| name | web-pentester |
| description | Guides authorized web application and API security testing—scoping and rules of engagement,
OWASP-oriented testing (injection, auth/session, access control, SSRF, XSS, CSRF, business logic),
REST and GraphQL API security, Burp/ZAP-style manual methodology without requiring commercial tools,
evidence and remediation reporting, and retest validation. Emphasizes written authorization and safe
boundaries. Use for web pentest, OWASP web assessment, web app security test, API pentest,
Burp-style testing, XSS or SQL injection testing when authorized—not network/AD/infra pentest
(network-pentester), general multi-domain pentest orchestration (penetration-tester), LLM or agent
adversarial testing (ai-redteam), enterprise adversary simulation or purple-team campaigns (red-team-specialist),
SOC alert triage (soc-analyst), incident command (incident-responder), or CI/CD security gates
and SBOM programs (devsecops).
|
Web Pentester
When to Use
- Plan or execute authorized web application or API security assessments
- Draft or validate rules of engagement, asset lists, test accounts, and emergency stop procedures
- Test OWASP Top 10 classes: injection, broken auth, access control, SSRF, XSS, CSRF, security misconfiguration, vulnerable components (surface only), business logic
- Assess REST and GraphQL APIs: authZ, mass assignment, BOLA/BFLA, rate limits, introspection, batching
- Run manual proxy-based workflows (Burp Suite, OWASP ZAP, or equivalent) with validated findings
- Produce remediation-focused reports and retest critical/high issues
When NOT to Use
- Network segmentation, wireless, AD, or internal infrastructure pentest →
network-pentester
- Jailbreak LLMs, prompt injection, or agent tool abuse →
ai-redteam
- Lead red team campaigns, purple team, or detection validation programs →
red-team-specialist
- Triage SIEM/EDR alerts or SOC playbooks →
soc-analyst
- Lead live incident command or war-room comms →
incident-responder
- Add SAST/SCA/DAST gates, SBOM, or pipeline security →
devsecops
- Implement WAF rules, IAM, or SIEM detections from findings →
information-security-engineer
- Cloud org guardrails, CSPM, landing zone design →
cloud-security-engineer
- Security program strategy, GRC, or pentest program governance →
cybersecurity
Related skills
| Need | Skill |
|---|
| Network/AD/infra pentest beyond web/API | network-pentester |
| Multi-domain pentest under one ROE | penetration-tester |
| Red team campaigns, purple team, ATT&CK emulation | red-team-specialist |
| Security program, pentest governance, GRC | cybersecurity |
| Remediate findings (WAF, IdP, SIEM, hardening) | information-security-engineer |
| Cloud control implementation and misconfig fixes | cloud-security-engineer |
| CI/CD and supply-chain security in delivery | devsecops |
| LLM/agent adversarial testing | ai-redteam |
| Front-end auth patterns, CSRF, cookies, CORS context | senior-frontend-software-engineer |
| Customer-facing pentest reports | tech-writer-researcher |
Core Workflows
1. Scope and authorization
Do not test without written authorization.
- Confirm signed SOW/ROE: URLs, APIs, environments, methods, windows, contacts
- Define out-of-scope (third parties, production PII, DoS unless approved, destructive writes)
- Agree severity rubric, evidence handling, and data minimization
- Establish emergency stop and escalation path
- Prefer staging, dedicated test tenants, or anonymized fixtures
See references/web_pentester_scope.md and references/scoping_and_rules_of_engagement.md.
2. Application mapping and OWASP testing
inventory routes/APIs → auth surface → role matrix → manual + targeted automation → validate each finding
Map unauthenticated, authenticated, and privileged flows. Prioritize state-changing endpoints and multi-step workflows.
See references/owasp_web_testing_methodology.md, references/api_security_testing.md, and references/auth_session_and_access_control.md.
3. Exploitation discipline (in scope only)
- Minimal PoC; redact tokens and PII in evidence
- Document preconditions (role, session, feature flag, tenant)
- Stop at agreed impact; avoid unnecessary data exfiltration
- Remove test accounts, uploaded shells, and injected records before closeout
4. Reporting, remediation, and retest
Per finding: title, severity, CWE/OWASP mapping, impact, reproduction, evidence, remediation, retest criteria. Deliver executive summary + technical appendix; schedule retest for critical/high.
See references/reporting_retest_safe_practices.md.
When to load references
| Topic | Reference |
|---|
| Role boundaries | references/web_pentester_scope.md |
| Authorization and ROE | references/scoping_and_rules_of_engagement.md |
| OWASP web methodology | references/owasp_web_testing_methodology.md |
| REST/GraphQL API testing | references/api_security_testing.md |
| Auth, session, access control | references/auth_session_and_access_control.md |
| Reports, retest, safe practices | references/reporting_retest_safe_practices.md |
