# Web

> Web application security testing skills organized by OWASP Top 10 2021 categories. Use when this capability is needed.

- Skill: `tomevault-io/web` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/web`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/web/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/web

---


# Web Application Security Skills

Comprehensive web application penetration testing skills based on OWASP Top 10 2021.

## Categories

### OWASP Top 10 2021

| Category | Skills |
|----------|--------|
| [A01 - Broken Access Control](a01-broken-access-control/SKILL.md) | IDOR, CSRF, CORS, Open Redirect |
| [A03 - Injection](a03-injection/SKILL.md) | SQL, NoSQL, Command, SSTI, LDAP, XPath |
| [A04 - Insecure Design](a04-insecure-design/SKILL.md) | Race Condition, HPP |
| [A05 - Security Misconfiguration](a05-security-misconfiguration/SKILL.md) | XXE, File Upload, Subdomain Takeover |
| [A06 - Vulnerable Components](a06-vulnerable-components/SKILL.md) | Deserialization |
| [A07 - Auth Failures](a07-auth-failures/SKILL.md) | JWT, OAuth, Session, 2FA |
| [A08 - Data Integrity](a08-data-integrity-failures/SKILL.md) | HTTP Request Smuggling |
| [A10 - SSRF](a10-ssrf/SKILL.md) | SSRF, WebSocket |

### Additional Categories

| Category | Skills |
|----------|--------|
| [XSS](xss/SKILL.md) | Cross-Site Scripting, Clickjacking |
| [API Security](api-security/SKILL.md) | GraphQL, REST API |
| [File Attacks](file-attacks/SKILL.md) | LFI, RFI |

## Quick Reference

| Attack Type | Tool | Detection |
|-------------|------|-----------|
| SQLi | sqlmap | `'`, error-based |
| XSS | burpsuite | `<script>` reflection |
| SSRF | curl | Internal IP access |
| Command Injection | commix | `;`, `\|`, `&&` |

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/omkar-ukirde) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-16 -->