skills.rest
briiirussell
briiirussellCOMMUNITY
Explore all skills by this author →
GitHub

web-pentest

Conduct authorized black-box or grey-box penetration tests of live web applications.

345|47|Updated Mar 13, 2026
Search Tags:#owasp#bug bounty#session security#burp suite#vulnerability reporting#authorization testing#web pentest
One-click install
npx skills add https://github.com/briiirussell/cybersecurity-skills --skill web-pentest
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-pentest
Source: https://github.com/briiirussell/cybersecurity-skills/tree/main/skills/web-pentest
Command: npx skills add https://github.com/briiirussell/cybersecurity-skills --skill web-pentest

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you perform an authorized black-box or grey-box penetration test of a live web application in a structured, evidence-based way, reducing the chance you miss high-impact issues like auth bypass, IDOR, and session flaws.

Core Features & Use Cases

  • OWASP WSTG-guided testing flow: walks through configuration, identity, authentication, authorization, session management, and business-logic testing in an organized order that produces reviewable evidence.
  • Authorization and session coverage: focuses on horizontal/vertical privilege escalation, tenant isolation, session fixation, logout invalidation, and CSRF validation.
  • Practical tooling workflows: guides typical Burp Suite (including Intruder/Repeater) and OWASP ZAP workflows, plus common manual testing techniques and an auditable report structure.

Quick Start

Ask the AI agent to run an authorized web pentest against https://example.com using your provided test credentials, then produce a WSTG-based report with prioritized findings, proof-of-concept requests, and remediations.

Frequently Asked Questions about web-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I conduct an authorized web pentest using an OWASP WSTG methodology?▼

You can perform an authorized web pentest by providing in-scope URLs and test credentials to guide an AI agent through OWASP WSTG checks, which then outputs a structured report with endpoints, severity mapping, and remediation guidance.

Can I use Burp Suite workflows for testing authorization and session management flaws?▼

Yes, Burp Suite workflows are supported for identifying authorization and session flaws, guiding typical Intruder and Repeater techniques to detect horizontal privilege escalation, session fixation, and CSRF validation issues.

Does this web pentest approach work for bug bounty testing with only guest access?▼

Yes, this web pentest approach applies to bug bounty testing with either guest access or user credentials, conducting black-box or grey-box testing to identify input validation and business-logic weaknesses.

What is the best way to report IDOR and authentication bypass vulnerabilities found during a web pentest?▼

The best way to report IDOR and authentication bypass vulnerabilities is to generate a final report containing endpoints, proof-of-concept requests, severity mapping, remediation guidance, and re-test instructions.

Do I need explicit authorization checks before running a web application penetration test?▼

Yes, explicit authorization checks are required before running a web application penetration test to validate the testing scope for internal audits, bug bounty programs, or engagement-based security assessments.

Related Skills

Explore More Software Engineering Skills→
angelapaiaangelapaia
13

web-security-audit

Automates authorized black-box web security audits and generates HTML vulnerability reports with remediation guidance.

Community
Advanced
Goblin1024Goblin1024
6

security-review

Identify security weaknesses and generate prioritized reports with remediation guidance.

Community
Advanced
securityfortechsecurityfortech
6

business-logic-flaws

Detect and exploit business logic flaws in web application workflows.

Official
Advanced
s0613s0613
1

sj-cso

Automate OWASP Top 10 and STRIDE security audits with confidence-scored vulnerability reports.

Community
Advanced