# Webapp Pentest Checklist

> Authorized self-pentest checklist for web applications you own. Walks the OWASP Web/API Top 10 against a locally-running target, discovering the base URL via env or entrypoint files (never hardcoded). Use when the user asks to "pentest", "attack", "probe", or "test the security of" their own running web app and the framework is unknown or mixed. For framework-specific deeper checks, use express/d…

- **Type:** Skill
- **Install:** `agentstack add skill-dolphinllc-claude-security-skills-webapp-pentest-checklist`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Dolphinllc](https://agentstack.voostack.com/s/dolphinllc)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Dolphinllc](https://github.com/Dolphinllc)
- **Source:** https://github.com/Dolphinllc/claude-security-skills/tree/main/skills/offensive/web/webapp-pentest-checklist

## Install

```sh
agentstack add skill-dolphinllc-claude-security-skills-webapp-pentest-checklist
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Web App Self-Pentest Checklist

Authorized, rate-limited probe of a web app running on the user's own machine. Follow the [shared probing conventions](../../../PROBING.md) for authorization, target discovery, and output schema.

## Procedure

1. **Authorization preflight.** Default to `localhost`/`127.0.0.1`. If a non-loopback host is named, require explicit user confirmation in chat.
2. **Discover base URL** per `PROBING.md` (env → entrypoint → ask). Record `target.base_url` and `target.discovered_via`.
3. **Confirm liveness.** `GET /` and `GET /healthz`/`/health` (if any). If unreachable, return `PREFLIGHT-BLOCKED`.
4. **Enumerate routes** from the app's source if you can read it; otherwise crawl from `/` to depth 2 (max 50 URLs) and stop.
5. **Run the rule pack below.** Stop at the first request budget hit (default 200 requests).

## Rules

| ID | Severity (if confirmed) | Probe | Confirmed when |
|----|-------------------------|-------|----------------|
| WEB-INFO-001 | low | Fetch `/.env`, `/.env.local`, `/.git/config`, `/.git/HEAD`, `/package.json`, `/composer.json` | Body is a non-404 file containing expected markers (`DB_`, `API_KEY`, `[core]`) |
| WEB-INFO-002 | medium | Fetch `/server-status`, `/.well-known/security.txt`, `/robots.txt`, `/sitemap.xml`, `/api-docs`, `/swagger`, `/openapi.json`, `/graphql` | Returns a populated body that exposes routes/internals |
| WEB-AUTH-001 | high | For each mutating route discovered, send the request with no auth header / cookie | 2xx response identical to authenticated response |
| WEB-AUTH-002 | high | Replay an authenticated request from user A's session against `/users/{B}/...` | 2xx instead of 403 = IDOR |
| WEB-AUTH-003 | medium | Send `Authorization: Bearer eyJhbGciOiJub25lIn0..` (alg=none JWT) | 2xx accepted = JWT alg confusion |
| WEB-XSS-001 | high | Submit `">` to each text input; render-back endpoints reflect it un-encoded | `<svg/onload` appears verbatim in HTML response (not entity-encoded) |
| WEB-SQLI-001 | high | Append `'` and `' OR '1'='1` to each numeric/string param; compare against baseline | Different status code OR DB error string in response |
| WEB-SSRF-001 | high | If app fetches URLs (preview, image proxy, webhook), submit `http://127.0.0.1:1`, `http://169.254.169.254/latest/meta-data/` | Connection succeeds / metadata returns |
| WEB-OR-001 | medium | Submit redirect param values like `//evil.test`, `https://evil.test` to login/return URLs | 30x with `Location:` outside same-origin |
| WEB-CORS-001 | high | Send `Origin: https://evil.test` with credentials to authenticated endpoint | `Access-Control-Allow-Origin` reflects origin AND `Allow-Credentials: true` |
| WEB-CSRF-001 | high | State-changing endpoint reachable via cross-origin form POST without CSRF token | 2xx on a request lacking the CSRF header/token |
| WEB-UPLOAD-001 | high | Upload file with double-extension `shell.php.jpg` / wrong MIME / SVG with embedded script | Stored and served with executable type / `Content-Type: image/svg+xml` rendered |
| WEB-MASS-001 | medium | Submit extra fields to update endpoints (`role: "admin"`, `is_staff: true`) | Field accepted and persisted = mass-assignment |
| WEB-ERR-001 | low | Trigger errors via `/?id[]=1`, malformed JSON, type confusion | Stack trace in 500 response = info disclosure |
| WEB-RATE-001 | medium | Send 10 rapid `POST /login` with random passwords | All accepted without 429 / lockout = no rate limiting |

## Workflow notes

- Reserve mutation probes (`WEB-MASS-001`, `WEB-UPLOAD-001`, `WEB-CSRF-001`) for endpoints clearly safe to write to (or skip if uncertain).
- For `WEB-AUTH-002` (IDOR), require the user to provide two test accounts; otherwise mark as `info: not-tested`.
- Render IDs from the running app's data, never inject random UUIDs that match nothing.

## Wrong-target safety

If the resolved `base_url` host is not in `{localhost, 127.0.0.1, ::1, *.localhost}` AND was not explicitly confirmed by the user this session — return a single `PREFLIGHT-BLOCKED` finding and stop.

## References

- OWASP Web Security Testing Guide: https://owasp.org/www-project-web-security-testing-guide/
- OWASP API Security Top 10: https://owasp.org/API-Security/
- PortSwigger Web Security Academy: https://portswigger.net/web-security

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Dolphinllc](https://github.com/Dolphinllc)
- **Source:** [Dolphinllc/claude-security-skills](https://github.com/Dolphinllc/claude-security-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-dolphinllc-claude-security-skills-webapp-pentest-checklist
- Seller: https://agentstack.voostack.com/s/dolphinllc
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.