Web application and REST/GraphQL API penetration testing using OWASP WSTG, ASVS and API Top 10. Use when the user mentions web pentest, API test, BOLA, IDOR, BFLA, mass assignment, SQLi, XSS, SSRF, SSTI, CSRF, JWT, OAuth, OIDC, SAML, GraphQL introspection, file-upload abuse, deserialization, or any WSTG-* / API:2023-* identifier.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Web application and REST/GraphQL API penetration testing using OWASP WSTG, ASVS and API Top 10. Use when the user mentions web pentest, API test, BOLA, IDOR, BFLA, mass assignment, SQLi, XSS, SSRF, SSTI, CSRF, JWT, OAuth, OIDC, SAML, GraphQL introspection, file-upload abuse, deserialization, or any WSTG-* / API:2023-* identifier.
Pentest — Web Application & API
Apply the methodology in the pentest-templates library when conducting web/API tests.
Library root
$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).
Phase content lives in 01-web-api/. Read 00-overview.md first, then walk numbered files in order.
Confirm scope and authenticated test accounts at multiple roles (low-priv, privileged, cross-tenant).
For each user request, locate the relevant phase file by topic and read the matching checklist item by stable ID (WEB-<PHASE>-<NN>).
When the user asks "how do I test X", expand the How to test block of the matching item — it contains tools, commands, payloads.
Map every finding to the per-item Mappings block (CWE / ATT&CK / CVSS) and emit a finding via templates/finding-template.md. Cross-reference frameworks/owasp-wstg.md or frameworks/owasp-api-top10.md.
For LLM-backed web apps, also pull pentest-ai-llm. For cloud-hosted backends with cloud-layer findings, also pull pentest-cloud.
When NOT to use
Mobile-app context → pentest-mobile (use this skill for the API surface only).
Pure infrastructure → pentest-infra-external / pentest-infra-internal.
Pre-conditions
Burp Suite / Caido / ZAP with TLS interception configured.
Target URL or asset list, plus ROE clarity on auth + payload classes.
OPSEC
Web pentest is generally noisy; coordinate with SOC if engagement is detection-aware.
No destructive payloads (DoS, data corruption) on production. Capture metadata only unless ROE permits sample extraction.
