skills.rest
baljinnyamday
baljinnyamdayCOMMUNITY
Explore all skills by this author →
GitHub

performing-web-application-penetration-test

Tests web applications for vulnerabilities following the OWASP WSTG methodology.

Updated May 27, 2026
Search Tags:#sql injection#vulnerability assessment#penetration testing#web security#idor#burp suite#owasp wstg
One-click install
npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill performing-web-application-penetration-test-baljinnyamday
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-web-application-penetration-test
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/performing-web-application-penetration-test
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill performing-web-application-penetration-test-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications ship with exploitable flaws in authentication, authorization, input validation, session management, and business logic that automated scanners alone miss. This Skill provides a structured, OWASP WSTG-aligned penetration testing workflow to systematically identify and document those vulnerabilities before attackers do. ## Core Features & Use Cases - Full WSTG Coverage: Guides testing across reconnaissance, authentication, authorization (IDOR, privilege escalation), injection (SQLi, XSS, SSRF, XXE, SSTI), session management, and business logic flaws. - Tool-Integrated Workflow: Incorporates Burp Suite Professional, ffuf, sqlmap, Nuclei, and SecLists with concrete commands and payload examples for each test category. - Structured Reporting: Produces findings with CVSS 3.1 severity ratings, reproduction steps, HTTP request/response evidence, and code-level remediation guidance. - Use Case: Before launching an e-commerce platform, run the full workflow against the staging environment to uncover an IDOR in the order API, stored XSS in product reviews, and SSRF in the image import function, then deliver a remediation-ready report to the development team. ## Quick Start Perform a web application penetration test against the authorized staging target following the OWASP WSTG methodology and report all findings with severity ratings.

Frequently Asked Questions about performing-web-application-penetration-test

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a web application penetration test?▼

Follow the OWASP WSTG methodology: map the application attack surface, then test authentication, authorization, input validation, session management, and business logic in sequence. Use Burp Suite for interception and manual testing, with ffuf and sqlmap for discovery and injection confirmation.

What tools are needed for web application security testing?▼

The core toolkit is Burp Suite Professional for proxying and manual testing, ffuf for directory and endpoint fuzzing, sqlmap for SQL injection exploitation, Nuclei for template-based vulnerability scanning, and SecLists for fuzzing wordlists.

How do I test for IDOR vulnerabilities in an API?▼

Capture requests accessing one account's resources, then replay them substituting another account's identifiers such as user IDs or order numbers. Burp's Autorize extension automates this across all endpoints to detect missing authorization checks.

Can automated scanners replace manual web application penetration testing?▼

No. Automated scanners miss business logic flaws like race conditions, workflow bypasses, and price manipulation, as well as many authorization issues. Manual testing with tools like Burp Repeater and Turbo Intruder is required for these vulnerability classes.

When should I not run a web application penetration test?▼

Do not test without written authorization and a signed statement of work defining scope. Avoid production systems during peak traffic without explicit approval, and exclude denial-of-service testing of web infrastructure.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

exploiting-broken-function-level-authorization

Tests APIs for Broken Function Level Authorization by probing admin endpoints with low-privilege credentials.

Community
Intermediate
bpcakesbpcakes
2

vulnerability-disclosure-and-retest-manager

Manage privacy-audit finding remediation, disclosure drafting, retest planning, and audit closure.

Official
Advanced
AeonDaveAeonDave
15

openvas

Run OpenVAS vulnerability scans against internal networks and generate compliance reports.

Community
Intermediate
KentoShimizuKentoShimizu
7

security-vulnerability-management

Prioritize and drive vulnerabilities from SAST/DAST scans to closure.

Community
Advanced