Web Pentest

When you need to find ways into a web app, this covers the full attack surface. SQL injection with WAF bypasses, XSS in different contexts, SSRF for cloud metadata access, command injection with filter evasion, JWT attacks, GraphQL introspection, IDOR enumeration, and business logic flaws like negative quantities. The advanced section gets into HTTP request smuggling (CL.TE, TE.CL, H2.CL variants) and web cache poisoning techniques that most guides skip. It's comprehensive enough that you won't need to context switch between multiple references during an assessment. The payloads are copy-paste ready but assume you understand what you're doing and have authorization.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill web-pentest --agent claude-code

Installs into .claude/skills of the current project.

Files

Web Application Penetration Testing

When to Activate

Web application security assessment (black/grey/white box)
API security testing (REST, GraphQL, WebSocket)
Authentication & session management testing (JWT, OAuth/OIDC, SAML)
Business-logic and race-condition hunting
WAF/CSP bypass, filter evasion, and CDN-layer attacks (desync, cache)
Validating modern 2024-2026 vectors: HTTP/1.1 desync (0.CL/TE.0), SSRF->cloud metadata, prototype-pollution->RCE, SSTI sandbox escapes