# Web Security

> Exploits web application vulnerabilities. Use when working with SQL injection, XSS, SSRF, SSTI, command injection, path traversal, authentication bypass, deserialization, or any web-based CTF challenge.

- Skill: `majiayu000/web-security-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/web-security-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/web-security-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics, Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/web-security-2

---


# Web Security Skill

## Quick Workflow

```
Progress:
- [ ] Identify technology stack
- [ ] Check common files (robots.txt, .git)
- [ ] Test injection points (SQLi, XSS, SSTI)
- [ ] Check authentication/session flaws
- [ ] Develop exploit
- [ ] Extract flag
```

## Quick Recon

```bash
# Directory enumeration
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://target/FUZZ -w wordlist.txt

# Technology detection
whatweb http://target
curl -I http://target

# Check robots.txt, .git exposure
curl http://target/robots.txt
curl http://target/.git/HEAD
```

## Vulnerability Reference

| Vulnerability | Reference File |
|--------------|----------------|
| SQL Injection | [reference/sqli.md](reference/sqli.md) |
| XSS | [reference/xss.md](reference/xss.md) |
| SSTI | [reference/ssti.md](reference/ssti.md) |
| Command Injection | [reference/command-injection.md](reference/command-injection.md) |
| SSRF / Path Traversal | [reference/ssrf-lfi.md](reference/ssrf-lfi.md) |
| Auth Bypass / Deserialization | [reference/auth-deser.md](reference/auth-deser.md) |

## Tools Quick Reference

| Tool | Purpose | Command |
|------|---------|---------|
| sqlmap | SQLi automation | `sqlmap -u URL --dbs` |
| commix | Command injection | `commix -u URL` |
| tplmap | SSTI automation | `tplmap -u URL` |
| ffuf | Fuzzing | `ffuf -u URL/FUZZ -w wordlist` |
| Burp Suite | Proxy/intercept | GUI |
| jwt_tool | JWT attacks | `jwt_tool TOKEN` |