# Webapp

> Web application security testing - OWASP Top 10, API security

- Skill: `majiayu000/webapp` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/webapp`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/webapp/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/webapp

---


# Web Application Testing

Run authorized web application security tests:
- OWASP Top 10 vulnerabilities
- SQL injection, XSS, command injection
- Authentication and session testing
- Authorization and access control (IDOR)
- API security testing
- Business logic flaws

## Required Context
1. **Target**: URL(s) in scope
2. **Authorization**: LOA, bug bounty program, or own app
3. **Scope**: In-scope/out-of-scope endpoints
4. **Constraints**: Rate limits, testing windows

## Tools Used
sqlmap, ffuf, gobuster, nuclei, dalfox, nikto, wpscan, burpsuite, jwt_tool, arjun

## Example
```
/webapp
Target: https://app.example.com
Authorization: Bug bounty program
Focus: Authentication bypass, SQLi
```