Web Pentest

Web Pentest — Master Methodology & Orchestration Skill

Purpose

Acts as the central coordinator for comprehensive web penetration testing assessments against authorized targets, aligning testing steps with the OWASP Web Security Testing Guide (WSTG), Strix autonomous testing lifecycle, and standard bug bounty methodologies.

Core Phases & Sub-Skill Delegations

┌─────────────────────────────────────────────────────────────┐
│                   Web Pentest Workflow                      │
│                                                             │
│  Phase 1: Target Ingestion & Source Review (if available)   │
│  ├── Skills: recon, web-enumeration, js-recon-secret-hunting │
│  └── Whitebox: source-code-audit (Local repos / Git)        │
│                                                             │
│  Phase 2: Endpoint Fuzzing & Parameter Discovery            │
│  └── Skills: fuzzing-and-content-discovery, parameter-mining│
│                                                             │
│  Phase 3: Deep Vulnerability Analysis                       │
│  ├── Automated: vulnerability-analysis (Nuclei)             │
│  ├── API & Auth: api-testing, authentication                │
│  └── Logic & Blind: business-logic-and-idor, oast-testing   │
│                                                             │
│  Phase 4: Browser-Driven Verification & WAF Evasion         │
│  ├── Browser MCP: Playwright/Puppeteer (DOM XSS, SPA, PoC)  │
│  └── Skill: waf-bypass-and-exploitation (Encoding & Headers)│
│                                                             │
│  Phase 5: "No PoC, No Finding" Verification & Reporting     │
│  ├── Skills: evidence-collection (poc.py / raw HTTP)        │
│  └── Skill: reporting (HackerOne/Bugcrowd markdown format)  │
└─────────────────────────────────────────────────────────────┘

Step-by-Step Execution Plan

1. Target Ingestion & Reconnaissance

• Take the operator's specified target directly and initiate reconnaissance:

  mkdir -p /workspace/recon/<target> /workspace/output/<target> /workspace/reports/<target>
  

• If source code or repository access is provided, run source-code-audit first to map internal routes and sensitive logic.

2. Attack Surface Profiling

• Static & SPA Discovery: Combine katana crawling with Browser MCP for client-side rendered apps.
• JavaScript & Secret Mining: Execute js-recon-secret-hunting against all extracted .js bundles.

3. Vulnerability Hypothesis & Testing (OWASP Mapping)

• Broken Access Control & IDOR: Delegate to business-logic-and-idor (test cross-tenant UUIDs and numeric IDs).
• Injection (SQLi, Command, SSRF, SSTI): Combine parameter-mining with oast-blind-testing for blind interactions.
• Authentication & Session Flaws: Delegate to authentication (JWT manipulation, OAuth redirect poisoning).
• Client-Side Security (XSS / CSRF / CORS): Use Browser MCP (puppeteer_navigate, puppeteer_evaluate, puppeteer_screenshot) to verify DOM execution and capture browser proofs.

4. Deterministic Proof-of-Concept ("No PoC, No Finding")

• Apply waf-bypass-and-exploitation if encountering WAF filters (403/429) using harmless encoding and rate controls.
• Generate a self-contained reproduction script (poc.py) via evidence-collection.

5. Structured Bug Bounty Reporting

• Invoke reporting to format markdown reports in /workspace/reports/<target>/ with CVSS v3.1 scoring, remediation, and reproducible evidence.