SOC 직업 분류 기준
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-07명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | wstg-info-07 |
| description | Map Execution Paths Through Application |
| category | information-gathering |
| owasp_id | WSTG-INFO-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-07
Map Execution Paths Through Application
Mapping execution paths involves understanding how users navigate through an application and identifying all possible workflows, decision points, and code paths. This foundational step ensures testers comprehend the application's structure before conducting comprehensive security testing. Understanding execution paths helps identify areas where security controls might be bypassed, business logic could be exploited, or race conditions might occur.
# Spider the application
# Using OWASP ZAP
zap-cli spider https://target.com
# Using Burp Suite
# Target > Site map > Spider
wget --spider -r -l 3 https://target.com 2>&1 | grep
Create a comprehensive list of:
Look for functionality that branches based on:
| Decision Type | Example |
|---|---|
| User role | Admin vs regular user |
| Authentication state | Logged in vs anonymous |
| Input validation | Valid vs invalid data |
| Business rules | Quantity limits, pricing tiers |
| Time-based | Business hours, expiration |
| Geographic | Region-specific features |
[Browse Products]
↓
[Add to Cart] → [Continue Shopping]
↓
[View Cart] → [Update Quantity] → [Remove Item]
↓
[Proceed to Checkout]
↓
[Login/Register] ←→ [Guest Checkout]
↓
[Shipping Address]
↓
[Shipping Method]
↓
[Payment Method] → [Apply Coupon]
↓
[Review Order]
↓
[Place Order] → [Payment Processing]
↓
[Order Confirmation]
[Login Page]
↓
[Submit Credentials]
↓
[Valid?] → No → [Error Message] → [Account Lockout?]
↓ Yes
[MFA Required?]
↓ Yes
[MFA Challenge]
↓
[MFA Valid?] → No → [Error] → [MFA Lockout?]
↓ Yes
[Session Created]
↓
[Redirect to Dashboard]
| Current State | Action | Next State | Conditions |
|---|---|---|---|
| Anonymous | Login | Authenticated | Valid credentials |
| Cart Empty | Add Item | Cart Active | Item in stock |
| Cart Active | Checkout | Payment | Authenticated |
| Payment | Submit | Processing | Valid payment |
| Processing | Success | Confirmed | Payment approved |
| Processing | Failure | Payment | Payment declined |
Look for concurrent access scenarios:
# Parallel request testing
# Two users purchasing last item
Request 1: GET /item/123/stock → 1
Request 2: GET /item/123/stock → 1
Request 1: POST /purchase/123
Request 2: POST /purchase/123
# Both succeed? Race condition!
# Example: Function with decision points
def process_order(user, cart, coupon=None):
# Decision Point 1: User authenticated?
if not user.is_authenticated:
return redirect('login')
# Decision Point 2: Cart not empty?
if cart.is_empty:
return error('Empty cart')
# Decision Point 3: Coupon valid?
if coupon:
if not coupon.is_valid:
return error('Invalid coupon')
cart.apply_discount(coupon)
# Decision Point 4: Stock available?
if not check_stock(cart):
return error('Out of stock')
# Process order
return create_order(user, cart)
# Test paths:
# 1. Unauthenticated user → redirect
# 2. Empty cart → error
# 3. Invalid coupon → error
# 4. Out of stock → error
# 5. Valid order → success
| Tool | Description | Usage |
|---|---|---|
| OWASP ZAP Spider | Automated web crawler | Spider via GUI/API |
| Burp Suite Spider | Passive/Active crawling | Target > Engagement tools |
| Scrapy | Python web scraper | Custom crawling scripts |
| HTTrack | Website copier | Offline analysis |
| Tool | Purpose |
|---|---|
| Draw.io | Flow diagrams |
| Lucidchart | Process mapping |
| Mermaid | Markdown diagrams |
| PlantUML | Text-based diagrams |
| Tool | Purpose |
|---|---|
| Burp Suite Logger | Request/response history |
| Chrome DevTools | Network monitoring |
| Wireshark | Packet capture |
# ZAP CLI spider
zap-cli -p 8090 spider https://target.com
# With AJAX spider
zap-cli -p 8090 ajax-spider https://target.com
# Export results
zap-cli -p 8090 report -o report.html -f html
graph TD
A[Start] --> B{Authenticated?}
B -->|No| C[Login Page]
C --> D{Valid Credentials?}
D -->|No| E[Error]
D -->|Yes| F{MFA Enabled?}
F -->|Yes| G[MFA Challenge]
F -->|No| H[Dashboard]
G --> I{MFA Valid?}
I -->|Yes| H
I -->|No| J[MFA Error]
B -->|Yes| H
#!/usr/bin/env python3
import asyncio
import aiohttp
async def make_request(session, url, data):
async with session.post(url, data=data) as response:
return await response.json()
async def race_test(url, data, count=10):
async with aiohttp.ClientSession() as session:
tasks = [make_request(session, url, data) for _ in range(count)]
results = await asyncio.gather(*tasks)
return results
# Test concurrent purchases
url = "https://target.com/api/purchase"
data = {"item_id": 123, "quantity": 1}
results = asyncio.run(race_test(url, data, 10))
print(f"Successful purchases: {sum(1 for r in results if r.get('success'))}")
# Use server-side session state
# Validate state transitions
def checkout(request):
cart = get_cart(request.session)
# Validate current state
if cart.state != 'active':
return error('Invalid cart state')
# Atomic state transition
with transaction.atomic():
cart.state = 'processing'
cart.save()
process_payment(cart)
# Use database locks
from django.db import transaction
@transaction.atomic
def purchase_item(user, item_id):
item = Item.objects.select_for_update().get(id=item_id)
if item.stock < 1:
raise OutOfStockError()
item.stock -= 1
item.save()
# Validate workflow sequence
VALID_TRANSITIONS = {
'cart': ['checkout'],
'checkout': ['payment', 'cart'],
'payment': ['confirmation', 'checkout'],
'confirmation': []
}
def validate_transition(current, next_state):
return next_state in VALID_TRANSITIONS.get(current, [])
This is a reconnaissance/mapping activity, not a direct vulnerability.
Mapping Phase: Informational (Score: 0.0)
Findings discovered during mapping (race conditions, logic flaws) have separate CVSS scores.
| Finding | Typical Severity |
|---|---|
| Undocumented admin paths | Medium |
| Race conditions | High |
| State manipulation | High |
| Workflow bypass | Medium-Critical |
| Missing authorization checks | High-Critical |
| CWE ID | Title | Description |
|---|---|---|
| CWE-362 | Concurrent Execution Using Shared Resource with Improper Synchronization | Race conditions |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Workflow bypass |
| CWE-840 | Business Logic Errors | Logic flaws |
[ ] Application spidered/crawled
[ ] All endpoints documented
[ ] User workflows mapped
[ ] Decision points identified
[ ] State transitions documented
[ ] Authentication flows mapped
[ ] Multi-step processes analyzed
[ ] Error handling paths tested
[ ] Race condition opportunities identified
[ ] Administrative paths documented
[ ] Flow diagrams created
[ ] Path coverage analysis completed