원클릭으로 Manus에서 모든 스킬 실행

pentest-web-api

스타5

포크2

업데이트2026년 6월 9일 03:59

Web application and REST/GraphQL API penetration testing using OWASP WSTG, ASVS and API Top 10. Use when the user mentions web pentest, API test, BOLA, IDOR, BFLA, mass assignment, SQLi, XSS, SSRF, SSTI, CSRF, JWT, OAuth, OIDC, SAML, GraphQL introspection, file-upload abuse, deserialization, or any WSTG-* / API:2023-* identifier.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

thau0x01

thau0x01/ai-pentest-kb

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Pentest — Web Application & API

Apply the methodology in the pentest-templates library when conducting web/API tests.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Phase content lives in 01-web-api/. Read 00-overview.md first, then walk numbered files in order.

Phase order

01-web-api/01-information-gathering.md — recon, fingerprinting, attack-surface map.
01-web-api/02-configuration-deployment.md — server config, headers, cloud storage, subdomain takeover.
01-web-api/03-identity-management.md — registration, enumeration, provisioning.
01-web-api/04-authentication.md — login, MFA, password policy, JWT, OAuth, SAML.
01-web-api/05-authorization.md — RBAC, IDOR/BOLA, BFLA, BOPLA, traversal.
01-web-api/06-session-management.md — cookies, fixation, CSRF, logout.
01-web-api/07-input-validation.md — XSS, SQLi, SSRF, SSTI, command injection, deserialization.
01-web-api/08-error-handling.md.
01-web-api/09-cryptography.md — TLS, padding oracle, weak ciphers.
01-web-api/10-business-logic.md — race conditions, workflow abuse, file upload.
01-web-api/11-client-side.md — DOM XSS, postMessage, CORS, clickjacking.
01-web-api/12-api-rest.md — OWASP API Top 10 (2023).
01-web-api/13-api-graphql.md — introspection, depth, batching.

How to operate

Confirm scope and authenticated test accounts at multiple roles (low-priv, privileged, cross-tenant).
For each user request, locate the relevant phase file by topic and read the matching checklist item by stable ID (WEB-<PHASE>-<NN>).
When the user asks "how do I test X", expand the How to test block of the matching item — it contains tools, commands, payloads.
Map every finding to the per-item Mappings block (CWE / ATT&CK / CVSS) and emit a finding via templates/finding-template.md. Cross-reference frameworks/owasp-wstg.md or frameworks/owasp-api-top10.md.
For LLM-backed web apps, also pull pentest-ai-llm. For cloud-hosted backends with cloud-layer findings, also pull pentest-cloud.

When NOT to use

Mobile-app context → pentest-mobile (use this skill for the API surface only).
Pure infrastructure → pentest-infra-external / pentest-infra-internal.

Pre-conditions

Burp Suite / Caido / ZAP with TLS interception configured.
Target URL or asset list, plus ROE clarity on auth + payload classes.

OPSEC

Web pentest is generally noisy; coordinate with SOC if engagement is detection-aware.
No destructive payloads (DoS, data corruption) on production. Capture metadata only unless ROE permits sample extraction.

References inside the library

Cheatsheet: cheatsheets/web-api.md.
Tooling: tools/install-web-api.md, tools/burp-extensions.md, tool-mappings/01-web-api-tools.md.
Frameworks: frameworks/owasp-wstg.md, frameworks/owasp-api-top10.md, frameworks/owasp-asvs.md.
Playbook: playbooks/02-first-4h-web-pentest.md.

이 저장소의 다른 Skills

같은 저장소

engagement-management

thau0x01/ai-pentest-kb

Engagement-lifecycle management — pre-engagement scoping, ROE drafting, authorisation letters, threat modeling, CVSS scoring, finding write-up, executive summary, technical report, retest scoping, remediation validation. Use when the user mentions scope a pentest, ROE template, rules of engagement, get-out-of-jail letter, authorisation letter, scope statement, communications plan, blackout window, escalation matrix, threat modeling, STRIDE, PASTA, attack tree, threat actor profile, CVSS scoring, finding template, executive summary, technical report, retest, remediation validation, regression coverage, engagement kickoff, or evidence chain of custody.

2026-06-095

engagement-retest

thau0x01/ai-pentest-kb

Plan and execute a pentest retest — re-scope, re-execute the validation steps from prior findings, detect regressions, and write the retest report. Use when the user mentions retest, re-test, remediation validation, regression coverage, "verify the fixes", "validate remediation", retest scoping, retest report, posture trajectory, or compares "before vs after" findings.

2026-06-095

engagement-scoping

thau0x01/ai-pentest-kb

Drive the pre-engagement scoping conversation and produce the scope statement, Rules of Engagement, authorisation letter, and communications plan. Use when the user mentions kickoff, scoping a pentest, drafting ROE, rules of engagement, scope statement, authorisation letter, get-out-of-jail letter, communications plan, blackout window, escalation matrix, ROE drift, third-party hosting carve-out, social-engineering allowance, time-window restrictions, or evidence-handling rules.

2026-06-095

pentest-active-directory

thau0x01/ai-pentest-kb

Active Directory and hybrid Entra ID penetration testing. Use when the user mentions BloodHound, SharpHound, SOAPHound, AzureHound, RustHound, Kerberoast, AS-REP roast, Golden/Silver/Diamond/Sapphire ticket, DCSync, DCShadow, NTLM relay, ntlmrelayx, ADCS ESC1-ESC15+, EKUwu, Certipy, ACL abuse (GenericAll/WriteDACL/WriteOwner/shadow credentials), GPO abuse, NoPac, ZeroLogon, PetitPotam, DFSCoerce, PrinterBug, krbrelayup, AAD Connect, MSOL_, Pass-Through Auth, Seamless SSO, AdminSDHolder, SID History, krbtgt, or any "domain compromise" task.

2026-06-095

pentest-ai-llm

thau0x01/ai-pentest-kb

LLM-backed application, AI agent, and AI/ML supply-chain penetration testing. Use when the user mentions LLM pentest, AI red team, prompt injection (direct or indirect), jailbreak, DAN, Crescendo, GCG, many-shot jailbreak, system prompt leakage, RAG poisoning, embedding poisoning/inversion, vector DB attack, MCP / Model Context Protocol abuse, tool poisoning, agent excessive agency, function-call abuse, output handling chains (XSS/SSRF/SQLi via LLM output), training-data extraction, membership inference, modelscan/picklescan, Hugging Face poisoned model, garak, PyRIT, promptmap, Augustus, Spikee, OWASP LLM01-LLM10, MITRE ATLAS, or unbounded consumption / cost amplification.

2026-06-095

pentest-cheatsheet

thau0x01/ai-pentest-kb

Surface a one-page pentest cheatsheet for fast field recall. Use when the user asks for a "quick command", "cheatsheet", "one-liner", "what's the syntax for X", "remind me how to do Y", "give me the recon snippets", "AD cheatsheet", "lateral-movement one-liners", "AWS quick commands", "Azure quick commands", "mobile cheatsheet", "initial access cheatsheet", or any request that wants tools/commands without methodology overhead.

2026-06-095

name	pentest-web-api
description	Web application and REST/GraphQL API penetration testing using OWASP WSTG, ASVS and API Top 10. Use when the user mentions web pentest, API test, BOLA, IDOR, BFLA, mass assignment, SQLi, XSS, SSRF, SSTI, CSRF, JWT, OAuth, OIDC, SAML, GraphQL introspection, file-upload abuse, deserialization, or any WSTG-* / API:2023-* identifier.

Pentest — Web Application & API

Apply the methodology in the pentest-templates library when conducting web/API tests.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Phase content lives in 01-web-api/. Read 00-overview.md first, then walk numbered files in order.

Phase order

01-web-api/01-information-gathering.md — recon, fingerprinting, attack-surface map.
01-web-api/02-configuration-deployment.md — server config, headers, cloud storage, subdomain takeover.
01-web-api/03-identity-management.md — registration, enumeration, provisioning.
01-web-api/04-authentication.md — login, MFA, password policy, JWT, OAuth, SAML.
01-web-api/05-authorization.md — RBAC, IDOR/BOLA, BFLA, BOPLA, traversal.
01-web-api/06-session-management.md — cookies, fixation, CSRF, logout.
01-web-api/07-input-validation.md — XSS, SQLi, SSRF, SSTI, command injection, deserialization.
01-web-api/08-error-handling.md.
01-web-api/09-cryptography.md — TLS, padding oracle, weak ciphers.
01-web-api/10-business-logic.md — race conditions, workflow abuse, file upload.
01-web-api/11-client-side.md — DOM XSS, postMessage, CORS, clickjacking.
01-web-api/12-api-rest.md — OWASP API Top 10 (2023).
01-web-api/13-api-graphql.md — introspection, depth, batching.

How to operate

Confirm scope and authenticated test accounts at multiple roles (low-priv, privileged, cross-tenant).
For each user request, locate the relevant phase file by topic and read the matching checklist item by stable ID (WEB-<PHASE>-<NN>).
When the user asks "how do I test X", expand the How to test block of the matching item — it contains tools, commands, payloads.
Map every finding to the per-item Mappings block (CWE / ATT&CK / CVSS) and emit a finding via templates/finding-template.md. Cross-reference frameworks/owasp-wstg.md or frameworks/owasp-api-top10.md.
For LLM-backed web apps, also pull pentest-ai-llm. For cloud-hosted backends with cloud-layer findings, also pull pentest-cloud.

When NOT to use

Mobile-app context → pentest-mobile (use this skill for the API surface only).
Pure infrastructure → pentest-infra-external / pentest-infra-internal.

Pre-conditions

Burp Suite / Caido / ZAP with TLS interception configured.
Target URL or asset list, plus ROE clarity on auth + payload classes.

OPSEC

Web pentest is generally noisy; coordinate with SOC if engagement is detection-aware.
No destructive payloads (DoS, data corruption) on production. Capture metadata only unless ROE permits sample extraction.

References inside the library

Cheatsheet: cheatsheets/web-api.md.
Tooling: tools/install-web-api.md, tools/burp-extensions.md, tool-mappings/01-web-api-tools.md.
Frameworks: frameworks/owasp-wstg.md, frameworks/owasp-api-top10.md, frameworks/owasp-asvs.md.
Playbook: playbooks/02-first-4h-web-pentest.md.