skills.rest
DucCuong159
DucCuong159COMMUNITY
Explore all skills by this author →
GitHub

web-security-testing

Tests web applications against OWASP Top 10 vulnerabilities through phased security assessment workflows.

Updated Aug 11, 2026
Search Tags:#sql injection#xss#owasp#vulnerability assessment#security testing#penetration testing#web security
One-click install
npx skills add https://github.com/DucCuong159/Realtime-chatapp --skill web-security-testing-duccuong159
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-security-testing
Source: https://github.com/DucCuong159/Realtime-chatapp/tree/main/.agent/skills/web-security-testing
Command: npx skills add https://github.com/DucCuong159/Realtime-chatapp --skill web-security-testing-duccuong159

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications frequently ship with injection flaws, XSS vulnerabilities, broken authentication, and access control weaknesses that go undetected until exploited. This Skill provides a structured, phase-by-phase workflow for systematically testing web applications against the OWASP Top 10, so nothing in the assessment is skipped. ## Core Features & Use Cases - Phased Testing Workflow: Seven ordered phases covering reconnaissance, injection testing, XSS testing, authentication testing, access control testing, security headers, and reporting. - OWASP Top 10 Checklist: A built-in checklist covering A01 through A10 ensures complete coverage of the standard vulnerability categories. - Quality Gates & Reporting: Defines completion criteria including documented vulnerabilities, proof of concepts, remediation guidance, and a final report. - Use Case: During a penetration test of a customer portal, follow the phases to map endpoints, run SQL injection and XSS tests, verify session management and MFA, test for IDOR and path traversal, audit security headers, and produce a structured findings report. ## Quick Start Use the web-security-testing workflow to assess my web application against the OWASP Top 10 and produce a vulnerability report.

Frequently Asked Questions about web-security-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a web application for OWASP Top 10 vulnerabilities?▼

Follow a phased workflow: reconnaissance to map the attack surface, then injection testing, XSS testing, authentication testing, access control testing, and security header review. Finish by documenting vulnerabilities with proof of concepts and remediation steps in a report.

What tools are used for SQL injection testing?▼

Manual SQL injection testing identifies vulnerable parameters, while SQLMap automates detection and exploitation of injection points. The workflow invokes dedicated SQL injection and SQLMap testing skills during the injection phase.

Does this workflow cover XSS and HTML injection testing?▼

Yes, the XSS phase covers reflected, stored, and DOM-based cross-site scripting plus XSS filter bypass attempts. HTML injection testing is included as a complementary check within the same phase.

Can this workflow test authentication and access control flaws?▼

Yes, it covers credential stuffing, brute force protection, session management, password policies, and MFA implementation. Access control testing includes vertical and horizontal privilege escalation, IDOR, and path traversal.

What are the limitations of this security testing workflow?▼

The workflow should only be used when the task matches its web application scope, and results require environment-specific validation and expert review. It is a guided process, not a substitute for manual verification or authorized testing permissions.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl

recon-and-methodology

Guides reconnaissance, endpoint discovery, and vulnerability testing methodology for authorized web targets.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
JayRHaJayRHa
3

nginx-config-pro

Generate nginx reverse-proxy configurations with TLS, caching, and security headers.

Community
Advanced
kalilurrahmankalilurrahman
1

security-testing

Designs security testing programs covering SAST, DAST, dependency scanning, and penetration testing.

Community
Advanced