# Pt Web Application Assessment

> Performs authorized web application and API penetration testing with focus on OWASP-style risks and business logic flaws. Use when assessing websites, web APIs, authentication flows, session handling, and input validation.

- **Type:** Skill
- **Install:** `agentstack add skill-santosomar-ethical-hacking-agent-skills-pt-web-application-assessment`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [santosomar](https://agentstack.voostack.com/s/santosomar)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [santosomar](https://github.com/santosomar)
- **Source:** https://github.com/santosomar/ethical-hacking-agent-skills/tree/main/skills/pt-web-application-assessment

## Install

```sh
agentstack add skill-santosomar-ethical-hacking-agent-skills-pt-web-application-assessment
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Web Application Assessment

## Authorized Use Only

Test only approved applications, domains, and endpoints. Respect rate limits and data handling constraints. Use non-destructive proofs and avoid unauthorized data extraction.

## Objectives

1. Identify exploitable weaknesses in web apps and APIs.
2. Validate authentication, authorization, session, and input controls.
3. Prioritize findings by exploitability and business impact.

## Workflow

1. Map attack surface:
   - Endpoints, parameters, methods, auth requirements, role boundaries
   - Hidden/admin routes, API schema, and third-party integrations
2. Test control families:
   - Authentication and session management
   - Authorization and access control (horizontal/vertical)
   - Input handling and output encoding
   - Business logic and workflow abuse
3. Validate high-impact classes:
   - Injection paths, XSS, access control failures, insecure object access
   - Sensitive data exposure, misconfiguration, weak secrets handling
4. Confirm exploitability:
   - Use constrained PoCs and reproducible steps
   - Document bypass conditions and security control failures
5. Produce remediation guidance:
   - Secure coding fixes plus operational controls
   - Regression test cases to prevent reintroduction

## Output Template

```markdown
# Web App Assessment Output

## Coverage
- Application/API in scope:
- Roles tested:
- Key workflows:

## Findings
- Finding:
  - Endpoint/feature:
  - Preconditions:
  - Evidence:
  - Impact:
  - Fix recommendation:
  - Regression test idea:

## Attack Path Summary
- Initial condition:
- Exploit chain:
- Business consequence:
```

## Quality Checks

- Findings include exact endpoint/workflow context.
- PoCs remain non-destructive and reproducible.
- Recommendations include both code and configuration controls.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [santosomar](https://github.com/santosomar)
- **Source:** [santosomar/ethical-hacking-agent-skills](https://github.com/santosomar/ethical-hacking-agent-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-santosomar-ethical-hacking-agent-skills-pt-web-application-assessment
- Seller: https://agentstack.voostack.com/s/santosomar
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.