본문으로 건너뛰기
cccskills
무료GitHub에 공개

web-security-testing

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic스타 92(GitHub 92 + cccskills 0)
연동 도구WordPress

실행 점수 미검증

설치 방법 보기

포함된 파일(1)

  • SKILL.md4.2 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Web Security Testing Workflow

Overview

Specialized workflow for testing web applications against OWASP Top 10 vulnerabilities including injection attacks, XSS, broken authentication, and access control issues.

When to Use This Workflow

Use this workflow when:

  • Testing web application security
  • Performing OWASP Top 10 assessment
  • Conducting penetration tests
  • Validating security controls
  • Bug bounty hunting

Workflow Phases

Phase 1: Reconnaissance

Skills to Invoke

  • scanning-tools - Security scanning
  • top-web-vulnerabilities - OWASP knowledge

Actions

  1. Map application surface
  2. Identify technologies
  3. Discover endpoints
  4. Find subdomains
  5. Document findings

Copy-Paste Prompts

Use @scanning-tools to perform web application reconnaissance

Phase 2: Injection Testing

Skills to Invoke

  • sql-injection-testing - SQL injection
  • sqlmap-database-pentesting - SQLMap

Actions

  1. Test SQL injection
  2. Test NoSQL injection
  3. Test command injection
  4. Test LDAP injection
  5. Document vulnerabilities

Copy-Paste Prompts

Use @sql-injection-testing to test for SQL injection

Use @sqlmap-database-pentesting to automate SQL injection testing

Phase 3: XSS Testing

Skills to Invoke

  • xss-html-injection - XSS testing
  • html-injection-testing - HTML injection

Actions

  1. Test reflected XSS
  2. Test stored XSS
  3. Test DOM-based XSS
  4. Test XSS filters
  5. Document findings

Copy-Paste Prompts

Use @xss-html-injection to test for cross-site scripting

Phase 4: Authentication Testing

Skills to Invoke

  • broken-authentication - Authentication testing

Actions

  1. Test credential stuffing
  2. Test brute force protection
  3. Test session management
  4. Test password policies
  5. Test MFA implementation

Copy-Paste Prompts

Use @broken-authentication to test authentication security

Phase 5: Access Control Testing

Skills to Invoke

  • idor-testing - IDOR testing
  • file-path-traversal - Path traversal

Actions

  1. Test vertical privilege escalation
  2. Test horizontal privilege escalation
  3. Test IDOR vulnerabilities
  4. Test directory traversal
  5. Test unauthorized access

Copy-Paste Prompts

Use @idor-testing to test for insecure direct object references

Use @file-path-traversal to test for path traversal

Phase 6: Security Headers

Skills to Invoke

  • api-security-best-practices - Security headers

Actions

  1. Check CSP implementation
  2. Verify HSTS configuration
  3. Test X-Frame-Options
  4. Check X-Content-Type-Options
  5. Verify referrer policy

Copy-Paste Prompts

Use @api-security-best-practices to audit security headers

Phase 7: Reporting

Skills to Invoke

  • reporting-standards - Security reporting

Actions

  1. Document vulnerabilities
  2. Assess risk levels
  3. Provide remediation
  4. Create proof of concept
  5. Generate report

Copy-Paste Prompts

Use @reporting-standards to create security report

OWASP Top 10 Checklist

  • A01: Broken Access Control
  • A02: Cryptographic Failures
  • A03: Injection
  • A04: Insecure Design
  • A05: Security Misconfiguration
  • A06: Vulnerable Components
  • A07: Authentication Failures
  • A08: Software/Data Integrity
  • A09: Logging/Monitoring
  • A10: SSRF

Quality Gates

  • All OWASP Top 10 tested
  • Vulnerabilities documented
  • Proof of concepts captured
  • Remediation provided
  • Report generated

Related Workflow Bundles

  • security-audit - Security auditing
  • api-security-testing - API security
  • wordpress-security - WordPress security

Limitations

  • Use this skill only when the task clearly matches the scope described above.
  • Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
  • Execute autonomously and adapt to available inputs, technical constraints, and mission objectives.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

api-fuzzing-bug-bounty

무료

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-chain-web2

무료

Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-chain-web3

무료

Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-chaining-core

무료

Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-surface-mapper

무료

Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

bb-methodology

무료

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

Sekolah76의 스킬 모두 보기

이 스킬의 문제 신고