skills.rest
GhostPWN
GhostPWNOFFICIAL
Explore all skills by this author →
GitHub

Web Application Security Testing

Identify web application and API security weaknesses in authorized targets.

4|Updated Mar 10, 2026
Search Tags:#xss#owasp#web-security#api-testing#sqli#pentest#vulnerability-scan
One-click install
npx skills add https://github.com/GhostPWN/ghostpwn --skill web-application-security-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Web Application Security Testing
Source: https://github.com/GhostPWN/ghostpwn/tree/main/src/skills/09-web-security
Command: npx skills add https://github.com/GhostPWN/ghostpwn --skill web-application-security-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, pyyaml, and includes scripts (resource) components.

What problem does it solve?

This Skill helps security teams and authorized testers identify web application and API weaknesses early, before they become exploitable incidents or costly remediation work.

Core Features & Use Cases

  • OWASP Top 10 Testing: Assess broken access control, injection, cryptographic issues, misconfiguration, and authentication flaws.
  • API Security Review: Evaluate REST, GraphQL, JWT, OAuth, and session handling for authorization and data exposure problems.
  • Practical Vulnerability Reporting: Produce structured findings with reproducible evidence, impact notes, and remediation guidance for review or handoff.

Quick Start

Ask the skill to assess an authorized web application or API for OWASP risks and return a concise, structured vulnerability report.

Frequently Asked Questions about Web Application Security Testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my web application for OWASP Top 10 vulnerabilities?▼

OWASP Top 10 vulnerability testing assesses web applications for broken access control, injection, and misconfiguration flaws. This skill performs HTTP probing and requests-based scanning to detect these security weaknesses on authorized targets.

What is the best way to perform API security testing for GraphQL and REST endpoints?▼

API security testing for REST and GraphQL evaluates authorization, JWT, OAuth, and session handling for data exposure problems. This skill parses optional OpenAPI specifications and probes endpoints to identify authentication and authorization weaknesses.

How do I detect SQL injection and XSS vulnerabilities in my web application?▼

SQL injection and XSS detection requires probing HTTP inputs and parameters for malicious payload execution. This skill uses Python scripts and requests-based scanning to identify injection vulnerabilities and produce reproducible findings.

Can I use Python scripts with requests and pyyaml for automated vulnerability scanning?▼

Automated vulnerability scanning with Python scripts requires the requests and pyyaml dependencies to probe HTTP targets and parse configurations. This skill utilizes these libraries to execute requests-based scanning and generate structured vulnerability reports.

How do I generate a structured vulnerability report with reproducible evidence?▼

Structured vulnerability reporting produces findings with reproducible evidence, impact notes, and remediation guidance. This skill outputs concise reports from Python scripts to facilitate security review and developer handoff for identified weaknesses.

Does this vulnerability scanning approach require an OpenAPI specification for API testing?▼

API testing does not strictly require an OpenAPI specification but can optionally parse it to evaluate REST endpoints. The skill performs HTTP probing and requests-based scanning to analyze GraphQL, JWT, and OAuth session handling without mandatory OpenAPI input.

Related Skills

Explore More Software Engineering Skills→
kuloudkuloud

api-mock-generator

Generate mock API responses from OpenAPI and Swagger specifications.

Community
Intermediate
JoranHonigJoranHonig
63

finding

Structure security findings with vulnerability, impact, and remediation details.

Community
Intermediate
MathiasPaulenkoMathiasPaulenko

WaveXis Network Testing

Capture and manipulate HTTP/HTTPS traffic for performance auditing and API testing.

Community
Advanced
summarybotngsummarybotng
2

security-testing

Scan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.

Official
Advanced