skills.rest
cxnaive
cxnaiveCOMMUNITY
Explore all skills by this author →
GitHub

web-pentest

Perform authorized web application penetration testing with reconnaissance, vulnerability analysis, and proof-based exploitation.

Updated Jun 17, 2026
Search Tags:#security#vulnerability#owasp#audit#web#pentest
One-click install
npx skills add https://github.com/cxnaive/hermes-agent-llbot --skill web-pentest-cxnaive
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-pentest
Source: https://github.com/cxnaive/hermes-agent-llbot/tree/main/optional-skills/security/web-pentest
Command: npx skills add https://github.com/cxnaive/hermes-agent-llbot --skill web-pentest-cxnaive

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nmap, whatweb, curl, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a structured, safe, and reproducible framework for conducting web application penetration testing, ensuring that security assessments are performed with rigorous guardrails and professional methodology.

Core Features & Use Cases

  • Phased Workflow: Implements a multi-phase approach covering reconnaissance, vulnerability analysis, proof-based exploitation, and reporting.
  • Hard Guardrails: Enforces strict authorization, scope allowlisting, and rate-limiting to prevent illegal or accidental testing of unauthorized systems.
  • Use Case: Use this to perform a security audit on a staging environment, identifying vulnerabilities like SQL injection or XSS while maintaining a clear, documented audit trail for stakeholders.

Quick Start

Initiate a penetration test by providing the target URL to the pentest command after confirming your authorization.

Frequently Asked Questions about web-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a safe web application penetration test with reproducible evidence?▼

Web penetration testing follows a multi-phase workflow covering reconnaissance, vulnerability analysis, proof-based exploitation, and reporting. This structured approach identifies vulnerabilities like SQL injection or XSS while maintaining a documented audit trail for stakeholders.

Do I need nmap and whatweb installed to run a web pentest?▼

Yes, web penetration testing requires nmap, whatweb, and curl as dependencies. These tools facilitate network scanning and technology identification during the reconnaissance phase before manual verification of detected vulnerabilities.

Can I use this to run an automated security audit on a staging environment?▼

Yes, web penetration testing supports security audits on staging environments by combining automated scanners with manual verification techniques. It identifies vulnerabilities while enforcing guardrails to ensure testing remains within strictly defined scope boundaries.

What is proof-based exploitation in web application vulnerability analysis?▼

Proof-based exploitation is a vulnerability analysis technique that safely demonstrates the existence of security flaws like SQL injection or XSS. It ensures findings are reproducible and documented within a formal security report for stakeholder review.

When should I not use automated scanners for web penetration testing?▼

Automated scanners should not be used outside a strictly defined scope or without explicit authorization. Web penetration testing enforces hard guardrails and rate-limiting to prevent illegal testing, requiring manual verification to confirm vulnerabilities safely.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

recon

Coordinates passive and active enumeration of authorized attack surfaces for penetration testing.

Community
Intermediate
ArabelaTsoArabelaTso
142

verified-spec-code-mapper

Map formal specifications to verified code components in Markdown reports.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
allsmogallsmog
22

Vulnerability Patterns

Identify web vulnerability patterns and exploitation flows for whitebox penetration testing.

Community
Intermediate