菜单
Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/s0ld13rr/pentestcode --skill playbook-webapp命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold, RCE truncates output, need proxychains/nmap through a host, chisel/ligolo.
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, __VIEWSTATE, python pickle, node-serialize, unserialize error, ObjectInputStream.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
基于 SOC 职业分类
正在显示 SKILL.md
| name | playbook-webapp |
| description | Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement. |
| tags | ["vuln_assess","exploitation"] |
This is the ORDER of operations and the map to the deep skills. Each vuln CLASS has a dedicated web-<class> skill with exact payloads + detect→exploit→PROVE — load the one matching the surface; don't test from this index.
Fingerprint stack+version (whatweb/httpx, headers), CMS (wpscan/etc.), APIs (/swagger, /graphql, /.well-known). Then a content-matched nuclei -u <t> pass BEFORE exhaustive dir-fuzz (framework-runtime RCEs don't appear as routes) → nuclei_parse. Version + a known CVE → fetch & vet a public PoC (shared exploitation methodology).
ffuf/gobuster (→ gobuster_parse), vhosts (ffuf -H Host:FUZZ), params (arjun), auth endpoints (login/register/reset/OAuth), API routes. Review client-side JS for endpoints/secrets.
| Signal / surface | Load |
|---|---|
| param → DB query, SQL error/differential | web-sqli |
| input renders in a server template ({{7*7}}) | web-ssti |
| server fetches a URL you control (webhook/proxy/import) | web-ssrf |
file param / download / ../ reflection | web-lfi-traversal |
| file upload sink | web-upload-rce |
| XML/SOAP/SAML/DOCX/SVG parsing | web-xxe |
| serialized blob (rO0/O:/VIEWSTATE/pickle) | web-deserialization |
| object IDs, roles, JWT, admin funcs | web-auth-bypass-idor |
| known framework+version CVE | shared exploitation methodology + searchsploit/nuclei |
Also-check (no dedicated skill yet): XSS (dalfox, xss_detect), command injection (;id/$(id)), CSRF, CORS/security-headers, crypto/secrets-in-JS, business-logic/race conditions. |
A finding is suspected until you reproduce concrete impact (dumped canary row / id / file bytes / cloud creds / cross-user data) — then add_vuln confirmed with the evidence. Never mark a host resolved/"safe" without a completed active scan. Report: reproduction steps + request/response evidence + CVSS + OWASP-WSTG mapping.
