How do I install the Playbook Webapp skill?

Run npx skillmds@latest add s0ld13rr/playbook-webapp in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Playbook Webapp safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Playbook Webapp?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Playbook Webapp free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Playbook Webapp?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Playbook Webapp by s0ld13rr — Agent Skill

Name: Playbook Webapp
Rating: 4.2 (5 reviews)
Author: s0ld13rr

Playbook Webapp

Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement.

s0ld13rr Updated Sep 22, 2026

File contents

Web App Pentest — methodology + skill router

This is the ORDER of operations and the map to the deep skills. Each vuln CLASS has a dedicated web-<class> skill with exact payloads + detect→exploit→PROVE — load the one matching the surface; don't test from this index.

1. Recon + active scan FIRST

Fingerprint stack+version (whatweb/httpx, headers), CMS (wpscan/etc.), APIs (/swagger, /graphql, /.well-known). Then a content-matched nuclei -u <t> pass BEFORE exhaustive dir-fuzz (framework-runtime RCEs don't appear as routes) → nuclei_parse. Version + a known CVE → fetch & vet a public PoC (shared exploitation methodology).

2. Map (hidden surface, AFTER the scan)

ffuf/gobuster (→ gobuster_parse), vhosts (ffuf -H Host:FUZZ), params (arjun), auth endpoints (login/register/reset/OAuth), API routes. Review client-side JS for endpoints/secrets.

3. Test by class → load the matching skill

Signal / surface	Load
param → DB query, SQL error/differential	web-sqli
input renders in a server template ({{7*7}})	web-ssti
server fetches a URL you control (webhook/proxy/import)	web-ssrf
file param / download / `../` reflection	web-lfi-traversal
file upload sink	web-upload-rce
XML/SOAP/SAML/DOCX/SVG parsing	web-xxe
serialized blob (rO0/O:/VIEWSTATE/pickle)	web-deserialization
object IDs, roles, JWT, admin funcs	web-auth-bypass-idor
known framework+version CVE	shared exploitation methodology + searchsploit/nuclei
Also-check (no dedicated skill yet): XSS (`dalfox`, `xss_detect`), command injection (`;id`/`$(id)`), CSRF, CORS/security-headers, crypto/secrets-in-JS, business-logic/race conditions.

4. PROVE + Report

A finding is suspected until you reproduce concrete impact (dumped canary row / id / file bytes / cloud creds / cross-user data) — then add_vuln confirmed with the evidence. Never mark a host resolved/"safe" without a completed active scan. Report: reproduction steps + request/response evidence + CVSS + OWASP-WSTG mapping.

---name: playbook-webappdescription: Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement.---# Web App Pentest — methodology + skill routerThis is the ORDER of operations and the map to the deep skills. Each vuln CLASS has a dedicated `web-<class>` skill with exact payloads + detect→exploit→PROVE — load the one matching the surface; don't test from this index.## 1. Recon + active scan FIRSTFingerprint stack+version (whatweb/httpx, headers), CMS (wpscan/etc.), APIs (/swagger, /graphql, /.well-known). Then a content-matched `nuclei -u <t>` pass BEFORE exhaustive dir-fuzz (framework-runtime RCEs don't appear as routes) → `nuclei_parse`. Version + a known CVE → fetch & vet a public PoC (shared exploitation methodology).## 2. Map (hidden surface, AFTER the scan)`ffuf`/`gobuster` (→ `gobuster_parse`), vhosts (`ffuf -H Host:FUZZ`), params (`arjun`), auth endpoints (login/register/reset/OAuth), API routes. Review client-side JS for endpoints/secrets.## 3. Test by class → load the matching skill| Signal / surface | Load ||---|---|| param → DB query, SQL error/differential | **web-sqli** || input renders in a server template ({{7*7}}) | **web-ssti** || server fetches a URL you control (webhook/proxy/import) | **web-ssrf** || file param / download / `../` reflection | **web-lfi-traversal** || file upload sink | **web-upload-rce** || XML/SOAP/SAML/DOCX/SVG parsing | **web-xxe** || serialized blob (rO0/O:/VIEWSTATE/pickle) | **web-deserialization** || object IDs, roles, JWT, admin funcs | **web-auth-bypass-idor** || known framework+version CVE | shared exploitation methodology + searchsploit/nuclei |Also-check (no dedicated skill yet): XSS (`dalfox`, `xss_detect`), command injection (`;id`/`$(id)`), CSRF, CORS/security-headers, crypto/secrets-in-JS, business-logic/race conditions.## 4. PROVE + ReportA finding is `suspected` until you reproduce concrete impact (dumped canary row / `id` / file bytes / cloud creds / cross-user data) — then `add_vuln` `confirmed` with the evidence. Never mark a host resolved/"safe" without a completed active scan. Report: reproduction steps + request/response evidence + CVSS + OWASP-WSTG mapping.

Frequently asked questions