playbook-webapp
Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement.
git clone --depth 1 https://github.com/s0ld13rr/pentestcode /tmp/playbook-webapp && cp -r /tmp/playbook-webapp/skills/playbooks/webapp ~/.claude/skills/playbook-webappSKILL.md
# Web App Pentest — methodology + skill router
This is the ORDER of operations and the map to the deep skills. Each vuln CLASS has a dedicated `web-<class>` skill with exact payloads + detect→exploit→PROVE — load the one matching the surface; don't test from this index.
## 1. Recon + active scan FIRST
Fingerprint stack+version (whatweb/httpx, headers), CMS (wpscan/etc.), APIs (/swagger, /graphql, /.well-known). Then a content-matched `nuclei -u <t>` pass BEFORE exhaustive dir-fuzz (framework-runtime RCEs don't appear as routes) → `nuclei_parse`. Version + a known CVE → fetch & vet a public PoC (shared exploitation methodology).
## 2. Map (hidden surface, AFTER the scan)
`ffuf`/`gobuster` (→ `gobuster_parse`), vhosts (`ffuf -H Host:FUZZ`), params (`arjun`), auth endpoints (login/register/reset/OAuth), API routes. Review client-side JS for endpoints/secrets.
## 3. Test by class → load the matching skill
| Signal / surface | Load |
|---|---|
| param → DB query, SQL error/differential | **web-sqli** |
| input renders in a server template ({{7*7}}) | **web-ssti** |
| server fetches a URL you control (webhook/proxy/import) | **web-ssrf** |
| file param / download / `../` reflection | **web-lfi-traversal** |
| file upload sink | **web-upload-rce** |
| XML/SOAP/SAML/DOCX/SVG parsing | **web-xxe** |
| serialized blob (rO0/O:/VIEWSTATE/pickle) | **web-deserialization** |
| object IDs, roles, JWT, admin funcs | **web-auth-bypass-idor** |
| known framework+version CVE | shared exploitation methodology + searchsploit/nuclei |
Also-check (no dedicated skill yet): XSS (`dalfox`, `xss_detect`), command injection (`;id`/`$(id)`), CSRF, CORS/security-headers, crypto/secrets-in-JS, business-logic/race conditions.
## 4. PROVE + Report
A finding is `suspected` until you reproduce concrete impact (dumped canary row / `id` / file bytes / cloud creds / cross-user data) — then `add_vuln` `confirmed` with the evidence. Never mark a host resolved/"safe" without a completed active scan. Report: reproduction steps + request/response evidence + CVSS + OWASP-WSTG mapping.Work with Effect v4 / effect-smol TypeScript code in this repo
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.
Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULN_ASSESS.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.