web-exploit

Chain advanced injection techniques to exploit web application vulnerabilities.

13|1|Updated Feb 4, 2026
One-click install
npx skills add https://github.com/0x0pointer/skills --skill web-exploit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web-exploit
Source: https://github.com/0x0pointer/skills/tree/main/web-exploit
Command: npx skills add https://github.com/0x0pointer/skills --skill web-exploit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill teaches an LLM to conduct thorough post‑discovery exploitation on web applications, turning initial findings into full‑scale attacks and reliable proof‑of‑concepts.

Core Features & Use Cases

  • Comprehensive Attack Surface: Handles SQLi, NoSQL, GraphQL, XSS, SSTI, SSRF, file upload, XXE, deserialization, command injection, path traversal, race conditions, CSRF, JWT attacks, request smuggling, CRLF injection, open redirects, CORS, cache poisoning, OAuth misconfigurations, and business logic flaws.
  • Automated Tool Integration: Uses sqlmap, commix, xsser, wapiti, davtest, and custom http actions for payload generation and verification.
  • Chaining Capability: Seamlessly pivots from /pentester or /api-security into deeper exploitation phases and hands off to /post-exploit or /ai-redteam when appropriate.

Quick Start

Invoke the web-exploit skill with a target URL and optional vulnerability type to begin automated deep exploitation.

Frequently Asked Questions about web-exploit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform post-discovery web exploitation after finding an initial vulnerability?

Post-discovery web exploitation involves chaining and executing advanced injection techniques on a target URL to turn initial findings like SQLi or XSS into full-scale attacks and reliable proof-of-concepts.

Can I chain SQLi, SSRF, and SSTI vulnerabilities during a single web exploitation session?

Yes, vulnerability chaining allows you to seamlessly pivot across injection vectors including SQLi, SSRF, SSTI, and XSS, executing advanced techniques to expand an initial finding into comprehensive exploitation.

Does this web exploitation approach support automated tools like sqlmap and commix?

Yes, automated tool integration supports sqlmap, commix, xsser, wapiti, and davtest, alongside custom HTTP actions for streamlined payload generation, session handling, and exploit verification.

What is the best way to generate payloads and verify exploits for web application vulnerabilities?

The best way to verify exploits is by using automated tool integration with sqlmap and custom HTTP actions, enabling comprehensive payload generation and reporting of confirmed exploits across various injection vectors.

How do I exploit advanced web vulnerabilities like request smuggling and deserialization?

Exploiting advanced web vulnerabilities involves applying comprehensive attack surface coverage to handle request smuggling, deserialization, JWT attacks, and cache poisoning, transforming discovered flaws into confirmed exploits.