pentest-web

name	pentest-web
description	Web application security testing methodology — OWASP Top 10, SSRF, IDOR, auth bypass, injection-class advisory. Burp/ZAP output analysis. Triggers on web pentest, OWASP, SQL injection, XSS, SSRF, IDOR, auth bypass, Burp output, ZAP, parameter pollution, request smuggling.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-web","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents web-hunter (advisory side)"}

pentest-web

Web app attack-surface advisory + Burp/ZAP output analysis + OWASP Top 10 methodology. Live exploit composing requires a scope declaration; no automatic exploit execution.

Triggers

• "OWASP Top 10 test"
• "review the Burp output"
• "did we find a SQL injection"
• "let's run an XSS test"
• "can you look for SSRF / IDOR / auth bypass"
• "request smuggling"

OWASP Top 10 Checklist

#	Category	Test Approach
A01	Broken Access Control	Yatay/dikey IDOR, force browse, JWT manipulation
A02	Cryptographic Failures	TLS config, password hash, sensitive data unencrypted
A03	Injection	SQLi (in-band, blind, OOB), NoSQL, OS command, XPath
A04	Insecure Design	Missing rate limit, business logic flaw
A05	Security Misconfig	Default cred, verbose error, exposed admin panel
A06	Vulnerable Components	Dependency CVE, framework version
A07	Auth Failures	Brute force, password reset, session fix
A08	Software/Data Integrity	Unsigned update, deserialization
A09	Logging Failures	Bypass detection, audit gap
A10	SSRF	Internal port reach, cloud metadata steal

Burp/ZAP Output Analysis

If the user pastes a Burp Pro/CE or ZAP report:

## Burp Active Scan — analysis

### True Positive
- High: SQL Injection in /api/users?id= (Time-based, MySQL)
  - Payload: `1' AND SLEEP(5)-- -`
  - Impact: Full DB read + potential RCE (if FILE priv exists)
- Medium: Reflected XSS in /search?q= (no CSP)

### False Positive (filtered out)
- Info: Server header reveals nginx — not an info leak, low fix priority
- Low: Cookie missing HttpOnly — server-only cookie, no JS access

### Suggested Manual Test
- IDOR check /api/users/{id} — auth bypass attempt
- Race condition /api/purchase (5 parallel requests)
- JWT alg=none + RSA key swap via alg=HS256

Common Methodology Flow

1. Recon: subfinder + httpx + wappalyzer
2. Crawl: ffuf / gobuster / katana (rate-limited)
3. Param discovery: paramspider / Arjun
4. Active probe: nuclei templates + manual Burp
5. Auth test: JWT decode + signature check + algorithm swap
6. Bizlogic: race, IDOR, price manipulation (hand off to pentest-bizlogic)
7. Report: OWASP severity + CVSS + remediation

Suggested Commands (with scope)

# MODERATE — content discovery (rate limit)
ffuf -w wordlist.txt -u https://<target>/FUZZ -t 20 -p 0.1 -mc 200,301,403 -o ffuf_<target>_$(date +%Y%m%d_%H%M%S).json

# MODERATE — auto template scan
nuclei -u https://<target> -severity medium,high,critical -rate-limit 50 -o nuclei_<target>_$(date +%Y%m%d_%H%M%S).txt

# LOUD — SQLi targeted (single param + level 1 only)
# sqlmap use is suggested, but composing requires a scope declaration

JWT Test Suggestion

# Manual decode (QUIET, sends no request to any target)
echo <token> | cut -d. -f2 | base64 -d | jq .

# Common bypass attempts
# alg: "none"          -> skip the signature
# alg: HS256 + RSA pub -> HMAC with the public key
# kid: ../../etc/passwd -> path traversal
# exp manipulation

CSP / Header Analysis

# QUIET — headers only
curl -sI https://<target> | grep -iE 'content-security-policy|x-frame-options|strict-transport|x-content-type'

Out-of-Scope

• Live sqlmap orchestration (the user runs authorized sqlmap)
• Mass scan, parallel attacks on multiple targets
• Automated exploitation (PoC validation in pentest-exploit-chain)
• DoS attempt