthrough for", or any request to document a CTF/lab solution in educational format. Also trigger for: "writeup for HTB", "THM walkthrough", "document the attack path", "how did we solve this", or when red-team-report is called with engagement type CTF. Produces clean Markdown writeups with technique explanations, command output, and learning notes — suitable for blog posts or portfolio.

2026-06-253

exploit-dev

az0307/Aurora-AI-Agency

Exploit research, proof-of-concept development, controlled exploitation, and initial access verification for penetration testing engagements. Use this skill whenever the user mentions exploit development, PoC creation, Metasploit module execution, searchsploit, payload generation, msfvenom, exploit testing, vulnerability exploitation, initial access, shell access, reverse shell, bind shell, exploit chain, privilege escalation exploits, buffer overflow, web shell upload, or "can we exploit this finding". Also trigger for: ExploitDB search, Metasploit framework usage, custom exploit writing, payload encoding, exploit adaptation, weaponization, or any request to move from identified vulnerability to confirmed access. This is phase three of a pentest — trigger after vuln-analysis confirms exploitable findings, or standalone when the operator has a specific CVE. CRITICAL: All exploitation requires human approval before execution. The AI prepares commands and payloads but the operator confirms each run.

2026-06-253

network-forensics

az0307/Aurora-AI-Agency

Network traffic capture, packet analysis, protocol dissection, and digital evidence preservation for security engagements. Use this skill whenever the user mentions packet capture, pcap analysis, Wireshark, tshark, tcpdump, network forensics, traffic analysis, protocol analysis, packet inspection, network evidence, DNS analysis from captures, HTTP traffic extraction, credential sniffing from pcap, malware traffic analysis, C2 detection, network timeline reconstruction, or any task involving captured network data. Also trigger for: "capture traffic", "analyze this pcap", "what's in this capture", "extract files from pcap", "find credentials in traffic", "reconstruct network session", or any network evidence analysis task. Expert tools: tshark (CLI analysis), tcpdump (capture), Wireshark (GUI), NetworkMiner (artifact extraction), zeek (protocol logging).

2026-06-253

name	web-app-security
description	Web application security testing following OWASP methodology, including injection testing, authentication bypass, XSS, CSRF, SSRF, IDOR, file upload attacks, API security testing, and web application firewalling. Use this skill whenever the user mentions web app testing, OWASP top 10, SQL injection, XSS, cross-site scripting, CSRF, SSRF, IDOR, insecure deserialization, file upload vulnerability, API security, JWT testing, session management testing, authentication bypass, authorization testing, Burp Suite, ZAP, OWASP testing guide, web app pentest, application security assessment, or any web-focused security testing task. Also trigger for: ffuf, gobuster, wfuzz, sqlmap, XSStrike, commix, directory brute force, parameter fuzzing, web fuzzing, cookie testing, header injection, HTTP verb tampering, CORS misconfiguration, clickjacking, content security policy, or "test this web application for vulnerabilities". Expert tools: sqlmap (SQLi), Burp Suite (intercepting proxy), ZAP (open-source proxy), ffuf (web fuzzer), nuclei (template scanner), XSStrike (XSS), commix (command injection), jwt_tool (JWT attacks).
compatibility	{"tools":["bash","python"],"mcps":["desktop-commander","hexstrike"],"skills":["vuln-analysis","scope-guard","exploit-dev"]}

Web Application Security Skill

Overview

Comprehensive web application testing following OWASP Testing Guide v4.2. Maps every OWASP Top 10 category to the best expert tool and provides step-by-step testing procedures. Feeds findings into vuln-analysis for CVE correlation and exploit-dev for confirmed exploitation.

Expert Tool Map — OWASP Top 10 (2021)

OWASP Category	Best Tool	Backup Tool	MCP Available
A01 Broken Access Control	Manual + Burp/ZAP	ffuf + auth tokens	Burp MCP (partial)
A02 Cryptographic Failures	testssl.sh, nmap ssl scripts	sslyze	nmap-mcp
A03 Injection (SQLi)	sqlmap	manual + Burp	sqlmap-mcp (security-hub)
A03 Injection (XSS)	XSStrike	nuclei xss templates	nuclei-mcp
A03 Injection (Command)	commix	manual testing	Desktop Commander
A04 Insecure Design	Manual code review	semgrep	—
A05 Security Misconfiguration	nuclei misconfiguration templates	nikto	nuclei-mcp
A06 Vulnerable Components	nuclei CVE templates + wpscan	retire.js	nuclei-mcp
A07 Auth Failures	hydra + manual	Burp intruder	hydra via Desktop Commander
A08 Software/Data Integrity	Manual + sigcheck	—	—
A09 Logging Failures	Manual verification	—	—
A10 SSRF	Manual + nuclei SSRF templates	Burp Collaborator	nuclei-mcp

Core Instructions

Step 1 — Web Application Fingerprinting

# Technology stack identification
whatweb {target_url} --log-json=/tmp/pentest/{target}/whatweb.json

# HTTP headers and security analysis
curl -sI {target_url} | tee /tmp/pentest/{target}/headers.txt

# Check key security headers:
# Strict-Transport-Security, Content-Security-Policy, X-Frame-Options,
# X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Step 2 — Content Discovery

# Directory and file enumeration
ffuf -u {target_url}/FUZZ -w /usr/share/wordlists/dirb/common.txt \
  -mc 200,301,302,403 -o /tmp/pentest/{target}/dirs.json -of json

# API endpoint discovery
ffuf -u {target_url}/api/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -mc 200,301,405 -o /tmp/pentest/{target}/api_endpoints.json -of json

# Backup and sensitive file detection
ffuf -u {target_url}/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common-and-backup.txt \
  -mc 200 -o /tmp/pentest/{target}/sensitive_files.json -of json

Step 3 — Injection Testing

SQL Injection (Expert: sqlmap):

# Auto-detect and exploit SQLi
sqlmap -u "{url_with_params}" --batch --level 3 --risk 2 \
  --threads 5 --output-dir=/tmp/pentest/{target}/sqlmap/

# Test POST parameters
sqlmap -u "{target_url}" --data="user=test&pass=test" --batch \
  --level 3 --risk 2 --output-dir=/tmp/pentest/{target}/sqlmap/

# With authentication cookie
sqlmap -u "{url}" --cookie="session=abc123" --batch --dbs

XSS (Expert: XSStrike):

# Reflected XSS detection
python3 xsstrike.py -u "{url_with_params}" --crawl -l 3

# DOM-based XSS via nuclei
nuclei -u {target_url} -t xss/ -o /tmp/pentest/{target}/xss.txt

Command Injection (Expert: commix):

# Auto-detect OS command injection
commix -u "{url_with_params}" --batch --output-dir=/tmp/pentest/{target}/commix/

Step 4 — Authentication Testing

# Default credentials check
nuclei -u {target_url} -t default-logins/ -o /tmp/pentest/{target}/default_creds.txt

# Brute force login (use credential-attack skill for wordlists)
hydra -L users.txt -P passwords.txt {target} http-post-form \
  "/login:username=^USER^&password=^PASS^:F=Invalid" -t 4

# JWT analysis (if JWT auth detected)
# jwt_tool {token} -T  # Tamper mode
# jwt_tool {token} -C -d wordlist.txt  # Crack secret

Step 5 — SSL/TLS Analysis

# Comprehensive SSL test
testssl.sh --json-pretty /tmp/pentest/{target}/ssl.json {target_url}

# Quick nmap SSL check
nmap --script ssl-enum-ciphers,ssl-cert,ssl-known-key -p 443 {target}

Step 6 — API Security Testing

# If OpenAPI/Swagger spec available
nuclei -u {target_url} -t exposed-panels/ -t apis/

# Parameter fuzzing
ffuf -u {target_url}/api/users/FUZZ -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
  -mc 200 -fw 0

# CORS misconfiguration check
curl -sI -H "Origin: https://evil.com" {target_url} | grep -i "access-control"

Output Format

{
  "target": "https://app.example.com",
  "methodology": "OWASP Testing Guide v4.2",
  "technologies": ["nginx 1.24", "PHP 8.1", "Laravel 10", "MySQL 8.0"],
  "findings": [
    {
      "owasp_category": "A03:2021 Injection",
      "type": "SQL Injection",
      "severity": "critical",
      "url": "https://app.example.com/search?q=test",
      "parameter": "q",
      "tool": "sqlmap",
      "evidence": "Boolean-based blind SQLi confirmed — database: app_production",
      "cwe": "CWE-89",
      "remediation": "Use parameterized queries / prepared statements"
    }
  ]
}

Output Checklist

Technology fingerprinting completed
Content discovery run (dirs, files, API endpoints)
All OWASP Top 10 categories tested where applicable
SQLi tested on all input parameters (GET/POST/cookies/headers)
XSS tested (reflected, stored, DOM-based)
Authentication and session management reviewed
SSL/TLS configuration audited
Security headers analyzed
Findings mapped to OWASP category and CWE