web-pentest

name	web-pentest
description	Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race
metadata	{"type":"offensive","phase":"exploitation","tools":"burpsuite, sqlmap, ffuf, feroxbuster, nuclei, httpx, curl, wfuzz, dalfox, commix, jwt_tool, ysoserial, http-request-smuggler","mitre":["T1190","T1059","T1552.005","T1078","T1539","T1505.003"]}
kill_chain	{"phase":["delivery","exploit"],"step":[3,4],"attck_tactics":["TA0001","TA0002"],"attck_techniques":["T1190","T1059.007","T1552.005","T1078","T1539","T1505.003","T1557"]}
depends_on	["recon-osint","vulnerability-analysis"]
feeds_into	["exploit-development","cloud-security","network-attack"]
inputs	["attack_surface_map","technology_fingerprint"]
outputs	["finding_record","web_vulnerability_list"]
references	["references/injection-sqli-cmdi.md","references/xss-csp-clientside.md","references/ssrf-cloud-metadata.md","references/http-desync-cache.md","references/ssti-deserialization.md","references/auth-api-access-control.md","references/proxy-mcp-integration.md"]
scripts	["scripts/desync_probe.py","scripts/jwt_forge.py","scripts/ssrf_toolkit.py","scripts/proto_ssti_gadgets.py","scripts/graphql_audit.py","scripts/race_single_packet.py","scripts/xss_csp_forge.py"]

Web Application Penetration Testing

When to Activate

• Web application security assessment (black/grey/white box)
• API security testing (REST, GraphQL, WebSocket)
• Authentication & session management testing (JWT, OAuth/OIDC, SAML)
• Business-logic and race-condition hunting
• WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache)
• Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud metadata, prototype-pollution->RCE, SSTI sandbox escapes

Input-Signal Routing (what to test when you see X)

Fast test selection — map an observed parameter/behavior to the right deep-dive:

Input signal you observe	Test for	Go to
id, uid, order_id, account, GUID/sequential ref	IDOR/BOLA, access control	references/auth-api-access-control.md
url, next, callback, dest, webhook, image_url	SSRF + cloud metadata, open redirect, OAuth chain	references/ssrf-cloud-metadata.md
price, qty, coupon, balance, status, state change	business logic + single-packet race	references/http-desync-cache.md (race)
template/preview/name reflected in output	SSTI -> RCE, reflected XSS	references/ssti-deserialization.md
search/filter/sort reflected; q=, error echoes input	SQLi, XSS, command injection	references/injection-sqli-cmdi.md
token, jwt, Authorization, Cookie, OAuth state	JWT forgery, session/OAuth flaws	references/auth-api-access-control.md
serialized blob / base64 object / __proto__	deserialization, prototype pollution	references/ssti-deserialization.md
behind CDN/cache; X-Forwarded-*; keyed params