What problem does it solve? Security analysts and developers often lack a structured, repeatable process for manually assessing web application vulnerabilities without relying on automated scanners like Nessus or OpenVAS. This Skill provides a step-by-step, six-phase methodology for identifying common web vulnerabilities in a controlled, authorized manner. ## Core Features & Use Cases - Six-Phase Assessment Workflow: Covers fingerprinting, configuration and information leakage checks, injection testing (SQL/NoSQL/Command), XSS detection, authentication and session review, and access control testing (IDOR, privilege escalation). - Advanced Checks: Includes SSL/TLS configuration review, endpoint fuzzing, CORS misconfiguration, open redirect, and file inclusion (LFI/RFI) testing. - Structured Reporting: Produces a prioritized findings report with executive summary, severity ratings (Critical/High/Medium/Low), and remediation recommendations. - Use Case: A penetration tester with written authorization assesses a client's web app by following the guided phases, testing login forms for SQL injection, checking cookie flags, and attempting IDOR on user ID parameters, then delivers a formatted vulnerability report. ## Quick Start Ask the agent to perform a web application vulnerability assessment on an authorized target URL and walk you through each phase step by step.
