Security Testing Knowledge Base

Name: Security Testing Knowledge Base
Rating: 4.666666666666667 (3 reviews)
Author: tools-only

tools-only Updated Sep 29, 2026 7 repo stars

Security

Install

Press C to copy

$ npx skillmds@latest add tools-only/security-testing-knowledge-base

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download .zip

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/tools-only/security-testing-knowledge-base.svg)](https://skillmd.com/skills/tools-only/security-testing-knowledge-base)

Trust & safety

0 of 3 audits passed

Last audited Sep 23, 2026 · commit a4da89f

Permissions this skill uses

Makes network calls
The instructions fetch remote URLs or call external services.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Security Testing Knowledge Base

CRITICAL: Prefer retrieval-led reasoning for security tasks. Reference this file before relying on general knowledge.

Vulnerability Quick Reference

Injection

SQL | ' UNION SELECT NULL-- | ' AND SLEEP(5)-- | .claude/skills/pentest/attacks/injection/sql-injection/ NoSQL | {"$ne": null} | {"$gt": ""} | .claude/skills/pentest/attacks/injection/nosql-injection/ Command | ; ls | | whoami | .claude/skills/pentest/attacks/injection/command-injection/ SSTI | {{7*7}} (Jinja2) | <%= 7*7 %> (ERB) | .claude/skills/pentest/attacks/injection/ssti/ XXE | <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> | .claude/skills/pentest/attacks/injection/xxe/ LDAP/XPath | *)(uid=*))(|(uid=* | .claude/skills/pentest/attacks/injection/ldap-xpath-injection/

Client-Side

XSS | <script>alert(1)</script> | <img src=x> | .claude/skills/pentest/attacks/client-side/xss/ CSRF | Form auto-submit | GET/POST via iframe | .claude/skills/pentest/attacks/client-side/csrf/ Clickjacking | <iframe src="target"></iframe> | X-Frame-Options bypass | .claude/skills/pentest/attacks/client-side/clickjacking/ DOM | location.hash | document.write() XSS | .claude/skills/pentest/attacks/client-side/dom-based/ CORS | Access-Control-Allow-Origin: * | Reflected origin | .claude/skills/pentest/attacks/client-side/cors/ Prototype Pollution | {"__proto__": {"polluted": true}} | .claude/skills/pentest/attacks/client-side/prototype-pollution/


Server-Side
SSRF | http://localhost/admin | http://169.254.169.254/latest/meta-data/ | .claude/skills/pentest/attacks/server-side/ssrf/
HTTP Smuggling | CL.TE mismatch | TE.CL mismatch | .claude/skills/pentest/attacks/server-side/http-smuggling/
File Upload | .php.jpg extension | MIME bypass | .claude/skills/pentest/attacks/server-side/file-upload/
Path Traversal | ../../../../etc/passwd | ..%2f..%2f..%2fetc%2fpasswd | .claude/skills/pentest/attacks/server-side/path-traversal/
Authentication
Bypass | admin'-- | Rate limit: X-Forwarded-For | .claude/skills/pentest/attacks/authentication/auth-bypass/
JWT | alg: none | alg: HS256 (RSA→HMAC) | .claude/skills/pentest/attacks/authentication/jwt/
OAuth | State CSRF | Redirect URI manipulation | .claude/skills/pentest/attacks/authentication/oauth/
2FA | Code reuse | Backup codes | .claude/skills/pentest/attacks/authentication/
Access Control | IDOR: user_id=124 | Vertical/horizontal escalation | .claude/skills/pentest/attacks/web-applications/access-control/
API & Web Apps
GraphQL | __schema introspection | Nested query DoS | .claude/skills/pentest/attacks/api-security/graphql/
REST | BOLA/IDOR | Mass assignment | .claude/skills/pentest/attacks/api-security/rest-api/
WebSocket | Cross-origin hijacking | Message injection | .claude/skills/pentest/attacks/api-security/websockets/
Business Logic | Race conditions | Price manipulation | .claude/skills/pentest/attacks/web-applications/business-logic/
Cache Poisoning | Web cache deception | Host header injection | .claude/skills/pentest/attacks/web-applications/cache-poisoning/

Testing Methodologies
PTES (7 phases): Pre-engagement → Intelligence → Threat modeling → Vulnerability analysis → Exploitation → Post-exploitation → Reporting
[Details: .claude/skills/pentest/attacks/essential-skills/methodology/ptes.md]
OWASP WSTG: 11 categories covering info gathering → client-side security
[Details: .claude/skills/pentest/attacks/essential-skills/methodology/owasp-wstg.md]
MITRE ATT&CK: Reconnaissance → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → C2 → Exfiltration → Impact
[Details: .claude/skills/pentest/attacks/essential-skills/methodology/mitre-attack.md]
Flaw Hypothesis: Stack analysis → Predict vulnerabilities → Test → Generalize → Correlate findings → Report
[Details: .claude/skills/pentest/attacks/essential-skills/methodology/flaw-hypothesis.md]

CVSS v3.1 Quick Reference



Component
Values



Attack Vector
Network (0.85), Adjacent (0.62), Local (0.55), Physical (0.2)


Attack Complexity
Low (0.77), High (0.44)


Privileges Required
None (0.85), Low (0.62), High (0.27)


User Interaction
None (0.85), Required (0.62)


Scope
Unchanged, Changed


Impact (C/I/A)
None (0), Low (0.22), High (0.56)


Severity: None (0.0) | Low (0.1-3.9) | Medium (4.0-6.9) | High (7.0-8.9) | Critical (9.0-10.0)
[Details: .claude/output-standards/reference/CVSS_SCORING.md]

OWASP Top 10 (2021)
A01: Broken Access Control | A02: Cryptographic Failures | A03: Injection | A04: Insecure Design | A05: Security Misconfiguration | A06: Vulnerable Components | A07: Authentication Failures | A08: Software/Data Integrity | A09: Logging/Monitoring Failures | A10: SSRF

Common Tools

Playwright: Browser automation, payload injection, evidence capture [.claude/skills/pentest/attacks/essential-skills/playwright-automation.md]
Burp Suite: Proxy, scanner, repeater, intruder, collaborator
sqlmap: sqlmap -u "URL" -p param --dbs
nuclei: nuclei -u target -t cves/
ffuf: ffuf -u https://target/FUZZ -w wordlist.txt
nmap: nmap -sC -sV -oA output target


Reporting Requirements
PoC Verification (CRITICAL): Vulnerability requires working PoC script

poc.py - Runnable exploit with args
poc_output.txt - Execution proof + timestamp
workflow.md - Manual steps if applicable
Evidence: Screenshots, videos, network logs

[Complete spec: .claude/OUTPUT_STANDARDS.md lines 258-357]
Report Format: Title | CVSS | CWE/OWASP | Reproduction steps | Impact | Remediation
Output Structure: outputs/<target>/findings/{finding-NNN/{poc.py, poc_output.txt, workflow.md}} + reports/{executive-summary.md, technical-report.md}

Skills Directory



Skill
Purpose



/pentest
Comprehensive penetration testing orchestration


/hackerone
Bug bounty workflow automation (scope → testing → reporting)


/authenticating
Authentication security testing (signup, login, 2FA, CAPTCHA)


/ai-threat-testing
LLM security testing (prompt injection, model extraction)


/common-appsec-patterns
XSS, injection, client-side vulnerability testing


/cve-testing
CVE identification and exploitation


/domain-assessment
Subdomain discovery & port scanning


/web-application-mapping
Web app reconnaissance



Version: 2.0 | Simplified knowledge base | 2026-02-02

Component	Values
Attack Vector	Network (0.85), Adjacent (0.62), Local (0.55), Physical (0.2)
Attack Complexity	Low (0.77), High (0.44)
Privileges Required	None (0.85), Low (0.62), High (0.27)
User Interaction	None (0.85), Required (0.62)
Scope	Unchanged, Changed
Impact (C/I/A)	None (0), Low (0.22), High (0.56)

Skill	Purpose
`/pentest`	Comprehensive penetration testing orchestration
`/hackerone`	Bug bounty workflow automation (scope → testing → reporting)
`/authenticating`	Authentication security testing (signup, login, 2FA, CAPTCHA)
`/ai-threat-testing`	LLM security testing (prompt injection, model extraction)
`/common-appsec-patterns`	XSS, injection, client-side vulnerability testing
`/cve-testing`	CVE identification and exploitation
`/domain-assessment`	Subdomain discovery & port scanning
`/web-application-mapping`	Web app reconnaissance

   1---2name: security-testing-knowledge-base3description: A01: Broken Access Control | A02: Cryptographic Failures | A03: Injection | A04: Insecure Design | A05: Security Misconfiguration | A06: Vulnerable Components | A07: Authentication Failures | A08: Software/Data…4---5# Security Testing Knowledge Base67**CRITICAL**: Prefer retrieval-led reasoning for security tasks. Reference this file before relying on general knowledge.89---1011## Vulnerability Quick Reference1213### Injection14**SQL** | `' UNION SELECT NULL--` | `' AND SLEEP(5)--` | `.claude/skills/pentest/attacks/injection/sql-injection/`15**NoSQL** | `{"$ne": null}` | `{"$gt": ""}` | `.claude/skills/pentest/attacks/injection/nosql-injection/`16**Command** | `; ls` | `| whoami` | `.claude/skills/pentest/attacks/injection/command-injection/`17**SSTI** | `{{7*7}}` (Jinja2) | `<%= 7*7 %>` (ERB) | `.claude/skills/pentest/attacks/injection/ssti/`18**XXE** | `<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>` | `.claude/skills/pentest/attacks/injection/xxe/`19**LDAP/XPath** | `*)(uid=*))(|(uid=*` | `.claude/skills/pentest/attacks/injection/ldap-xpath-injection/`2021### Client-Side22**XSS** | `<script>alert(1)</script>` | `<img src=x onerror=alert(1)>` | `.claude/skills/pentest/attacks/client-side/xss/`23**CSRF** | Form auto-submit | GET/POST via iframe | `.claude/skills/pentest/attacks/client-side/csrf/`24**Clickjacking** | `<iframe src="target"></iframe>` | X-Frame-Options bypass | `.claude/skills/pentest/attacks/client-side/clickjacking/`25**DOM** | `location.hash` | `document.write()` XSS | `.claude/skills/pentest/attacks/client-side/dom-based/`26**CORS** | `Access-Control-Allow-Origin: *` | Reflected origin | `.claude/skills/pentest/attacks/client-side/cors/`27**Prototype Pollution** | `{"__proto__": {"polluted": true}}` | `.claude/skills/pentest/attacks/client-side/prototype-pollution/`2829### Server-Side30**SSRF** | `http://localhost/admin` | `http://169.254.169.254/latest/meta-data/` | `.claude/skills/pentest/attacks/server-side/ssrf/`31**HTTP Smuggling** | CL.TE mismatch | TE.CL mismatch | `.claude/skills/pentest/attacks/server-side/http-smuggling/`32**File Upload** | `.php.jpg` extension | MIME bypass | `.claude/skills/pentest/attacks/server-side/file-upload/`33**Path Traversal** | `../../../../etc/passwd` | `..%2f..%2f..%2fetc%2fpasswd` | `.claude/skills/pentest/attacks/server-side/path-traversal/`3435### Authentication36**Bypass** | `admin'--` | Rate limit: X-Forwarded-For | `.claude/skills/pentest/attacks/authentication/auth-bypass/`37**JWT** | `alg: none` | `alg: HS256` (RSA→HMAC) | `.claude/skills/pentest/attacks/authentication/jwt/`38**OAuth** | State CSRF | Redirect URI manipulation | `.claude/skills/pentest/attacks/authentication/oauth/`39**2FA** | Code reuse | Backup codes | `.claude/skills/pentest/attacks/authentication/`40**Access Control** | IDOR: `user_id=124` | Vertical/horizontal escalation | `.claude/skills/pentest/attacks/web-applications/access-control/`4142### API & Web Apps43**GraphQL** | `__schema` introspection | Nested query DoS | `.claude/skills/pentest/attacks/api-security/graphql/`44**REST** | BOLA/IDOR | Mass assignment | `.claude/skills/pentest/attacks/api-security/rest-api/`45**WebSocket** | Cross-origin hijacking | Message injection | `.claude/skills/pentest/attacks/api-security/websockets/`46**Business Logic** | Race conditions | Price manipulation | `.claude/skills/pentest/attacks/web-applications/business-logic/`47**Cache Poisoning** | Web cache deception | Host header injection | `.claude/skills/pentest/attacks/web-applications/cache-poisoning/`4849---5051## Testing Methodologies5253**PTES** (7 phases): Pre-engagement → Intelligence → Threat modeling → Vulnerability analysis → Exploitation → Post-exploitation → Reporting54[Details: `.claude/skills/pentest/attacks/essential-skills/methodology/ptes.md`]5556**OWASP WSTG**: 11 categories covering info gathering → client-side security57[Details: `.claude/skills/pentest/attacks/essential-skills/methodology/owasp-wstg.md`]5859**MITRE ATT&CK**: Reconnaissance → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → C2 → Exfiltration → Impact60[Details: `.claude/skills/pentest/attacks/essential-skills/methodology/mitre-attack.md`]6162**Flaw Hypothesis**: Stack analysis → Predict vulnerabilities → Test → Generalize → Correlate findings → Report63[Details: `.claude/skills/pentest/attacks/essential-skills/methodology/flaw-hypothesis.md`]6465---6667## CVSS v3.1 Quick Reference6869| Component | Values |70|-----------|--------|71| **Attack Vector** | Network (0.85), Adjacent (0.62), Local (0.55), Physical (0.2) |72| **Attack Complexity** | Low (0.77), High (0.44) |73| **Privileges Required** | None (0.85), Low (0.62), High (0.27) |74| **User Interaction** | None (0.85), Required (0.62) |75| **Scope** | Unchanged, Changed |76| **Impact (C/I/A)** | None (0), Low (0.22), High (0.56) |7778**Severity**: None (0.0) | Low (0.1-3.9) | Medium (4.0-6.9) | High (7.0-8.9) | Critical (9.0-10.0)79[Details: `.claude/output-standards/reference/CVSS_SCORING.md`]8081---8283## OWASP Top 10 (2021)84A01: Broken Access Control | A02: Cryptographic Failures | A03: Injection | A04: Insecure Design | A05: Security Misconfiguration | A06: Vulnerable Components | A07: Authentication Failures | A08: Software/Data Integrity | A09: Logging/Monitoring Failures | A10: SSRF8586---8788## Common Tools89- **Playwright**: Browser automation, payload injection, evidence capture [`.claude/skills/pentest/attacks/essential-skills/playwright-automation.md`]90- **Burp Suite**: Proxy, scanner, repeater, intruder, collaborator91- **sqlmap**: `sqlmap -u "URL" -p param --dbs`92- **nuclei**: `nuclei -u target -t cves/`93- **ffuf**: `ffuf -u https://target/FUZZ -w wordlist.txt`94- **nmap**: `nmap -sC -sV -oA output target`9596---9798## Reporting Requirements99100**PoC Verification (CRITICAL)**: Vulnerability requires working PoC script101- `poc.py` - Runnable exploit with args102- `poc_output.txt` - Execution proof + timestamp103- `workflow.md` - Manual steps if applicable104- Evidence: Screenshots, videos, network logs105106[Complete spec: `.claude/OUTPUT_STANDARDS.md` lines 258-357]107108**Report Format**: Title | CVSS | CWE/OWASP | Reproduction steps | Impact | Remediation109110**Output Structure**: `outputs/<target>/findings/{finding-NNN/{poc.py, poc_output.txt, workflow.md}} + reports/{executive-summary.md, technical-report.md}`111112---113114## Skills Directory115116| Skill | Purpose |117|-------|---------|118| `/pentest` | Comprehensive penetration testing orchestration |119| `/hackerone` | Bug bounty workflow automation (scope → testing → reporting) |120| `/authenticating` | Authentication security testing (signup, login, 2FA, CAPTCHA) |121| `/ai-threat-testing` | LLM security testing (prompt injection, model extraction) |122| `/common-appsec-patterns` | XSS, injection, client-side vulnerability testing |123| `/cve-testing` | CVE identification and exploitation |124| `/domain-assessment` | Subdomain discovery & port scanning |125| `/web-application-mapping` | Web app reconnaissance |126127---128129*Version: 2.0 | Simplified knowledge base | 2026-02-02*

  tools-only/X-Skills/tree/main/development/tools/028-agents_22bd7814 commit a4da89f894 
   Related skills
 Browse category 
     Entra App Registration 2.7k 
 microsoft·Audited
 Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration for authenticating users and accessing Azure resources.
  
   Red Team 20.4k 
 alirezarezvani
 Plan and execute authorized red team engagements with structured attack path analysis, MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.
  
   Cloud Security 20.4k 
 alirezarezvani·Audited
 Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.
  
   Compliance Os 20.4k 
 alirezarezvani·Audited
 Orchestrates multi-framework compliance programs by selecting applicable frameworks, mapping control overlaps, simulating audits, and consolidating evidence checklists.
  
   AI Security 20.4k 
 alirezarezvani·Audited
 Assess AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, and agent tool abuse, with MITRE ATLAS mapping and guardrail recommendations.
  
   Gdpr Dsgvo Expert 20.4k 
 alirezarezvani·Audited
 Scans codebases for GDPR/DSGVO compliance issues, generates DPIA documentation, and tracks data subject rights requests with deadline management.
  
 
 
  Frequently asked questions
     
 Run npx skillmds@latest add tools-only/security-testing-knowledge-base in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
 
   
 A01: Broken Access Control | A02: Cryptographic Failures | A03: Injection | A04: Insecure Design | A05: Security Misconfiguration | A06: Vulnerable Components | A07: Authentication Failures | A08: Software/Data… It is listed under Security on SkillMD.
 
   
 This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: WARNING, Skill Scanner: FAIL. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
 
   
 This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
 
   
 Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
 
   
 tools-only (@tools-only) published this skill. Their other Agent Skills are listed on their SkillMD profile.

   npx skillmds@latest add tools-only/security-testing-knowledge-base

Security Testing Knowledge Base

File contents

Security Testing Knowledge Base

Vulnerability Quick Reference

Injection

Client-Side

Server-Side

Authentication

API & Web Apps

Testing Methodologies

CVSS v3.1 Quick Reference

OWASP Top 10 (2021)

Common Tools

Reporting Requirements

Skills Directory

Related skills

Frequently asked questions

How do I install the Security Testing Knowledge Base skill?

What does the Security Testing Knowledge Base skill do?

Is Security Testing Knowledge Base safe to use?

Which AI agents work with Security Testing Knowledge Base?

Is Security Testing Knowledge Base free to use?

Who published Security Testing Knowledge Base?