web-pentest

Automate web application penetration testing for authorized targets using phase-based workflows, built-in guardrails, and standardized evidence capture to ensure strict compliance. The structured lifecycle enforces authorization checks and scope before mapping endpoints and collecting findings.

Before starting a guided pentest engagement, you need to define explicit scope and authorization. You also need optional tooling installed, including python3, nmap, whatweb, and curl, to execute reconnaissance and map the target's technologies within legal boundaries.

Structured web pentest reconnaissance maps endpoints and technologies by running the initial engagement phase using tools like nmap and whatweb. This phase safely maps the target's attack surface and identifies underlying frameworks for evidence-backed findings.

Yes, you can use nmap and whatweb during web application penetration testing to perform reconnaissance. The Skill integrates these dependencies to map endpoints and identify web technologies within an authorization-bounded scope.

Penetration testing reporting does not require manual formatting after evidence capture, as the workflow uses guided templates to produce a formal report. Evidence-backed findings are collected automatically during the phases to build reproducible client deliverables.

You should not use automated web security testing when explicit scope and authorization are absent. The enforced guardrails prevent operation outside legal boundaries, meaning the workflow halts without documented authorization for the target.