Web

Web Application Exploitation — Category Overview

This is a routing skill. It helps you identify the correct attack technique, then directs you to the specialized sub-skill with full exploitation procedures.

Attack Technique Routing

Match the target's characteristics to the right sub-skill:

Quick Detection — Which Attack Type?

Run these probes to identify which sub-skill to load:

# 1. SQL Injection — single quote error
curl -s 'https://<TARGET>/page?id=1%27' -o /dev/null -w '%{http_code}'

# 2. SSTI — math evaluation
curl -s 'https://<TARGET>/page?input={{7*7}}' | grep -o '49'

# 3. XSS — reflection check
curl -s 'https://<TARGET>/search?q=<script>test</script>' | grep '<script>test'

# 4. LFI — path traversal
curl -s 'https://<TARGET>/file?name=../../../etc/passwd' | grep 'root:'

# 5. Command Injection — command chaining
curl -s 'https://<TARGET>/ping?host=127.0.0.1;id' | grep 'uid='

# 6. SSRF — localhost access
curl -s 'https://<TARGET>/fetch?url=http://127.0.0.1/' -o ssrf_test.txt

# 7. XXE — XML acceptance
curl -s 'https://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>'

# 8. GraphQL — endpoint discovery
curl -s 'https://<TARGET>/graphql' -H 'Content-Type: application/json' -d '{"query":"{ __typename }"}'

Decision Flow

Web target identified?
├── Has query parameters → Try sqli.md, then ssti.md
├── Has file/path parameters → Try lfi.md
├── Has URL/fetch parameters → Try ssrf.md
├── Has search/input reflection → Try xss.md
├── Has file upload form → Try file-upload.md
├── Accepts XML input → Try xxe.md
├── Has /graphql endpoint → Try graphql.md
├── Has ping/exec functionality → Try command-injection.md
├── Has serialized data (cookies, POST) → Try deserialization.md
├── Has object IDs in URLs → Try idor.md
├── Tag/hint includes race/concurrent/toctou → Try race-condition.md
├── Tag/hint includes smuggling/desync/hrs OR multi-proxy stack detected → Try smuggling.md
├── Tag/hint includes crypto/cipher/oracle/captcha OR base64 cookie %16==0 with distinct pad-vs-auth errors → Try crypto.md
├── Tag includes business_logic / privilege_escalation / 2fa_bypass / auth_bypass → Try business-logic.md
├── Tag includes cve OR challenge description mentions a specific CVE/plugin vulnerability → Load cve.md
└── Unknown → Run quick detection probes above

CVE / Known-Exploit Methodology

For CVE-class exploitation, load cve.md (full procedure includes fingerprinting → cve_lookup tool call → cve_poc_lookup → PoC adaptation → flag sweep). Once the CVE class is identified (SQLi/LFI/RCE/auth bypass), also load the matching attack-class sub-skill (sqli.md, lfi.md, command-injection.md, etc.) for the continuation primitive.

Payload Pacing — Cross-Technique Rule

After 3 payloads of the same bypass class against the same endpoint all produce the same-class negative result (all blocked / all 404 / all no-reflection), pivot to the next bypass class from the sub-skill's cookbook. Do not iterate further within the exhausted class.

A "class" is the bypass mechanism, not the payload string. Three payloads that differ only in the injected JS expression (e.g. alert(1) → alert(2) → confirm(1)) are ONE class.

After exhausting 3 bypass classes on the same endpoint: the endpoint is hardened. Write exploit/PIVOT.md and switch to a different endpoint or vulnerability class from recon SUMMARY.md.

Sub-Skill Loading Rule

ALWAYS load the specialized sub-skill before executing any attack. This overview provides routing only — the sub-skills contain the actual exploitation procedures, tool commands, bypass techniques, and decision trees needed for successful exploitation.

The agent loop (intake handoff verification, confirm-gate phase, verification, silent-stall recovery, three-strike rule) is already loaded into your system prompt at agent boot — no load_skill call needed for it.