DAST Automation with Playwright MCP
Thin router. Specific guidance lives in workflows/, methodology/, payloads/, and examples/. Read this file first, then lazy-load only the files you need for the task.
When to Use
- Operator asks for a DAST / dynamic security scan of one or more web apps.
- Blackbox external scan of a single domain.
- Greybox (authenticated) scan with provided credentials.
- Parallel scanning across a fleet of domains.
- Setting up continuous / scheduled DAST with baseline diffing.
- CI/CD integration to block regressions on new Critical/High issues.
Trigger Phrases
"scan ", "run DAST", "blackbox scan", "greybox scan", "authenticated pentest", "spider and test this app", "security-test these URLs", "weekly security scan", "continuous DAST".
When NOT to Use This Skill
- Source-code SAST / dependency CVEs → use
sast-automation / sca-automation.
- Container image CVE scanning → use
container-security.
- IaC / Terraform / K8s manifest misconfig scanning → use
iac-security.
- Mobile app runtime testing (Frida, MASTG) → use
mobile-security.
- Network/host hardening audit without web surface → use
network-audit.
- Manual bug-bounty research on a single target → use this skill for surface mapping but switch to
hackerone-research for narrative PoC work.
Decision Tree
Domains = 1 ──→ creds provided? ──→ no → workflows/blackbox_single_domain.md
└─→ yes → workflows/greybox_authenticated.md
Domains ≥ 2 ──→ one-shot scan ──→ workflows/multi_domain_parallel.md
└→ recurring schedule ─→ workflows/continuous_scanning.md
Any mode ──→ emit schemas/finding.json → methodology/reporting.md
Parallelism Hints
Independent — run concurrently:
- Phase 0 recon tools:
nmap, whatweb, ffuf, subfinder, root-level nuclei.
- Per-injection-class test batches (XSS, SQLi, SSRF, path traversal, CRLF) after crawl finishes.
- One sub-agent per domain in multi-domain mode.
- One sub-agent per low-priv account when running IDOR diff.
Must be sequential:
- Playwright login must complete before greybox crawl starts (storageState is consumed downstream).
- Crawl must complete before Nuclei endpoint overlay.
- Business-logic tests run after authed crawl builds the workflow map.
- Baseline diff runs after the current scan's
output.json is finalized.
Sub-Agent Delegation
Spawn sub-agents (via the Task tool) when:
| Scenario |
Sub-agent granularity |
Cap |
| Multi-domain scan |
One per domain |
5 concurrent |
| Focused single-target triage |
One per vuln class (XSS, SQLi, SSRF, IDOR, business-logic) |
5 concurrent |
| IDOR / authz diff |
One per account identity |
2–3 (one per tier) |
| Continuous fleet |
One per domain per schedule tick |
5 concurrent |
Each sub-agent writes to its own results/<scope>/ directory and returns a path to output.json. The parent aggregates; sub-agents never cross-read each other's output mid-run.
Reasoning Budget
Extended thinking on:
- Business-logic flaw analysis (pricing, workflow skip, race conditions) — see
payloads/business_logic.txt.
- Multi-step workflow mapping (checkout, KYC, password reset).
- IDOR model: which IDs are tenant-scoped, which are global, which are predictable.
- Severity/confidence calibration for ambiguous findings.
- Greybox auth failure triage (CAPTCHA, 2FA, CSRF-on-login).
No / minimal thinking on:
- Rote payload injection from
payloads/*.txt against discovered inputs.
- Running standard recon tools with stock flags.
- Nuclei overlay pass.
- Emitting JSON conforming to
schemas/finding.json.
Multimodal Hooks
- Playwright screenshots — captured per-entry; path stored at
evidence.playwright_screenshot_path.
- Optional Playwright
.zip trace for time-travel debugging of complex finding repros.
- Network HAR exports attachable to high-severity findings.
- Visual diff between low-priv and high-priv account views (IDOR evidence).
Structured Output
Every output entry conforms to schemas/finding.json. DAST-specific fields: affected.url, affected.http_method, affected.parameter, affected.payload, affected.http_status, affected.authenticated_as, evidence.playwright_screenshot_path, evidence.playwright_trace_path, evidence.har_path.
Workflow Index
| File |
When |
workflows/blackbox_single_domain.md |
One domain, no creds |
workflows/greybox_authenticated.md |
One domain, with creds |
workflows/multi_domain_parallel.md |
≥2 domains, one-shot |
workflows/continuous_scanning.md |
Scheduled / CI recurring |
Methodology Index
| File |
Phase |
methodology/recon.md |
Phase 0 — surface discovery |
methodology/crawling.md |
Phase 1 — Playwright BFS + auth |
methodology/vuln_testing.md |
Phase 2 — injection, authz, logic |
methodology/reporting.md |
Phase 3 — output artifacts & gating |
Payloads Index
| File |
Content |
payloads/xss_contexts.txt |
HTML, attribute, JS, URL, WAF-bypass XSS |
payloads/sqli.txt |
Auth-bypass, error, time, boolean, union, sqlmap flags |
payloads/ssrf_cloud_metadata.txt |
AWS/GCP/Azure/K8s metadata URLs, IP bypass |
payloads/path_traversal.txt |
Unix/Windows traversal, CVE patterns, target files |
payloads/crlf_smuggling.txt |
CRLF header injection, CL.TE/TE.CL smuggling |
payloads/jwt_attacks.txt |
alg:none, key confusion, kid/jku, weak HMAC |
payloads/business_logic.txt |
Price, workflow skip, race, IDOR, mass assignment |
References Index
| File |
Content |
references/hackerone_attack_patterns.md |
6,894 HackerOne patterns across 157 categories (pointer — don't inline) |
references/bounty_patterns_2024_2026.md |
Post-2023 bounty TTPs (TE.0 smuggling, HTTP/2 CONNECT scan, WAFFLED parser bypass, SVG/popover XSS, base64-SSRF, prototype pollution, cache deception) |
references/advanced_exploitation_techniques.md |
OS-tool deep dives (sqlmap, nuclei, jwt_tool, etc.) |
references/dast_methodology.md |
Full long-form methodology |
references/playwright_security_patterns.md |
Playwright-specific security patterns |
references/vulnerability_testing.md |
Exhaustive vuln-class test catalogue |
references/tool_configuration.md |
Per-tool config templates |
references/api_testing.md |
API-specific DAST |
references/reporting_guide.md |
Long-form report customization |
Examples Index
| File |
Scenario |
examples/blackbox_basic.md |
Single-domain blackbox tool-call blueprint |
examples/greybox_multi_domain.md |
Authenticated multi-domain with sub-agents |
examples/continuous_setup.md |
Setting up scheduled scans |
examples/github_actions_dast.yml |
Drop-in CI workflow |
Tools
| Name |
Purpose |
Install |
| Playwright MCP |
Browser automation, crawling, auth, evidence |
MCP server in Claude config |
| nmap |
Port/service discovery |
apt install nmap |
| subfinder |
Passive subdomain enum |
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest |
| whatweb |
Tech fingerprinting |
apt install whatweb |
| ffuf |
Content discovery |
go install github.com/ffuf/ffuf/v2@latest |
| nuclei |
CVE / misconfig / panel templates |
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest |
| sqlmap |
Automated SQLi |
apt install sqlmap |
| nikto |
Web-server misconfig (optional) |
apt install nikto |
| jwt_tool |
JWT attacks |
pip install jwt_tool |
| interactsh-client |
OOB exfil for SSRF/blind RCE |
go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest |
Helper scripts live under scripts/ (entry points: playwright_dast_scanner.py, dast_orchestrator.py, check_findings.py).
Last Validated
- Date: 2026-04
- Minimum versions: Playwright ≥ 1.45, nuclei ≥ 3.2, sqlmap ≥ 1.8, ffuf ≥ 2.1, Python ≥ 3.12.
- Requires Playwright MCP to be configured and reachable before greybox scans.
1---2name: dast-automation3description: Automated Dynamic Application Security Testing (DAST) using Playwright MCP plus standard OS pentest tooling. Performs blackbox or greybox scans on single or multiple domains with orchestrated crawling, vulnerability detection, and structured output. Trigger on requests like "scan this domain", "run DAST on these URLs", "automated pentest", or "security-test the staging app".4---56# DAST Automation with Playwright MCP78Thin router. Specific guidance lives in `workflows/`, `methodology/`, `payloads/`, and `examples/`. Read this file first, then lazy-load only the files you need for the task.910## When to Use1112- Operator asks for a DAST / dynamic security scan of one or more web apps.13- Blackbox external scan of a single domain.14- Greybox (authenticated) scan with provided credentials.15- Parallel scanning across a fleet of domains.16- Setting up continuous / scheduled DAST with baseline diffing.17- CI/CD integration to block regressions on new Critical/High issues.1819## Trigger Phrases2021"scan <domain>", "run DAST", "blackbox scan", "greybox scan", "authenticated pentest", "spider and test this app", "security-test these URLs", "weekly security scan", "continuous DAST".2223## When NOT to Use This Skill2425- Source-code SAST / dependency CVEs → use `sast-automation` / `sca-automation`.26- Container image CVE scanning → use `container-security`.27- IaC / Terraform / K8s manifest misconfig scanning → use `iac-security`.28- Mobile app runtime testing (Frida, MASTG) → use `mobile-security`.29- Network/host hardening audit without web surface → use `network-audit`.30- Manual bug-bounty research on a single target → use this skill for surface mapping but switch to `hackerone-research` for narrative PoC work.3132## Decision Tree3334```35Domains = 1 ──→ creds provided? ──→ no → workflows/blackbox_single_domain.md36 └─→ yes → workflows/greybox_authenticated.md3738Domains ≥ 2 ──→ one-shot scan ──→ workflows/multi_domain_parallel.md39 └→ recurring schedule ─→ workflows/continuous_scanning.md4041Any mode ──→ emit schemas/finding.json → methodology/reporting.md42```4344## Parallelism Hints4546Independent — run concurrently:4748- Phase 0 recon tools: `nmap`, `whatweb`, `ffuf`, `subfinder`, root-level `nuclei`.49- Per-injection-class test batches (XSS, SQLi, SSRF, path traversal, CRLF) after crawl finishes.50- One sub-agent per domain in multi-domain mode.51- One sub-agent per low-priv account when running IDOR diff.5253Must be sequential:5455- Playwright **login** must complete before greybox crawl starts (storageState is consumed downstream).56- Crawl must complete before Nuclei endpoint overlay.57- Business-logic tests run after authed crawl builds the workflow map.58- Baseline diff runs after the current scan's `output.json` is finalized.5960## Sub-Agent Delegation6162Spawn sub-agents (via the Task tool) when:6364| Scenario | Sub-agent granularity | Cap |65|----------|----------------------|-----|66| Multi-domain scan | One per domain | 5 concurrent |67| Focused single-target triage | One per vuln class (XSS, SQLi, SSRF, IDOR, business-logic) | 5 concurrent |68| IDOR / authz diff | One per account identity | 2–3 (one per tier) |69| Continuous fleet | One per domain per schedule tick | 5 concurrent |7071Each sub-agent writes to its own `results/<scope>/` directory and returns a path to `output.json`. The parent aggregates; sub-agents never cross-read each other's output mid-run.7273## Reasoning Budget7475Extended thinking on:7677- Business-logic flaw analysis (pricing, workflow skip, race conditions) — see `payloads/business_logic.txt`.78- Multi-step workflow mapping (checkout, KYC, password reset).79- IDOR model: which IDs are tenant-scoped, which are global, which are predictable.80- Severity/confidence calibration for ambiguous findings.81- Greybox auth failure triage (CAPTCHA, 2FA, CSRF-on-login).8283No / minimal thinking on:8485- Rote payload injection from `payloads/*.txt` against discovered inputs.86- Running standard recon tools with stock flags.87- Nuclei overlay pass.88- Emitting JSON conforming to `schemas/finding.json`.8990## Multimodal Hooks9192- Playwright screenshots — captured per-entry; path stored at `evidence.playwright_screenshot_path`.93- Optional Playwright `.zip` trace for time-travel debugging of complex finding repros.94- Network HAR exports attachable to high-severity findings.95- Visual diff between low-priv and high-priv account views (IDOR evidence).9697## Structured Output9899Every output entry conforms to `schemas/finding.json`. DAST-specific fields: `affected.url`, `affected.http_method`, `affected.parameter`, `affected.payload`, `affected.http_status`, `affected.authenticated_as`, `evidence.playwright_screenshot_path`, `evidence.playwright_trace_path`, `evidence.har_path`.100101## Workflow Index102103| File | When |104|------|------|105| `workflows/blackbox_single_domain.md` | One domain, no creds |106| `workflows/greybox_authenticated.md` | One domain, with creds |107| `workflows/multi_domain_parallel.md` | ≥2 domains, one-shot |108| `workflows/continuous_scanning.md` | Scheduled / CI recurring |109110## Methodology Index111112| File | Phase |113|------|-------|114| `methodology/recon.md` | Phase 0 — surface discovery |115| `methodology/crawling.md` | Phase 1 — Playwright BFS + auth |116| `methodology/vuln_testing.md` | Phase 2 — injection, authz, logic |117| `methodology/reporting.md` | Phase 3 — output artifacts & gating |118119## Payloads Index120121| File | Content |122|------|---------|123| `payloads/xss_contexts.txt` | HTML, attribute, JS, URL, WAF-bypass XSS |124| `payloads/sqli.txt` | Auth-bypass, error, time, boolean, union, sqlmap flags |125| `payloads/ssrf_cloud_metadata.txt`| AWS/GCP/Azure/K8s metadata URLs, IP bypass |126| `payloads/path_traversal.txt` | Unix/Windows traversal, CVE patterns, target files |127| `payloads/crlf_smuggling.txt` | CRLF header injection, CL.TE/TE.CL smuggling |128| `payloads/jwt_attacks.txt` | alg:none, key confusion, kid/jku, weak HMAC |129| `payloads/business_logic.txt` | Price, workflow skip, race, IDOR, mass assignment |130131## References Index132133| File | Content |134|------|---------|135| `references/hackerone_attack_patterns.md` | 6,894 HackerOne patterns across 157 categories (pointer — don't inline) |136| `references/bounty_patterns_2024_2026.md` | Post-2023 bounty TTPs (TE.0 smuggling, HTTP/2 CONNECT scan, WAFFLED parser bypass, SVG/popover XSS, base64-SSRF, prototype pollution, cache deception) |137| `references/advanced_exploitation_techniques.md` | OS-tool deep dives (sqlmap, nuclei, jwt_tool, etc.) |138| `references/dast_methodology.md` | Full long-form methodology |139| `references/playwright_security_patterns.md` | Playwright-specific security patterns |140| `references/vulnerability_testing.md` | Exhaustive vuln-class test catalogue |141| `references/tool_configuration.md` | Per-tool config templates |142| `references/api_testing.md` | API-specific DAST |143| `references/reporting_guide.md` | Long-form report customization |144145## Examples Index146147| File | Scenario |148|------|----------|149| `examples/blackbox_basic.md` | Single-domain blackbox tool-call blueprint |150| `examples/greybox_multi_domain.md` | Authenticated multi-domain with sub-agents |151| `examples/continuous_setup.md` | Setting up scheduled scans |152| `examples/github_actions_dast.yml` | Drop-in CI workflow |153154## Tools155156| Name | Purpose | Install |157|------|---------|---------|158| Playwright MCP | Browser automation, crawling, auth, evidence | MCP server in Claude config |159| nmap | Port/service discovery | `apt install nmap` |160| subfinder | Passive subdomain enum | `go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest` |161| whatweb | Tech fingerprinting | `apt install whatweb` |162| ffuf | Content discovery | `go install github.com/ffuf/ffuf/v2@latest` |163| nuclei | CVE / misconfig / panel templates | `go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |164| sqlmap | Automated SQLi | `apt install sqlmap` |165| nikto | Web-server misconfig (optional) | `apt install nikto` |166| jwt_tool | JWT attacks | `pip install jwt_tool` |167| interactsh-client | OOB exfil for SSRF/blind RCE | `go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest` |168169Helper scripts live under `scripts/` (entry points: `playwright_dast_scanner.py`, `dast_orchestrator.py`, `check_findings.py`).170171## Last Validated172173- Date: 2026-04174- Minimum versions: Playwright ≥ 1.45, nuclei ≥ 3.2, sqlmap ≥ 1.8, ffuf ≥ 2.1, Python ≥ 3.12.175- Requires Playwright MCP to be configured and reachable before greybox scans.
hardw00t