# Web Pentester

> Guides authorized web application and API security testing—scoping and rules of engagement, OWASP-oriented testing (injection, auth/session, access control, SSRF, XSS, CSRF, business logic), REST and GraphQL API security, Burp/ZAP-style manual methodology without requiring commercial tools, evidence and remediation reporting, and retest validation. Emphasizes written authorization and safe boundaries. Use for web pentest, OWASP web assessment, web app security test, API pentest, Burp-style testing, XSS or SQL injection testing when authorized—not network/AD/infra pentest (network-pentester), general multi-domain pentest orchestration (penetration-tester), LLM or agent adversarial testing (ai-redteam), enterprise adversary simulation or purple-team campaigns (red-team-specialist), SOC alert triage (soc-analyst), incident command (incident-responder), or CI/CD security gates and SBOM programs (devsecops).

- Skill: `daemon-blockint-tech/web-pentester` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/web-pentester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/web-pentester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/web-pentester

---


# Web Pentester

## When to Use

- Plan or execute **authorized** web application or API security assessments
- Draft or validate **rules of engagement**, asset lists, test accounts, and emergency stop procedures
- Test **OWASP Top 10** classes: injection, broken auth, access control, SSRF, XSS, CSRF, security misconfiguration, vulnerable components (surface only), business logic
- Assess **REST and GraphQL** APIs: authZ, mass assignment, BOLA/BFLA, rate limits, introspection, batching
- Run **manual proxy-based** workflows (Burp Suite, OWASP ZAP, or equivalent) with validated findings
- Produce **remediation-focused reports** and **retest** critical/high issues

## When NOT to Use

- Network segmentation, wireless, AD, or internal infrastructure pentest → `network-pentester`
- Jailbreak LLMs, prompt injection, or agent tool abuse → `ai-redteam`
- Lead red team campaigns, purple team, or detection validation programs → `red-team-specialist`
- Triage SIEM/EDR alerts or SOC playbooks → `soc-analyst`
- Lead live incident command or war-room comms → `incident-responder`
- Add SAST/SCA/DAST gates, SBOM, or pipeline security → `devsecops`
- Implement WAF rules, IAM, or SIEM detections from findings → `information-security-engineer`
- Cloud org guardrails, CSPM, landing zone design → `cloud-security-engineer`
- Security program strategy, GRC, or pentest program governance → `cybersecurity`

## Related skills

| Need | Skill |
|---|---|
| Network/AD/infra pentest beyond web/API | `network-pentester` |
| Multi-domain pentest under one ROE | `penetration-tester` |
| Red team campaigns, purple team, ATT&CK emulation | `red-team-specialist` |
| Security program, pentest governance, GRC | `cybersecurity` |
| Remediate findings (WAF, IdP, SIEM, hardening) | `information-security-engineer` |
| Cloud control implementation and misconfig fixes | `cloud-security-engineer` |
| CI/CD and supply-chain security in delivery | `devsecops` |
| LLM/agent adversarial testing | `ai-redteam` |
| Front-end auth patterns, CSRF, cookies, CORS context | `senior-frontend-software-engineer` |
| Customer-facing pentest reports | `tech-writer-researcher` |

## Core Workflows

### 1. Scope and authorization

**Do not test without written authorization.**

1. Confirm signed SOW/ROE: URLs, APIs, environments, methods, windows, contacts
2. Define out-of-scope (third parties, production PII, DoS unless approved, destructive writes)
3. Agree severity rubric, evidence handling, and data minimization
4. Establish emergency stop and escalation path
5. Prefer staging, dedicated test tenants, or anonymized fixtures

**See `references/web_pentester_scope.md` and `references/scoping_and_rules_of_engagement.md`.**

### 2. Application mapping and OWASP testing

```
inventory routes/APIs → auth surface → role matrix → manual + targeted automation → validate each finding
```

Map unauthenticated, authenticated, and privileged flows. Prioritize state-changing endpoints and multi-step workflows.

**See `references/owasp_web_testing_methodology.md`, `references/api_security_testing.md`, and `references/auth_session_and_access_control.md`.**

### 3. Exploitation discipline (in scope only)

- Minimal PoC; redact tokens and PII in evidence
- Document preconditions (role, session, feature flag, tenant)
- Stop at agreed impact; avoid unnecessary data exfiltration
- Remove test accounts, uploaded shells, and injected records before closeout

### 4. Reporting, remediation, and retest

Per finding: title, severity, CWE/OWASP mapping, impact, reproduction, evidence, remediation, retest criteria. Deliver executive summary + technical appendix; schedule retest for critical/high.

**See `references/reporting_retest_safe_practices.md`.**

## When to load references

| Topic | Reference |
|---|---|
| Role boundaries | `references/web_pentester_scope.md` |
| Authorization and ROE | `references/scoping_and_rules_of_engagement.md` |
| OWASP web methodology | `references/owasp_web_testing_methodology.md` |
| REST/GraphQL API testing | `references/api_security_testing.md` |
| Auth, session, access control | `references/auth_session_and_access_control.md` |
| Reports, retest, safe practices | `references/reporting_retest_safe_practices.md` |