用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-07命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-info-07 |
| description | Map Execution Paths Through Application |
| category | information-gathering |
| owasp_id | WSTG-INFO-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-07
Map Execution Paths Through Application
Mapping execution paths involves understanding how users navigate through an application and identifying all possible workflows, decision points, and code paths. This foundational step ensures testers comprehend the application's structure before conducting comprehensive security testing. Understanding execution paths helps identify areas where security controls might be bypassed, business logic could be exploited, or race conditions might occur.
# Spider the application
# Using OWASP ZAP
zap-cli spider https://target.com
# Using Burp Suite
# Target > Site map > Spider
wget --spider -r -l 3 https://target.com 2>&1 | grep
Create a comprehensive list of:
Look for functionality that branches based on:
| Decision Type | Example |
|---|---|
| User role | Admin vs regular user |
| Authentication state | Logged in vs anonymous |
| Input validation | Valid vs invalid data |
| Business rules | Quantity limits, pricing tiers |
| Time-based | Business hours, expiration |
| Geographic | Region-specific features |
[Browse Products]
↓
[Add to Cart] → [Continue Shopping]
↓
[View Cart] → [Update Quantity] → [Remove Item]
↓
[Proceed to Checkout]
↓
[Login/Register] ←→ [Guest Checkout]
↓
[Shipping Address]
↓
[Shipping Method]
↓
[Payment Method] → [Apply Coupon]
↓
[Review Order]
↓
[Place Order] → [Payment Processing]
↓
[Order Confirmation]
[Login Page]
↓
[Submit Credentials]
↓
[Valid?] → No → [Error Message] → [Account Lockout?]
↓ Yes
[MFA Required?]
↓ Yes
[MFA Challenge]
↓
[MFA Valid?] → No → [Error] → [MFA Lockout?]
↓ Yes
[Session Created]
↓
[Redirect to Dashboard]
| Current State | Action | Next State | Conditions |
|---|---|---|---|
| Anonymous | Login | Authenticated | Valid credentials |
| Cart Empty | Add Item | Cart Active | Item in stock |
| Cart Active | Checkout | Payment | Authenticated |
| Payment | Submit | Processing | Valid payment |
| Processing | Success | Confirmed | Payment approved |
| Processing | Failure | Payment | Payment declined |
Look for concurrent access scenarios:
# Parallel request testing
# Two users purchasing last item
Request 1: GET /item/123/stock → 1
Request 2: GET /item/123/stock → 1
Request 1: POST /purchase/123
Request 2: POST /purchase/123
# Both succeed? Race condition!
# Example: Function with decision points
def process_order(user, cart, coupon=None):
# Decision Point 1: User authenticated?
if not user.is_authenticated:
return redirect('login')
# Decision Point 2: Cart not empty?
if cart.is_empty:
return error('Empty cart')
# Decision Point 3: Coupon valid?
if coupon:
if not coupon.is_valid:
return error('Invalid coupon')
cart.apply_discount(coupon)
# Decision Point 4: Stock available?
if not check_stock(cart):
return error('Out of stock')
# Process order
return create_order(user, cart)
# Test paths:
# 1. Unauthenticated user → redirect
# 2. Empty cart → error
# 3. Invalid coupon → error
# 4. Out of stock → error
# 5. Valid order → success
| Tool | Description | Usage |
|---|---|---|
| OWASP ZAP Spider | Automated web crawler | Spider via GUI/API |
| Burp Suite Spider | Passive/Active crawling | Target > Engagement tools |
| Scrapy | Python web scraper | Custom crawling scripts |
| HTTrack | Website copier | Offline analysis |
| Tool | Purpose |
|---|---|
| Draw.io | Flow diagrams |
| Lucidchart | Process mapping |
| Mermaid | Markdown diagrams |
| PlantUML | Text-based diagrams |
| Tool | Purpose |
|---|---|
| Burp Suite Logger | Request/response history |
| Chrome DevTools | Network monitoring |
| Wireshark | Packet capture |
# ZAP CLI spider
zap-cli -p 8090 spider https://target.com
# With AJAX spider
zap-cli -p 8090 ajax-spider https://target.com
# Export results
zap-cli -p 8090 report -o report.html -f html
graph TD
A[Start] --> B{Authenticated?}
B -->|No| C[Login Page]
C --> D{Valid Credentials?}
D -->|No| E[Error]
D -->|Yes| F{MFA Enabled?}
F -->|Yes| G[MFA Challenge]
F -->|No| H[Dashboard]
G --> I{MFA Valid?}
I -->|Yes| H
I -->|No| J[MFA Error]
B -->|Yes| H
#!/usr/bin/env python3
import asyncio
import aiohttp
async def make_request(session, url, data):
async with session.post(url, data=data) as response:
return await response.json()
async def race_test(url, data, count=10):
async with aiohttp.ClientSession() as session:
tasks = [make_request(session, url, data) for _ in range(count)]
results = await asyncio.gather(*tasks)
return results
# Test concurrent purchases
url = "https://target.com/api/purchase"
data = {"item_id": 123, "quantity": 1}
results = asyncio.run(race_test(url, data, 10))
print(f"Successful purchases: {sum(1 for r in results if r.get('success'))}")
# Use server-side session state
# Validate state transitions
def checkout(request):
cart = get_cart(request.session)
# Validate current state
if cart.state != 'active':
return error('Invalid cart state')
# Atomic state transition
with transaction.atomic():
cart.state = 'processing'
cart.save()
process_payment(cart)
# Use database locks
from django.db import transaction
@transaction.atomic
def purchase_item(user, item_id):
item = Item.objects.select_for_update().get(id=item_id)
if item.stock < 1:
raise OutOfStockError()
item.stock -= 1
item.save()
# Validate workflow sequence
VALID_TRANSITIONS = {
'cart': ['checkout'],
'checkout': ['payment', 'cart'],
'payment': ['confirmation', 'checkout'],
'confirmation': []
}
def validate_transition(current, next_state):
return next_state in VALID_TRANSITIONS.get(current, [])
This is a reconnaissance/mapping activity, not a direct vulnerability.
Mapping Phase: Informational (Score: 0.0)
Findings discovered during mapping (race conditions, logic flaws) have separate CVSS scores.
| Finding | Typical Severity |
|---|---|
| Undocumented admin paths | Medium |
| Race conditions | High |
| State manipulation | High |
| Workflow bypass | Medium-Critical |
| Missing authorization checks | High-Critical |
| CWE ID | Title | Description |
|---|---|---|
| CWE-362 | Concurrent Execution Using Shared Resource with Improper Synchronization | Race conditions |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Workflow bypass |
| CWE-840 | Business Logic Errors | Logic flaws |
[ ] Application spidered/crawled
[ ] All endpoints documented
[ ] User workflows mapped
[ ] Decision points identified
[ ] State transitions documented
[ ] Authentication flows mapped
[ ] Multi-step processes analyzed
[ ] Error handling paths tested
[ ] Race condition opportunities identified
[ ] Administrative paths documented
[ ] Flow diagrams created
[ ] Path coverage analysis completed