skills.rest
MaiconGambini
MaiconGambiniCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

wstg-information-gathering

Enumerate web application attack surface using OWASP WSTG reconnaissance test cases.

Updated Jul 29, 2026
Search Tags:#owasp#penetration testing#reconnaissance#web security#attack surface#fingerprinting#wstg
One-click install
npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill wstg-information-gathering-maicongambini
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wstg-information-gathering
Source: https://github.com/MaiconGambini/opencode-harness-guide/tree/main/skills/wstg-information-gathering
Command: npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill wstg-information-gathering-maicongambini

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Penetration testers and security assessors need a systematic, repeatable methodology to map a target web application's attack surface before exploitation begins, and ad-hoc reconnaissance often misses hidden endpoints, leaked metadata, and infrastructure components. ## Core Features & Use Cases - Ten WSTG Test Cases (INFO-01 to INFO-10): Covers search engine reconnaissance, web server fingerprinting, metafile review, application enumeration, content leakage review, entry point identification, execution path mapping, framework fingerprinting, and architecture mapping. - Structured Test Guidance: Each test case provides objectives, step-by-step testing procedures, what to look for, and remediation advice aligned with OWASP WSTG v4.2. - Use Case: During a black-box penetration test, use this Skill to fingerprint the web server via banner grabbing and malformed requests, enumerate virtual hosts and non-standard ports, and extract leaked API keys from JavaScript and source maps before moving to vulnerability testing. ## Quick Start Use the wstg-information-gathering skill to fingerprint the web server and enumerate application entry points for the authorized target at https://example.com.

Frequently Asked Questions about wstg-information-gathering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint a web server during a penetration test?▼

Fingerprint a web server by examining the Server response header, analyzing header field ordering, and sending malformed requests to trigger default error pages. Apache, nginx, and IIS each emit characteristic header sequences and error page structures even when version banners are suppressed.

What is OWASP WSTG information gathering?▼

OWASP WSTG information gathering is the first phase of web application security testing, covering test cases WSTG-INFO-01 through INFO-10. It maps the attack surface through reconnaissance, fingerprinting, and enumeration before any exploitation begins.

How to find hidden endpoints in a web application?▼

Find hidden endpoints by reviewing robots.txt Disallow entries, parsing sitemap.xml, forced browsing with directory wordlists, and analyzing JavaScript files for API routes. A 403 response confirms a path exists but is protected, while 302 redirects reveal authentication gates.

Can JavaScript source maps leak sensitive information?▼

Yes, exposed .map files reveal original unminified source code, including internal API endpoints, developer comments, build paths with usernames, and business logic. Check for source maps by appending .map to discovered JavaScript and CSS file URLs.

What are the limitations of black-box information gathering?▼

Black-box testing cannot achieve full code path coverage, and obfuscated headers or renamed cookies reduce fingerprinting accuracy. Gray-box interviews with developers help identify non-HTTP input sources like mail handlers and message queues that external testing misses.

Related Skills

Explore More Software Engineering Skills→
starlink-awakenstarlink-awaken

Recon

Aggregate OSINT sources and active scans to map internet-facing assets.

Community
Advanced
lNwNllNwNl

recon-for-sec

Routes reconnaissance tasks to methodology skills for asset discovery and security testing.

Community
Basic
overtimepogovertimepog

cve-lookup

Correlate CVEs against target technology stacks and assess exploit availability.

Community
Advanced
riparinoriparino
1

defensive-exposure-management

Discover internet-facing assets and detect exposure risks across cloud and on-prem environments.

Community
Intermediate