What problem does it solve? Web security testers and CTF players often lack a structured, citable knowledge base when performing authorized penetration tests, forcing them to rely on memory or scattered notes for payloads, bypass techniques, and testing methodology. ## Core Features & Use Cases - Vulnerability Playbooks: Lazy-loaded reference files covering SQL injection, XSS, RCE, deserialization, XXE, file upload, path traversal, SSRF, information disclosure, business logic/auth flaws, modern protocols (CORS, GraphQL, HTTP smuggling, WebSocket, OAuth), and deployment/supply-chain security. - Unified Testing Methodology: Combines the L1-L4 research pyramid, WooYun vulnerability formulas, and OWASP WSTG/LLM/Agentic mappings into a decision loop from reconnaissance to reporting. - Strict Citation Discipline: Every payload must cite a specific reference section; unverifiable claims are marked UNABLE TO CITE, and exploitation chains are only provided for authorized targets. - Use Case: Given an authorized target URL with a search parameter, the skill routes to the SQL injection reference, loads WAF bypass and blind injection techniques, and outputs test cases with cited payloads and verification steps. ## Quick Start Ask the assistant to test an authorized target URL for web vulnerabilities using this security knowledge base and cite the relevant references.
