Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-07O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | wstg-info-07 |
| description | Map Execution Paths Through Application |
| category | information-gathering |
| owasp_id | WSTG-INFO-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-07
Map Execution Paths Through Application
Mapping execution paths involves understanding how users navigate through an application and identifying all possible workflows, decision points, and code paths. This foundational step ensures testers comprehend the application's structure before conducting comprehensive security testing. Understanding execution paths helps identify areas where security controls might be bypassed, business logic could be exploited, or race conditions might occur.
# Spider the application
# Using OWASP ZAP
zap-cli spider https://target.com
# Using Burp Suite
# Target > Site map > Spider
wget --spider -r -l 3 https://target.com 2>&1 | grep
Create a comprehensive list of:
Look for functionality that branches based on:
| Decision Type | Example |
|---|---|
| User role | Admin vs regular user |
| Authentication state | Logged in vs anonymous |
| Input validation | Valid vs invalid data |
| Business rules | Quantity limits, pricing tiers |
| Time-based | Business hours, expiration |
| Geographic | Region-specific features |
[Browse Products]
↓
[Add to Cart] → [Continue Shopping]
↓
[View Cart] → [Update Quantity] → [Remove Item]
↓
[Proceed to Checkout]
↓
[Login/Register] ←→ [Guest Checkout]
↓
[Shipping Address]
↓
[Shipping Method]
↓
[Payment Method] → [Apply Coupon]
↓
[Review Order]
↓
[Place Order] → [Payment Processing]
↓
[Order Confirmation]
[Login Page]
↓
[Submit Credentials]
↓
[Valid?] → No → [Error Message] → [Account Lockout?]
↓ Yes
[MFA Required?]
↓ Yes
[MFA Challenge]
↓
[MFA Valid?] → No → [Error] → [MFA Lockout?]
↓ Yes
[Session Created]
↓
[Redirect to Dashboard]
| Current State | Action | Next State | Conditions |
|---|---|---|---|
| Anonymous | Login | Authenticated | Valid credentials |
| Cart Empty | Add Item | Cart Active | Item in stock |
| Cart Active | Checkout | Payment | Authenticated |
| Payment | Submit | Processing | Valid payment |
| Processing | Success | Confirmed | Payment approved |
| Processing | Failure | Payment | Payment declined |
Look for concurrent access scenarios:
# Parallel request testing
# Two users purchasing last item
Request 1: GET /item/123/stock → 1
Request 2: GET /item/123/stock → 1
Request 1: POST /purchase/123
Request 2: POST /purchase/123
# Both succeed? Race condition!
# Example: Function with decision points
def process_order(user, cart, coupon=None):
# Decision Point 1: User authenticated?
if not user.is_authenticated:
return redirect('login')
# Decision Point 2: Cart not empty?
if cart.is_empty:
return error('Empty cart')
# Decision Point 3: Coupon valid?
if coupon:
if not coupon.is_valid:
return error('Invalid coupon')
cart.apply_discount(coupon)
# Decision Point 4: Stock available?
if not check_stock(cart):
return error('Out of stock')
# Process order
return create_order(user, cart)
# Test paths:
# 1. Unauthenticated user → redirect
# 2. Empty cart → error
# 3. Invalid coupon → error
# 4. Out of stock → error
# 5. Valid order → success
| Tool | Description | Usage |
|---|---|---|
| OWASP ZAP Spider | Automated web crawler | Spider via GUI/API |
| Burp Suite Spider | Passive/Active crawling | Target > Engagement tools |
| Scrapy | Python web scraper | Custom crawling scripts |
| HTTrack | Website copier | Offline analysis |
| Tool | Purpose |
|---|---|
| Draw.io | Flow diagrams |
| Lucidchart | Process mapping |
| Mermaid | Markdown diagrams |
| PlantUML | Text-based diagrams |
| Tool | Purpose |
|---|---|
| Burp Suite Logger | Request/response history |
| Chrome DevTools | Network monitoring |
| Wireshark | Packet capture |
# ZAP CLI spider
zap-cli -p 8090 spider https://target.com
# With AJAX spider
zap-cli -p 8090 ajax-spider https://target.com
# Export results
zap-cli -p 8090 report -o report.html -f html
graph TD
A[Start] --> B{Authenticated?}
B -->|No| C[Login Page]
C --> D{Valid Credentials?}
D -->|No| E[Error]
D -->|Yes| F{MFA Enabled?}
F -->|Yes| G[MFA Challenge]
F -->|No| H[Dashboard]
G --> I{MFA Valid?}
I -->|Yes| H
I -->|No| J[MFA Error]
B -->|Yes| H
#!/usr/bin/env python3
import asyncio
import aiohttp
async def make_request(session, url, data):
async with session.post(url, data=data) as response:
return await response.json()
async def race_test(url, data, count=10):
async with aiohttp.ClientSession() as session:
tasks = [make_request(session, url, data) for _ in range(count)]
results = await asyncio.gather(*tasks)
return results
# Test concurrent purchases
url = "https://target.com/api/purchase"
data = {"item_id": 123, "quantity": 1}
results = asyncio.run(race_test(url, data, 10))
print(f"Successful purchases: {sum(1 for r in results if r.get('success'))}")
# Use server-side session state
# Validate state transitions
def checkout(request):
cart = get_cart(request.session)
# Validate current state
if cart.state != 'active':
return error('Invalid cart state')
# Atomic state transition
with transaction.atomic():
cart.state = 'processing'
cart.save()
process_payment(cart)
# Use database locks
from django.db import transaction
@transaction.atomic
def purchase_item(user, item_id):
item = Item.objects.select_for_update().get(id=item_id)
if item.stock < 1:
raise OutOfStockError()
item.stock -= 1
item.save()
# Validate workflow sequence
VALID_TRANSITIONS = {
'cart': ['checkout'],
'checkout': ['payment', 'cart'],
'payment': ['confirmation', 'checkout'],
'confirmation': []
}
def validate_transition(current, next_state):
return next_state in VALID_TRANSITIONS.get(current, [])
This is a reconnaissance/mapping activity, not a direct vulnerability.
Mapping Phase: Informational (Score: 0.0)
Findings discovered during mapping (race conditions, logic flaws) have separate CVSS scores.
| Finding | Typical Severity |
|---|---|
| Undocumented admin paths | Medium |
| Race conditions | High |
| State manipulation | High |
| Workflow bypass | Medium-Critical |
| Missing authorization checks | High-Critical |
| CWE ID | Title | Description |
|---|---|---|
| CWE-362 | Concurrent Execution Using Shared Resource with Improper Synchronization | Race conditions |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Workflow bypass |
| CWE-840 | Business Logic Errors | Logic flaws |
[ ] Application spidered/crawled
[ ] All endpoints documented
[ ] User workflows mapped
[ ] Decision points identified
[ ] State transitions documented
[ ] Authentication flows mapped
[ ] Multi-step processes analyzed
[ ] Error handling paths tested
[ ] Race condition opportunities identified
[ ] Administrative paths documented
[ ] Flow diagrams created
[ ] Path coverage analysis completed