pentest-fuzz-skill
Use this skill to route a Web security question into the right vulnerability family, then give short, practical, test-oriented guidance.
Keep the scope on authorized testing, labs, demos, CTFs, or systems the user is permitted to assess.
Safety boundary
- Help only with authorized testing.
- If authorization is unclear and the request is target-specific, ask one short clarification.
- Do not pretend a random public target is in scope.
What this skill should do
- Identify the likely vulnerability family.
- Route to the closest directory in this skill.
- Give a compact answer with:
- what the bug is
- quick payload examples
- how to test it safely
- what response differences matter
- what to fuzz next
- Stay practical. Avoid long theory unless the user asks.
Suggested response shape
Likely issue
Name the most likely bug family and why it matches the request.
Quick tests
Give 2-5 lightweight probes or payloads.
What to compare
Point out useful signals such as:
- status code changes
- body length or word-count changes
- reflected characters or encoded output
- stack traces, SQL errors, template errors, XML parser errors
- timing differences
- privilege or data exposure changes
Next fuzz ideas
Recommend the next character set, payload family, or request mutation to try.
Directory map
sqli/: SQL injection basics, fuzzing cues, and fuzz.txtxss/: reflected, stored, and DOM XSS basics, fuzzing cues, and fuzz.txtssti/: template injection basics, engine probes, and fuzz.txtssrf/: server-side request forgery checks, SSRF-oriented fuzzing, and fuzz.txtxxe/: XML external entity testing, parser-oriented fuzzing, and fuzz.txtlfi-rfi/: file inclusion, traversal notes, and fuzz.txtidor/: object access control, identifier enumeration notes, and fuzz.txtjwt/: JWT inspection, weakness checks, and fuzz.txtrce/: command injection, code execution notes, and fuzz.txtdeserialization/: unsafe deserialization notes and fuzz.txt
Each vulnerability directory should be treated as a small bundle:
README.md for navigationoverview.md for bug summary and sample payloadsfuzzing.md for testing heuristicsfuzz.txt for a compact wordlist or token list to reuse in manual or scripted probing
Routing hints
- SQL errors, quote handling, login bypass, UNION behavior: start with
sqli/.
- Reflection into HTML, attributes, JS, or admin bot flows: start with
xss/.
{{7*7}}, ${7*7}, or template syntax: start with ssti/.- URL fetchers, webhooks, image importers, PDF renderers, metadata lookups: start with
ssrf/.
- XML bodies, SOAP, SVG, DOCX/XLSX import, SAML: start with
xxe/.
- File paths, traversal, include parameters, download/read endpoints: start with
lfi-rfi/.
- Numeric IDs, UUIDs, object keys, other-user data exposure: start with
idor/.
- Bearer tokens,
alg, kid, weak secrets, JWT parsing: start with jwt/.
- Shell metacharacters, OS commands, image/document converters, wrapper abuse: start with
rce/.
- Serialized blobs, signed cookies, Java/PHP/Python object restore paths: start with
deserialization/.
Relationship to fuzz-skill
Use pentest-fuzz-skill for vulnerability reasoning and test ideas.
If the user specifically wants a tuned ffuf command, matcher/filter advice, or raw-request fuzzing, fuzz-skill is the better follow-up.
1---2name: pentest-fuzz-skill3description: Help with authorized Web pentest, Web fuzzing, and CTF-style vulnerability analysis. Use this skill whenever the user wants payload ideas, fuzz dictionaries, quick probe strings, test methodology, response-difference heuristics, or per-vulnerability checklists for common Web bugs such as SQL injection, XSS, SSTI, SSRF, XXE, file inclusion, IDOR, JWT weaknesses, deserialization, auth bypass, or command injection. Make sure to use it when the user asks how to test a Web bug, what characters or tokens to fuzz, how to organize notes by vulnerability type, or which vulnerability family a behavior most likely belongs to, even if they do not explicitly mention a skill.4---56# pentest-fuzz-skill78Use this skill to route a Web security question into the right vulnerability family, then give short, practical, test-oriented guidance.910Keep the scope on authorized testing, labs, demos, CTFs, or systems the user is permitted to assess.1112## Safety boundary1314- Help only with authorized testing.15- If authorization is unclear and the request is target-specific, ask one short clarification.16- Do not pretend a random public target is in scope.1718## What this skill should do19201. Identify the likely vulnerability family.212. Route to the closest directory in this skill.223. Give a compact answer with:23 - what the bug is24 - quick payload examples25 - how to test it safely26 - what response differences matter27 - what to fuzz next284. Stay practical. Avoid long theory unless the user asks.2930## Suggested response shape3132### Likely issue3334Name the most likely bug family and why it matches the request.3536### Quick tests3738Give 2-5 lightweight probes or payloads.3940### What to compare4142Point out useful signals such as:43- status code changes44- body length or word-count changes45- reflected characters or encoded output46- stack traces, SQL errors, template errors, XML parser errors47- timing differences48- privilege or data exposure changes4950### Next fuzz ideas5152Recommend the next character set, payload family, or request mutation to try.5354## Directory map5556- `sqli/`: SQL injection basics, fuzzing cues, and `fuzz.txt`57- `xss/`: reflected, stored, and DOM XSS basics, fuzzing cues, and `fuzz.txt`58- `ssti/`: template injection basics, engine probes, and `fuzz.txt`59- `ssrf/`: server-side request forgery checks, SSRF-oriented fuzzing, and `fuzz.txt`60- `xxe/`: XML external entity testing, parser-oriented fuzzing, and `fuzz.txt`61- `lfi-rfi/`: file inclusion, traversal notes, and `fuzz.txt`62- `idor/`: object access control, identifier enumeration notes, and `fuzz.txt`63- `jwt/`: JWT inspection, weakness checks, and `fuzz.txt`64- `rce/`: command injection, code execution notes, and `fuzz.txt`65- `deserialization/`: unsafe deserialization notes and `fuzz.txt`6667Each vulnerability directory should be treated as a small bundle:68- `README.md` for navigation69- `overview.md` for bug summary and sample payloads70- `fuzzing.md` for testing heuristics71- `fuzz.txt` for a compact wordlist or token list to reuse in manual or scripted probing7273## Routing hints7475- SQL errors, quote handling, login bypass, UNION behavior: start with `sqli/`.76- Reflection into HTML, attributes, JS, or admin bot flows: start with `xss/`.77- `{{7*7}}`, `${7*7}`, or template syntax: start with `ssti/`.78- URL fetchers, webhooks, image importers, PDF renderers, metadata lookups: start with `ssrf/`.79- XML bodies, SOAP, SVG, DOCX/XLSX import, SAML: start with `xxe/`.80- File paths, traversal, include parameters, download/read endpoints: start with `lfi-rfi/`.81- Numeric IDs, UUIDs, object keys, other-user data exposure: start with `idor/`.82- Bearer tokens, `alg`, `kid`, weak secrets, JWT parsing: start with `jwt/`.83- Shell metacharacters, OS commands, image/document converters, wrapper abuse: start with `rce/`.84- Serialized blobs, signed cookies, Java/PHP/Python object restore paths: start with `deserialization/`.8586## Relationship to `fuzz-skill`8788Use `pentest-fuzz-skill` for vulnerability reasoning and test ideas.8990If the user specifically wants a tuned `ffuf` command, matcher/filter advice, or raw-request fuzzing, `fuzz-skill` is the better follow-up.
m-sec-org