Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
File Explorer
22 files
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview
name
wooyun-legacy
description
Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.
allowed-tools
["Read","Grep","Glob","Bash"]
WooYun Vulnerability Analysis Knowledge Base
Methodology and testing patterns extracted from 88,636 real-world
vulnerability cases reported to the WooYun platform (2010-2016).
When to Use
All testing described here must be performed only against systems you
have written authorization to test.
Penetration testing web applications
Security code review (server-side or client-side)
Vulnerability research against web targets you have explicit authorization to test
Building security test cases or checklists
Assessing web application attack surface
Reviewing remediation effectiveness
Training or education in authorized security testing contexts
Compliance-only assessments (PCI-DSS, SOC2 checklists without testing)
Physical security assessments
Social engineering campaigns
Cloud infrastructure misconfigurations (IAM, S3 buckets) — these
require cloud-specific tooling, not web vuln patterns
Rationalizations to Reject
These shortcuts lead to missed findings. Reject them:
"The WAF will catch it" — WAFs are bypass-able; test the application
logic, not the middleware
"It's an internal app, so auth doesn't matter" — internal apps get
compromised via SSRF, lateral movement, and credential reuse
"We already use parameterized queries everywhere" — check for ORM
misuse, stored procedures with dynamic SQL, and second-order injection
"The framework handles XSS" — template engines have raw output modes,
JavaScript contexts bypass HTML encoding, and DOM XSS lives
entirely client-side
"File uploads are safe because we check the extension" — extension
checks are bypassed via null bytes, double extensions, parser
discrepancies, and race conditions
"We validate on the frontend" — client-side validation is a UX
feature, not a security control
"Nobody would guess that URL" — security through obscurity fails
against directory bruteforcing, referrer leaks, and JS source analysis
"Low severity, not worth reporting" — low-severity findings chain
into critical attack paths
Core Mental Model
Vulnerability = Expected Behavior - Actual Behavior
= Developer Assumptions + Attacker Input -> Unexpected State
Analysis chain:
1. Where does data come from? (Input sources)
-> GET/POST/Cookie/Header/File/WebSocket
2. Where does data flow? (Data path)
-> Validation -> Processing -> Storage -> Output
3. Where is data trusted? (Trust boundaries)
-> Client / Server / Database / OS / External service
4. How is data processed? (Processing logic)
-> Filter / Escape / Validate / Execute
5. Where does data end up? (Output sinks)
-> HTML / SQL / Shell / Filesystem / Log / Email
Note: The RCE checklist covers deserialization, OGNL injection, and
framework-specific remote code execution — distinct from the OS command
injection focus of the Command Execution reference above.
These demonstrate how individual vulnerabilities chain together into
full compromise scenarios.
Testing Priority Framework
High Priority (test first)
SQL Injection — direct data access, highest case count (27,732)
Command Execution — OS-level compromise
File Upload — arbitrary code execution via webshell
Medium Priority
Unauthorized Access — second-highest case count (14,377)
Business Logic Flaws — application-specific, hard to automate
XSS — session hijacking, phishing
Lower Priority (but still important)
Path Traversal — file read, sometimes write
Information Disclosure — reconnaissance value, enables chaining
CSRF/SSRF/XXE — context-dependent severity
Defense Quick Reference
Vulnerability
Core Defense
Implementation
SQL Injection
Parameterized queries
PreparedStatement / ORM
XSS
Output encoding
Context-aware escaping + CSP
Command Execution
Avoid shell
execFile not exec, allowlist
File Upload
Strict validation
Allowlist ext, rename, isolate
Path Traversal
Canonical paths
Resolve + validate against allowlist
Unauthorized Access
Access control
AuthN + AuthZ + session mgmt
Logic Flaws
Server-side checks
Validate all business logic server-side
Info Disclosure
Minimize exposure
Custom errors, no debug in prod
Key Insight
All 88,636 vulnerabilities in this database share a common root cause:
the gap between what developers assumed and what attackers actually
provided. Effective security testing means systematically challenging
every assumption at every trust boundary.
Four principles from the data:
Boundary thinking — all vulnerabilities occur at trust boundaries
Data flow tracing — follow data from input to output completely
Assumption challenging — question every "obvious" validation
