How do I install the Pentest Web skill?

Run npx skillmds@latest add aibot88/pentest-web in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pentest Web safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pentest Web?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pentest Web free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Pentest Web?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pentest Web by aibot88 — Agent Skill

Name: Pentest Web
Rating: 4.2 (5 reviews)
Author: aibot88

Pentest Web

Web application security testing methodology — OWASP Top 10, SSRF, IDOR, auth bypass, injection sinifi advisory. Burp/ZAP cikti analizi. Triggers on web pentest, OWASP, SQL injection, XSS, SSRF, IDOR, auth bypass, Burp output, ZAP, parameter pollution, request smuggling.

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

pentest-web

Web app saldiri yuzeyi advisory + Burp/ZAP cikti analizi + OWASP Top 10 methodology. Live exploit composer'lama scope deklare ile yapilir; otomatik exploit calistirma yok.

Triggers

"OWASP Top 10 test"
"Burp ciktisi inceleyin"
"SQL injection bulduk mu"
"XSS testi yapalim"
"SSRF / IDOR / auth bypass arar misin"
"request smuggling"

OWASP Top 10 Kontrol Listesi

#	Kategori	Test Yaklasimi
A01	Broken Access Control	Yatay/dikey IDOR, force browse, JWT manipulation
A02	Cryptographic Failures	TLS config, parola hash, sensitive data unencrypted
A03	Injection	SQLi (in-band, blind, OOB), NoSQL, OS command, XPath
A04	Insecure Design	Rate limit eksik, business logic flaw
A05	Security Misconfig	Default cred, verbose error, exposed admin panel
A06	Vulnerable Components	Dependency CVE, framework version
A07	Auth Failures	Brute force, password reset, session fix
A08	Software/Data Integrity	Unsigned update, deserialization
A09	Logging Failures	Bypass detection, audit gap
A10	SSRF	Internal port reach, cloud metadata steal

Burp/ZAP Cikti Analizi

Kullanici Burp Pro/CE veya ZAP report yapistirirsa:

## Burp Active Scan — analiz

### True Positive
- High: SQL Injection in /api/users?id= (Time-based, MySQL)
  - Payload: `1' AND SLEEP(5)-- -`
  - Etki: Tam DB okuma + potential RCE (FILE priv varsa)
- Medium: Reflected XSS in /search?q= (no CSP)

### False Positive (elenir)
- Info: Server header reveals nginx — bilgi sizintisi degil, fix oncelik dusuk
- Low: Cookie missing HttpOnly — only-server cookie, JS erisimi yok

### Onerilen Manuel Test
- IDOR check /api/users/{id} — auth bypass denemesi
- Race condition /api/purchase (5 paralel istek)
- JWT alg=none + alg=HS256 ile RSA key swap

Yaygin Methodology Akisi

1. Recon: subfinder + httpx + wappalyzer
2. Crawl: ffuf / gobuster / katana (rate-limited)
3. Param discovery: paramspider / Arjun
4. Active probe: nuclei templates + manual Burp
5. Auth test: JWT decode + signature check + algorithm swap
6. Bizlogic: race, IDOR, price manipulation (pentest-bizlogic'e devret)
7. Report: OWASP severity + CVSS + remediation

Onerilen Komutlar (Scope ile)

# MODERATE — content discovery (rate limit)
ffuf -w wordlist.txt -u https://<hedef>/FUZZ -t 20 -p 0.1 -mc 200,301,403 -o ffuf_<hedef>_$(date +%Y%m%d_%H%M%S).json

# MODERATE — auto template scan
nuclei -u https://<hedef> -severity medium,high,critical -rate-limit 50 -o nuclei_<hedef>_$(date +%Y%m%d_%H%M%S).txt

# LOUD — SQLi targeted (sadece tek param + level 1)
# sqlmap kullanim onerilir ama composer'lama icin scope deklare zorunlu

JWT Test Onerisi

# Manuel decode (QUIET, hicbir hedefe istek atmaz)
echo <token> | cut -d. -f2 | base64 -d | jq .

# Common bypass denemeleri
# alg: "none"          -> imza atla
# alg: HS256 + RSA pub -> public key ile HMAC
# kid: ../../etc/passwd -> path traversal
# exp manipulation

CSP / Header Analiz

# QUIET — header sadece
curl -sI https://<hedef> | grep -iE 'content-security-policy|x-frame-options|strict-transport|x-content-type'

Out-of-Scope

Live sqlmap orchestration (kullanici yetkili sqlmap calistirir)
Mass scan, parallel attacks on multiple targets
Automated exploitation (PoC validation pentest-exploit-chain'de)
DoS denemesi

---name: pentest-webdescription: Web application security testing methodology — OWASP Top 10, SSRF, IDOR, auth bypass, injection sinifi advisory. Burp/ZAP cikti analizi. Triggers on web pentest, OWASP, SQL injection, XSS, SSRF, IDOR, auth bypass, Burp output, ZAP, parameter pollution, request smuggling.license: MIT---# pentest-webWeb app saldiri yuzeyi advisory + Burp/ZAP cikti analizi + OWASP Top 10 methodology. Live exploit composer'lama scope deklare ile yapilir; otomatik exploit calistirma yok.## Triggers- "OWASP Top 10 test"- "Burp ciktisi inceleyin"- "SQL injection bulduk mu"- "XSS testi yapalim"- "SSRF / IDOR / auth bypass arar misin"- "request smuggling"## OWASP Top 10 Kontrol Listesi| # | Kategori | Test Yaklasimi ||---|----------|---------------|| A01 | Broken Access Control | Yatay/dikey IDOR, force browse, JWT manipulation || A02 | Cryptographic Failures | TLS config, parola hash, sensitive data unencrypted || A03 | Injection | SQLi (in-band, blind, OOB), NoSQL, OS command, XPath || A04 | Insecure Design | Rate limit eksik, business logic flaw || A05 | Security Misconfig | Default cred, verbose error, exposed admin panel || A06 | Vulnerable Components | Dependency CVE, framework version || A07 | Auth Failures | Brute force, password reset, session fix || A08 | Software/Data Integrity | Unsigned update, deserialization || A09 | Logging Failures | Bypass detection, audit gap || A10 | SSRF | Internal port reach, cloud metadata steal |## Burp/ZAP Cikti AnaliziKullanici Burp Pro/CE veya ZAP report yapistirirsa:```markdown## Burp Active Scan — analiz### True Positive- High: SQL Injection in /api/users?id= (Time-based, MySQL) - Payload: `1' AND SLEEP(5)-- -` - Etki: Tam DB okuma + potential RCE (FILE priv varsa)- Medium: Reflected XSS in /search?q= (no CSP)### False Positive (elenir)- Info: Server header reveals nginx — bilgi sizintisi degil, fix oncelik dusuk- Low: Cookie missing HttpOnly — only-server cookie, JS erisimi yok### Onerilen Manuel Test- IDOR check /api/users/{id} — auth bypass denemesi- Race condition /api/purchase (5 paralel istek)- JWT alg=none + alg=HS256 ile RSA key swap```## Yaygin Methodology Akisi```1. Recon: subfinder + httpx + wappalyzer2. Crawl: ffuf / gobuster / katana (rate-limited)3. Param discovery: paramspider / Arjun4. Active probe: nuclei templates + manual Burp5. Auth test: JWT decode + signature check + algorithm swap6. Bizlogic: race, IDOR, price manipulation (pentest-bizlogic'e devret)7. Report: OWASP severity + CVSS + remediation```## Onerilen Komutlar (Scope ile)```bash# MODERATE — content discovery (rate limit)ffuf -w wordlist.txt -u https://<hedef>/FUZZ -t 20 -p 0.1 -mc 200,301,403 -o ffuf_<hedef>_$(date +%Y%m%d_%H%M%S).json# MODERATE — auto template scannuclei -u https://<hedef> -severity medium,high,critical -rate-limit 50 -o nuclei_<hedef>_$(date +%Y%m%d_%H%M%S).txt# LOUD — SQLi targeted (sadece tek param + level 1)# sqlmap kullanim onerilir ama composer'lama icin scope deklare zorunlu```## JWT Test Onerisi```bash# Manuel decode (QUIET, hicbir hedefe istek atmaz)echo <token> | cut -d. -f2 | base64 -d | jq .# Common bypass denemeleri# alg: "none" -> imza atla# alg: HS256 + RSA pub -> public key ile HMAC# kid: ../../etc/passwd -> path traversal# exp manipulation```## CSP / Header Analiz```bash# QUIET — header sadececurl -sI https://<hedef> | grep -iE 'content-security-policy|x-frame-options|strict-transport|x-content-type'```## Out-of-Scope- Live sqlmap orchestration (kullanici yetkili `sqlmap` calistirir)- Mass scan, parallel attacks on multiple targets- Automated exploitation (PoC validation pentest-exploit-chain'de)- DoS denemesi

Frequently asked questions