skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

fast-checking

Applies a rapid offensive security checklist for time-boxed web application assessments.

Updated Sep 17, 2026
Search Tags:#owasp#vulnerability assessment#penetration testing#web security#api security#recon#security checklist
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill fast-checking-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fast-checking
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-fast-checking
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill fast-checking-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers working under tight time constraints need a structured, prioritized checklist to quickly map attack surfaces and find quick-win vulnerabilities without missing critical test areas. ## Core Features & Use Cases - Rapid Recon and Surface Mapping: Covers content discovery, technology fingerprinting, origin IP identification behind CDN/WAF, and API contract capture. - Comprehensive Test Checklists: Includes authentication, session handling, access control, input validation, file upload, business logic, API (REST/GraphQL/OAuth/JWT), infrastructure, cloud, Kubernetes, and HTTP request smuggling checks. - Emerging Technology Coverage: Provides test cases for LLM/AI integrations, WebSockets, gRPC, and Server-Sent Events. - Use Case: During a two-day time-boxed penetration test or CTF-style engagement, follow the checklist to triage the target, identify quick-win vulnerabilities like IDOR and XSS, and track which items have been completed. ## Quick Start Run a fast security assessment of my web application using the fast-checking methodology and report the quick-win findings.

Frequently Asked Questions about fast-checking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a fast web application security assessment?▼

Follow a structured rapid checklist covering recon, authentication, access control, input validation, and API testing in order. Track completed items and prioritize quick-win patterns like IDOR, reflected XSS, and open redirects before deeper exploitation.

What should a penetration testing checklist include?▼

A thorough checklist covers reconnaissance, authentication and session handling, access control (IDOR/BOLA/BFLA), injection flaws, file uploads, business logic, API security (GraphQL, OAuth, JWT), infrastructure, and cloud misconfigurations. This checklist also adds LLM, WebSocket, and gRPC testing.

What tools are used with this fast testing checklist?▼

The methodology references Burp Suite for proxying and CSRF PoCs, SQLMap for injection automation, SecLists and BLNS for fuzzing wordlists, jwt_tool for token attacks, and services like SecurityTrails, Censys, and Shodan for recon.

When should I use a rapid checklist instead of a full pentest methodology?▼

Use it for time-boxed assessments, CTF-speed engagements, or initial surface mapping where breadth matters more than depth. For compliance-driven or deep-dive engagements, a full methodology with extended exploitation and reporting phases is more appropriate.

Does this checklist cover cloud and Kubernetes security testing?▼

Yes, it includes checks for AWS, Azure, and GCP misconfigurations such as IMDS exposure, storage permissions, and identity federation, plus Kubernetes items like RBAC, exposed Kubelet and ETCD APIs, and privileged pod configurations.

Related Skills

Explore More Software Engineering Skills→
Yenn503Yenn503
1

executing-red-team-engagement-planning

Plan red team engagements by defining scope, rules of engagement, and MITRE ATT&CK threat profiles.

Community
Intermediate
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
RedHatProductSecurityRedHatProductSecurity
47

differential-review

Analyze code diffs for security regressions and vulnerabilities.

Official
Advanced
ThePhoenixAgencyThePhoenixAgency

security-audit

Audits web applications, APIs, and codebases with penetration testing and secure code reviews.

Official
Advanced