Web Vulnerability Assessment

Systematic identification and exploitation of web application vulnerabilities. This skill provides structured workflows for every major web vulnerability class, routing you to the correct Hexstrike MCP tools and Kali tooling with proper parameters. Stop guessing at payloads and tool flags -- use the right tool for the right vuln class.

Why Structured Web Assessment Matters

Web applications are the primary attack surface in most engagements. A single SQLi grants database access. An SSRF leaks cloud credentials. An SSTI yields RCE. Structured testing ensures you cover every class systematically instead of ad-hoc fuzzing. Every finding feeds the findings-tracker and chain-detector for automatic exploit chain discovery.

Triage and Prioritization

Before testing anything, determine what you are dealing with. Target type dictates testing priority.

Priority Matrix by Target Type

Quick Stack Fingerprinting

Before deep testing, identify the stack:

# Broad fingerprinting with nuclei
nuclei_scan target="https://target.com" templates="technologies/" severity="info"

# Check response headers for framework hints
# X-Powered-By, Server, X-AspNet-Version, X-Generator, Set-Cookie names

Log stack information as target intel:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" tech-stack framework "Laravel 10" --source "response-headers"
node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" defense waf "Cloudflare" --source "wafw00f"

Testing Workflow

Follow this workflow for each target. Steps are ordered for maximum efficiency -- early findings inform later tests.

Step 1 — Reconnaissance and Surface Mapping

Map the attack surface before testing individual vuln classes.

# Discover parameters and endpoints
ffuf -u "https://target.com/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -o recon.json

# Parameter discovery on known endpoints
paramspider -d target.com

# Technology detection
nuclei_scan target="https://target.com" templates="technologies/" severity="info"

If behind a WAF, detect it first:

wafw00f_scan target="https://target.com"

Log defenses:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" defense waf "Cloudflare" --source "wafw00f"

Step 2 — Broad Vulnerability Scanning

Run automated scanners across all vuln classes to find low-hanging fruit.

# Nuclei with critical/high templates
nuclei_scan target="https://target.com" severity="critical,high,medium"

# Jaeles signature-based scanning
jaeles_vulnerability_scan target="https://target.com"

# AI-powered vulnerability assessment
ai_vulnerability_assessment target="https://target.com"

Load Hexstrike tools first:

ToolSearch → "+hexstrike nuclei" or "select:mcp__hexstrike-ai__nuclei_scan"
ToolSearch → "+hexstrike sqlmap" or "select:mcp__hexstrike-ai__sqlmap_scan"
ToolSearch → "+hexstrike dalfox" or "select:mcp__hexstrike-ai__dalfox_xss_scan"

Step 3 — Targeted Vulnerability Testing

Based on scanner results and stack fingerprinting, test each relevant vuln class. Use the decision tree below to route to the correct reference.

Step 4 — Chain Detection

After logging findings, run chain detection to discover multi-step exploit paths:

node ${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js

The chain detector matches finding combinations into exploit chains. For example: SSRF + cloud metadata → credential theft, or SQLi + file write → RCE.

Step 5 — Exploitation and Proof

For confirmed vulns, build proof-of-concept exploits. Document impact clearly for the report.

Vulnerability Class Decision Tree

Use this to pick the right testing approach for each class. Each class has a dedicated reference document.

Injection Vulnerabilities

Access Control Vulnerabilities

Server-Side Vulnerabilities

Tool Routing

Hexstrike MCP Tools