Skip to content
cccskills
FreePublished on GitHub

web-security-advanced

Web高级安全测试 — 注入攻击族、协议安全、认证与逻辑漏洞、文件与部署安全、现代Web攻击面，含完整Playbook

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw
See how to install

Files included (34)

  • SKILL.md3.7 KB
  • references/web-ai-attack-map.md562 B
  • references/web-deployment-security.md15.0 KB
  • references/web-file-infra.md17.9 KB
  • references/web-injection.md26.0 KB
  • references/web-logic-auth.md16.4 KB
  • references/web-modern-protocols.md10.3 KB
  • references/web-playbook-01-clickjacking.md1.4 KB
  • references/web-playbook-02-supply-chain-attacks.md2.2 KB
  • references/web-playbook-03-cache-and-cdn-security.md1.5 KB
  • references/web-playbook-04-open-redirect.md1.5 KB
  • references/web-playbook-05-framework-vulnerabilities.md8.1 KB
  • references/web-playbook-06-request-smuggling.md2.2 KB
  • references/web-playbook-07-authentication-vulnerabilities.md4.3 KB
  • references/web-playbook-08-file-vulnerabilities.md4.2 KB
  • references/web-playbook-09-business-logic-vulnerabilities.md3.5 KB
  • references/web-playbook-10-prototype-pollution.md2.3 KB
  • references/web-playbook-11-cloud-security-vulnerabilities.md2.9 KB
  • references/web-playbook-12-ai-security.md3.1 KB
  • references/web-playbook-13-api-security.md5.4 KB
  • references/web-playbook-14-csrf-cross-site-request-forgery.md3.7 KB
  • references/web-playbook-15-jwt-security.md2.8 KB
  • references/web-playbook-16-lfi-rfi-file-inclusion.md5.4 KB
  • references/web-playbook-17-rce-remote-code-execution.md5.3 KB
  • references/web-playbook-18-sql-nosql-injection.md7.8 KB
  • references/web-playbook-19-ssrf-server-side-request-forgery.md5.4 KB
  • references/web-playbook-20-ssti-template-injection.md4.7 KB
  • references/web-playbook-21-websocket-security.md2.4 KB
  • references/web-playbook-22-xss-cross-site-scripting.md5.2 KB
  • references/web-playbook-23-xxe-entity-injection.md3.6 KB
  • references/web-playbook-24-php-regex-bypass.md3.5 KB
  • references/web-playbook-index.md1.5 KB
  • references/web-security-playbook-openai.yaml296 B
  • references/web-security-playbook-skill.md3.6 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Web 高级安全测试 Skill

当目标是 Web 应用、API、网关或浏览器面向服务，且需要系统性的漏洞测试时使用本 Skill。

前置条件：如果请求仍由客户端控制且重放未稳定，先使用 client-reverse Skill。

CTF 场景路由

当目标为 CTF 题目（已知有 flag，需要绕过特定过滤）时，优先使用 ctf-web Skill 获取具体绕过值和 payload：

CTF 场景路由到 ctf-web参考文档
PHP 弱比较/类型绕过ctf-webreferences/php-bypass-cheatsheet.md
命令注入空格绕过ctf-webreferences/command-injection-bypass.md
eval 回显/无回显ctf-webreferences/eval-and-rce-techniques.md
PHP 代码审计ctf-webreferences/php-code-audit-checklist.md
SSTI 注入链ctf-webreferences/ssti-injection-chains.md
反序列化利用链ctf-webreferences/deserialization-playbook.md
文件上传 → RCE本 Skillreferences/web-playbook-08-file-vulnerabilities.md

本 Skill 侧重渗透测试方法论，CTF 实战绕过值和 payload 模板请参考 ctf-web。

场景路由

攻击面类型首选参考
参数注入（SQLi/XSS/命令执行/SSTI/XXE）references/web-injection.md
协议安全（CORS/GraphQL/WebSocket/OAuth/请求走私）references/web-modern-protocols.md
认证与逻辑（IDOR/越权/支付/密码重置/鉴权绕过）references/web-logic-auth.md
文件与基础设施（上传/遍历/包含/部署/缓存/CDN/云）references/web-file-infra.md
部署安全references/web-deployment-security.md

测试流程

1. 输入验证测试

  • SQL 注入：布尔/时间/报错/Union/堆叠
  • XSS：反射/存储/DOM/CSP 绕过
  • 命令注入：分隔符绕过、编码绕过
  • SSTI：模板引擎识别 + RCE 链
  • XXE：实体注入、OOB 数据外带
  • 反序列化：Java/PHP/Python 链

2. 认证与会话测试

  • 默认凭据、暴力破解
  • 会话管理缺陷（固定/劫持/不安全 Cookie）
  • JWT 安全（算法篡改/密钥爆破/none算法）
  • OAuth/OIDC 配置缺陷
  • MFA 绕过

3. 逻辑漏洞测试

  • 越权访问（水平/垂直）
  • 业务逻辑绕过（支付/优惠券/投票）
  • 竞态条件
  • IDOR（不安全直接对象引用）

4. 协议安全测试

  • CORS 配置错误
  • GraphQL 内省/注入
  • WebSocket 认证与注入
  • HTTP 请求走私
  • SSRF（内网探测/云元数据）

5. 文件与部署安全

  • 文件上传绕过
  • 路径穿越
  • LFI/RFI
  • CDN/缓存投毒
  • 供应链攻击
  • 云安全配置

参考文档

  • references/web-injection.md — 注入攻击详细参考
  • references/web-modern-protocols.md — 现代协议安全
  • references/web-logic-auth.md — 认证与逻辑漏洞
  • references/web-file-infra.md — 文件与基础设施安全
  • references/web-deployment-security.md — 部署安全
  • references/web-ai-attack-map.md — Web 与 AI 攻击映射
  • references/web-playbook-*.md — 各专项 Playbook（23 个）

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

ai-mcp-security

Free

AI与MCP安全评估 — Prompt注入、工具滥用、MCP信任边界、Agent权限逃逸、数据泄露、模型风险、GAARM风险矩阵

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw3.8KUpdated Oct 12, 2026

android-pentest

Free

安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw3.8KUpdated Oct 12, 2026

client-reverse

Free

客户端逆向与Burp重放 — 复杂客户端签名恢复、加密还原、请求链追踪、稳定重放，适用于已授权安卓App渗透测试、浏览器JS签名、桌面客户端逆向

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw3.8KUpdated Oct 12, 2026

crypto-toolkit

Free

编码解码与加解密工具 — base64/URL/Hex/HTML实体编码解码，MD5/SHA哈希，AES/DES/RSA加解密，JWT解析，Caesar/ROT13密码，栅栏/Vigenere密码，Unicode转义，Morse电码等

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw3.8KUpdated Oct 12, 2026

ctf-crypto

Free

CTF密码学攻击知识库 — RSA攻击（小指数/共模/Wiener/Coppersmith）、AES攻击（Padding Oracle/ECB字节翻转/GCM nonce重用）、ECC攻击、LFSR/LCG/PRNG攻击、古典密码、LWE格攻击

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw3.8KUpdated Oct 12, 2026

ctf-misc

Free

CTF杂项知识库 — Python Jail逃逸、Bash Jail逃逸、编码链识别与解码、QR/音频/图像隐写、游戏VM逆向、CTFd API导航、Linux提权

The English summary is being prepared. Showing the original description.

Netw0rkNoob/VulnClaw3.8KUpdated Oct 12, 2026

See all skills by Netw0rkNoob

Report a problem with this skill