# Web > Web application security testing skills organized by OWASP Top 10 2021 categories. - Skill: `omkar-ukirde/web` (Agent Skill) - Install (CLI): `npx skillmds@latest add omkar-ukirde/web` - Raw SKILL.md: https://api.skillmd.com/api/skills/omkar-ukirde/web/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: omkar-ukirde (https://skillmd.com/u/omkar-ukirde) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/omkar-ukirde/web --- # Web Application Security Skills Comprehensive web application penetration testing skills based on OWASP Top 10 2021. ## Categories ### OWASP Top 10 2021 | Category | Skills | |----------|--------| | [A01 - Broken Access Control](a01-broken-access-control/SKILL.md) | IDOR, CSRF, CORS, Open Redirect | | [A03 - Injection](a03-injection/SKILL.md) | SQL, NoSQL, Command, SSTI, LDAP, XPath | | [A04 - Insecure Design](a04-insecure-design/SKILL.md) | Race Condition, HPP | | [A05 - Security Misconfiguration](a05-security-misconfiguration/SKILL.md) | XXE, File Upload, Subdomain Takeover | | [A06 - Vulnerable Components](a06-vulnerable-components/SKILL.md) | Deserialization | | [A07 - Auth Failures](a07-auth-failures/SKILL.md) | JWT, OAuth, Session, 2FA | | [A08 - Data Integrity](a08-data-integrity-failures/SKILL.md) | HTTP Request Smuggling | | [A10 - SSRF](a10-ssrf/SKILL.md) | SSRF, WebSocket | ### Additional Categories | Category | Skills | |----------|--------| | [XSS](xss/SKILL.md) | Cross-Site Scripting, Clickjacking | | [API Security](api-security/SKILL.md) | GraphQL, REST API | | [File Attacks](file-attacks/SKILL.md) | LFI, RFI | | [Web2 Recon](web2-recon/SKILL.md) | Recon pipeline, tech detection | | [Web3 Audit](web3-audit/SKILL.md) | Smart contract audit, DeFi | | [CVE Hunting](cve-hunting/SKILL.md) | Fetch latest web CVEs | ## Quick Reference | Attack Type | Tool | Detection | |-------------|------|-----------| | SQLi | sqlmap | `'`, error-based | | XSS | burpsuite | `