# Web Pentest

> Master orchestrator skill for end-to-end authorized web application penetration testing, mapping OWASP Top 10 vulnerabilities, coordinating specialized sub-skills, source code auditing, browser automation, and deterministic PoC reporting.

- Skill: `zyrexnn/web-pentest` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zyrexnn/web-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zyrexnn/web-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zyrexnn (https://skillmd.com/u/zyrexnn)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zyrexnn/web-pentest

---


# Web Pentest — Master Methodology & Orchestration Skill

## Purpose
Acts as the central coordinator for comprehensive web penetration testing assessments against authorized targets, aligning testing steps with the **OWASP Web Security Testing Guide (WSTG)**, Strix autonomous testing lifecycle, and standard bug bounty methodologies.

## Core Phases & Sub-Skill Delegations

```text
┌─────────────────────────────────────────────────────────────┐
│                   Web Pentest Workflow                      │
│                                                             │
│  Phase 1: Target Ingestion & Source Review (if available)   │
│  ├── Skills: recon, web-enumeration, js-recon-secret-hunting │
│  └── Whitebox: source-code-audit (Local repos / Git)        │
│                                                             │
│  Phase 2: Endpoint Fuzzing & Parameter Discovery            │
│  └── Skills: fuzzing-and-content-discovery, parameter-mining│
│                                                             │
│  Phase 3: Deep Vulnerability Analysis                       │
│  ├── Automated: vulnerability-analysis (Nuclei)             │
│  ├── API & Auth: api-testing, authentication                │
│  └── Logic & Blind: business-logic-and-idor, oast-testing   │
│                                                             │
│  Phase 4: Browser-Driven Verification & WAF Evasion         │
│  ├── Browser MCP: Playwright/Puppeteer (DOM XSS, SPA, PoC)  │
│  └── Skill: waf-bypass-and-exploitation (Encoding & Headers)│
│                                                             │
│  Phase 5: "No PoC, No Finding" Verification & Reporting     │
│  ├── Skills: evidence-collection (poc.py / raw HTTP)        │
│  └── Skill: reporting (HackerOne/Bugcrowd markdown format)  │
└─────────────────────────────────────────────────────────────┘
```

## Step-by-Step Execution Plan

### 1. Target Ingestion & Reconnaissance
- Take the operator's specified target directly and initiate reconnaissance:
  ```bash
  mkdir -p /workspace/recon/<target> /workspace/output/<target> /workspace/reports/<target>
  ```
- If source code or repository access is provided, run `source-code-audit` first to map internal routes and sensitive logic.

### 2. Attack Surface Profiling
- **Static & SPA Discovery**: Combine `katana` crawling with Browser MCP for client-side rendered apps.
- **JavaScript & Secret Mining**: Execute `js-recon-secret-hunting` against all extracted `.js` bundles.

### 3. Vulnerability Hypothesis & Testing (OWASP Mapping)
- **Broken Access Control & IDOR**: Delegate to `business-logic-and-idor` (test cross-tenant UUIDs and numeric IDs).
- **Injection (SQLi, Command, SSRF, SSTI)**: Combine `parameter-mining` with `oast-blind-testing` for blind interactions.
- **Authentication & Session Flaws**: Delegate to `authentication` (JWT manipulation, OAuth redirect poisoning).
- **Client-Side Security (XSS / CSRF / CORS)**: Use Browser MCP (`puppeteer_navigate`, `puppeteer_evaluate`, `puppeteer_screenshot`) to verify DOM execution and capture browser proofs.

### 4. Deterministic Proof-of-Concept ("No PoC, No Finding")
- Apply `waf-bypass-and-exploitation` if encountering WAF filters (403/429) using harmless encoding and rate controls.
- Generate a self-contained reproduction script (`poc.py`) via `evidence-collection`.

### 5. Structured Bug Bounty Reporting
- Invoke `reporting` to format markdown reports in `/workspace/reports/<target>/` with CVSS v3.1 scoring, remediation, and reproducible evidence.