AI导哈

测试与安全

performing-web-application-penetration-test

mukul975/anthro…y-skills

Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.

  • 668 次安装
  • 3.5万 星标
  • 收录于

安装命令

npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-web-application-penetration-test

SKILL.md

Performing Web Application Penetration Test

When to Use

  • Testing web applications before production deployment to identify exploitable vulnerabilities
  • Conducting compliance-driven security assessments (PCI-DSS requirement 6.6, SOC 2 Type II)
  • Validating remediation of previously identified web application vulnerabilities during retesting
  • Assessing third-party web applications before integration into the organization's environment
  • Evaluating custom-developed web applications where automated scanning alone is insufficient

Do not use against web applications without written authorization, against production systems during peak traffic hours without explicit approval, or for denial-of-service testing of web infrastructure.

Prerequisites

  • Signed statement of work (SoW) defining the target application URLs, environments (staging/production), and testing boundaries
  • Burp Suite Professional license with up-to-date extensions (Active Scan++, Autorize, JSON Beautifier, Logger++)
  • Valid test accounts at each privilege level (unauthenticated, standard user, administrator) for authorization testing
  • Application documentation including API specifications (OpenAPI/Swagger), sitemap, and technology stack details
  • Browser configured with Burp Suite proxy (FoxyProxy recommended) and Burp CA certificate installed

相关 Skills

testing-api-security-with-owasp-top-10mukul975/anthro…y-skillsSystematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls and rate limiting.测试与安全807analyzing-api-gateway-access-logsmukul975/anthro…y-skillsParses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.后端与数据库769analyzing-android-malware-with-apktoolmukul975/anthro…y-skillsPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.移动开发683acquiring-disk-image-with-dd-and-dcflddmukul975/anthro…y-skillsCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.设计与多媒体678testing-for-xss-vulnerabilitiesmukul975/anthro…y-skillsTests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.测试与安全677conducting-api-security-testingmukul975/anthro…y-skillsConducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.测试与安全655