/web-assessment

name: web-assessment
description: |
  This skill activates when the user mentions "XSS", "cross-site scripting", "reflected XSS",
  "stored XSS", "DOM XSS", "blind XSS", "SQL injection", "SQLi", "blind SQLi", "union injection",
  "error-based injection", "time-based injection", "stacked queries", "second-order injection",
  "SSRF", "server-side request forgery", "cloud metadata", "IMDS", "internal service access",
  "IDOR", "insecure direct object reference", "broken access control", "horizontal privilege",
  "vertical privilege", "BOLA", "BFLA", "object-level authorization",
  "LFI", "local file inclusion", "RFI", "remote file inclusion", "path traversal",
  "directory traversal", "file read", "arbitrary file read", "dot dot slash",
  "command injection", "OS command injection", "RCE", "remote code execution",
  "code injection", "code execution", "reverse shell", "web shell",
  "SSTI", "server-side template injection", "template injection", "Jinja2 injection",
  "Twig injection", "Freemarker injection", "Velocity injection", "Pebble injection",
  "XXE", "XML external entity", "XML injection", "DTD injection", "XML parser",
  "NoSQL injection", "NoSQLi", "MongoDB injection", "operator injection",
  "authentication bypass", "auth bypass", "login bypass", "password reset",
  "account takeover", "session fixation", "session hijacking", "JWT attack",
  "JWT forgery", "token manipulation", "brute force login", "credential stuffing",
  "web vulnerability", "web application testing", "web pentest", "web assessment",
  "injection testing", "parameter fuzzing", "input validation", "OWASP",
  "OWASP Top 10", "A01 broken access", "A03 injection",
  "API testing", "REST API", "GraphQL injection", "parameter tampering",
  "mass assignment", "rate limiting", "race condition", "TOCTOU",
  "open redirect", "CRLF injection", "HTTP header injection",
  "deserialization", "insecure deserialization", "object injection",
  "file upload", "unrestricted upload", "web shell upload",
  "CORS misconfiguration", "CSP bypass", "clickjacking",
  "subdomain takeover", "host header injection",
  "nuclei scan", "sqlmap", "dalfox", "ffuf", "burp", "web scanner",
  "vulnerability scanner", "web fuzzing", "parameter discovery",
  or discusses testing web application security, exploiting web vulnerabilities,
  or performing web application penetration testing.
version: 2.0.0

Web Vulnerability Assessment

Systematic identification and exploitation of web application vulnerabilities. This skill provides structured workflows for every major web vulnerability class, routing you to the correct Hexstrike MCP tools and Kali tooling with proper parameters. Stop guessing at payloads and tool flags -- use the right tool for the right vuln class.

Why Structured Web Assessment Matters

Web applications are the primary attack surface in most engagements. A single SQLi grants database access. An SSRF leaks cloud credentials. An SSTI yields RCE. Structured testing ensures you cover every class systematically instead of ad-hoc fuzzing. Every finding feeds the findings-tracker and chain-detector for automatic exploit chain discovery.

Triage and Prioritization

Before testing anything, determine what you are dealing with. Target type dictates testing priority.

Priority Matrix by Target Type

| Target Type | Test First | Test Second | Test Third | |-------------|-----------|-------------|------------| | **PHP app** | SQLi, LFI/RFI, SSTI (Twig), RCE, file upload | XSS, IDOR, auth bypass | SSRF, XXE | | **Java/Spring** | SQLi, SSTI (Freemarker/Velocity), XXE, deserialization | SSRF, IDOR, auth bypass | XSS, NoSQLi | | **Node.js/Express** | NoSQLi, SSTI (Pug/EJS), prototype pollution, RCE | SSRF, IDOR, auth bypass | XSS, SQLi | | **Python/Django/Flask** | SSTI (Jinja2), SQLi, RCE, SSRF | IDOR, auth bypass | XSS, XXE | | **Ruby on Rails** | SQLi, SSTI (ERB), deserialization, mass assignment | SSRF, IDOR, auth bypass | XSS, XXE | | **API-only (REST)** | IDOR/BOLA, auth bypass, SQLi/NoSQLi, mass assignment | SSRF, rate limit bypass | injection via headers | | **API-only (GraphQL)** | Introspection, query depth abuse, batching attacks | IDOR, auth bypass, injection | DoS via nested queries | | **WordPress** | See waf-bypass + wordpress-hacking skills | SQLi via plugins, file upload | XSS, SSRF | | **Cloud-hosted** | SSRF (IMDS), config leaks, auth bypass | SQLi/NoSQLi, IDOR | RCE, XSS |

Quick Stack Fingerprinting

Before deep testing, identify the stack:

# Broad fingerprinting with nuclei
nuclei_scan target="https://target.com" templates="technologies/" severity="info"

# Check response headers for framework hints
# X-Powered-By, Server, X-AspNet-Version, X-Generator, Set-Cookie names

Log stack information as target intel:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" tech-stack framework "Laravel 10" --source "response-headers"
node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" defense waf "Cloudflare" --source "wafw00f"

Testing Workflow

Follow this workflow for each target. Steps are ordered for maximum efficiency -- early findings inform later tests.

Step 1 — Reconnaissance and Surface Mapping

Map the attack surface before testing individual vuln classes.

# Discover parameters and endpoints
ffuf -u "https://target.com/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -o recon.json

# Parameter discovery on known endpoints
paramspider -d target.com

# Technology detection
nuclei_scan target="https://target.com" templates="technologies/" severity="info"

If behind a WAF, detect it first:

wafw00f_scan target="https://target.com"

Log defenses:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" defense waf "Cloudflare" --source "wafw00f"

Step 2 — Broad Vulnerability Scanning

Run automated scanners across all vuln classes to find low-ha