vuln-kb

What problem does it solve?

Security testers and penetration testers often waste time manually searching for CWE details, attack playbooks, and detection signatures during web application and API security assessments, leading to inconsistent testing and missed vulnerabilities.

Core Features & Use Cases

• Signal-to-Vulnerability Mapping: Quickly map common static analysis signals and HTTP traffic patterns (like dangerouslySetInnerHTML or GraphQL introspection requests) to high-priority vulnerability classes.
• CWE Quick References: Access test strategies, detection signals, and reporting requirements for common vulnerability categories including injection, broken access control, SSRF, and CORS misconfigurations.
• Systematic Analysis Frameworks: Use codified analysis lenses (taint analysis, trust boundary mapping, business logic tracing) and full testing checklists to ensure comprehensive coverage of web application and API attack surfaces.
• Use Case: A tester finds a React application using dangerouslySetInnerHTML with user-controlled input; they can immediately look up the associated DOM XSS (CWE-79) test strategy, detection signals, and reporting standards without leaving their workflow.

Quick Start

Use the vuln-kb skill to look up the test strategy and detection signals for CWE-89 SQL Injection when you encounter SQL error messages in application responses.