web-assessment

Web Vulnerability Assessment

Systematic identification and exploitation of web application vulnerabilities. This skill provides structured workflows for every major web vulnerability class, routing you to the correct Hexstrike MCP tools and Kali tooling with proper parameters. Stop guessing at payloads and tool flags -- use the right tool for the right vuln class.

Why Structured Web Assessment Matters

Web applications are the primary attack surface in most engagements. A single SQLi grants database access. An SSRF leaks cloud credentials. An SSTI yields RCE. Structured testing ensures you cover every class systematically instead of ad-hoc fuzzing. Every finding feeds the findings-tracker and chain-detector for automatic exploit chain discovery.

Triage and Prioritization

Before testing anything, determine what you are dealing with. Target type dictates testing priority.

Priority Matrix by Target Type

| Target Type | Test First | Test Second | Test Third | |-------------|-----------|-------------|------------| | PHP app | SQLi, LFI/RFI, SSTI (Twig), RCE, file upload | XSS, IDOR, auth bypass | SSRF, XXE | | Java/Spring | SQLi, SSTI (Freemarker/Velocity), XXE, deserialization | SSRF, IDOR, auth bypass | XSS, NoSQLi | | Node.js/Express | NoSQLi, SSTI (Pug/EJS), prototype pollution, RCE | SSRF, IDOR, auth bypass | XSS, SQLi | | Python/Django/Flask | SSTI (Jinja2), SQLi, RCE, SSRF | IDOR, auth bypass | XSS, XXE | | Ruby on Rails | SQLi, SSTI (ERB), deserialization, mass assignment | SSRF, IDOR, auth bypass | XSS, XXE | | API-only (REST) | IDOR/BOLA, auth bypass, SQLi/NoSQLi, mass assignment | SSRF, rate limit bypass | injection via headers | | API-only (GraphQL) | Introspection, query depth abuse, batching attacks | IDOR, auth bypass, injection | DoS via nested queries | | WordPress | See waf-bypass + wordpress-hacking skills | SQLi via plugins, file upload | XSS, SSRF | | Cloud-hosted | SSRF (IMDS), config leaks, auth bypass | SQLi/NoSQLi, IDOR | RCE, XSS |

Quick Stack Fingerprinting

Before deep testing, identify the stack:

# Broad fingerprinting with nuclei
nuclei_scan target="https://target.com" templates="technologies/" severity="info"

# Check response headers for framework hints
# X-Powered-By, Server, X-AspNet-Version, X-Generator, Set-Cookie names

Log stack information as target intel:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" tech-stack framework "Laravel 10" --source "response-headers"
node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" defense waf "Cloudflare" --source "wafw00f"

Testing Workflow

Follow this workflow for each target. Steps are ordered for maximum efficiency -- early findings inform later tests.

Step 1 — Reconnaissance and Surface Mapping

Map the attack surface before testing individual vuln classes.

# Discover parameters and endpoints
ffuf -u "https://target.com/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -o recon.json

# Parameter discovery on known endpoints
paramspider -d target.com

# Technology detection
nuclei_scan target="https://target.com" templates="technologies/" severity="info"

If behind a WAF, detect it first:

wafw00f_scan target="https://target.com"

Log defenses:

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" defense waf "Cloudflare" --source "wafw00f"

Step 2 — Broad Vulnerability Scanning

Run automated scanners across all vuln classes to find low-hanging fruit.

# Nuclei with critical/high templates
nuclei_scan target="https://target.com" severity="critical,high,medium"

# Jaeles signature-based scanning
jaeles_vulnerability_scan target="https://target.com"

# AI-powered vulnerability assessment
ai_vulnerability_assessment target="https://target.com"

Load Hexstrike tools first:

ToolSearch → "+hexstrike nuclei" or "select:mcp__hexstrike-ai__nuclei_scan"
ToolSearch → "+hexstrike sqlmap" or "select:mcp__hexstrike-ai__sqlmap_scan"
ToolSearch → "+hexstrike dalfox" or "select:mcp__hexstrike-ai__dalfox_xss_scan"

Step 3 — Targeted Vulnerability Testing

Based on scanner results and stack fingerprinting, test each relevant vuln class. Use the decision tree below to route to the correct reference.

Step 4 — Chain Detection

After logging findings, run chain detection to discover multi-step exploit paths:

node ${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js

The chain detector matches finding combinations into exploit chains. For example: SSRF + cloud metadata → credential theft, or SQLi + file write → RCE.

Step 5 — Exploitation and Proof

For confirmed vulns, build proof-of-concept exploits. Document impact clearly for the report.

Vulnerability Class Decision Tree

Use this to pick the right testing approach for each class. Each class has a dedicated reference document.

Injection Vulnerabilities

| Class | Primary Tool | Reference | Vuln Type | Quick Indicator | |-------|-------------|-----------|-----------|-----------------| | SQL Injection | sqlmap_scan | references/sqli-testing.md | sqli | Error messages with SQL syntax, different responses for ' OR 1=1-- vs ' OR 1=2-- | | XSS | dalfox_xss_scan | references/xss-testing.md | xss | Input reflected in response HTML without encoding | | SSTI | ai_generate_payload | references/ssti-testing.md | ssti | {{7*7}} returns 49 in response | | XXE | http_repeater | references/xxe-testing.md | xxe | XML content type accepted, DTD processing enabled | | NoSQL Injection | http_intruder | references/nosqli-testing.md | nosqli | MongoDB-style parameters, JSON body injection | | Command Injection | ai_generate_payload | references/rce-testing.md | cmdi | Time delay with sleep or ping, DNS callback | | RCE | varies | references/rce-testing.md | rce | Direct code execution via any vector |

Access Control Vulnerabilities

| Class | Primary Tool | Reference | Vuln Type | Quick Indicator | |-------|-------------|-----------|-----------|-----------------| | IDOR | http_repeater | references/idor-testing.md | idor | Sequential/guessable IDs in URLs or request bodies | | Auth Bypass | http_repeater | references/auth-testing.md | auth-bypass | Missing auth checks on endpoints, JWT manipulation |

Server-Side Vulnerabilities

| Class | Primary Tool | Reference | Vuln Type | Quick Indicator | |-------|-------------|-----------|-----------|-----------------| | SSRF | http_repeater | references/ssrf-testing.md | ssrf | URL parameters, redirect/callback fields, file import | | LFI/RFI | dotdotpwn_scan | references/ssrf-testing.md | lfi/rfi | File path parameters, include functions, wrapper protocols |

Tool Routing

Hexstrike MCP Tools

| Tool | Best For | Load With | |------|----------|-----------| | sqlmap_scan | SQL injection detection + exploitation | select:mcp__hexstrike-ai__sqlmap_scan | | dalfox_xss_scan | XSS scanning with DOM analysis + WAF bypass | select:mcp__hexstrike-ai__dalfox_xss_scan | | xsser_scan | Focused XSS with encoding control | select:mcp__hexstrike-ai__xsser_scan | | nuclei_scan | Broad vuln scanning with templates | select:mcp__hexstrike-ai__nuclei_scan | | jaeles_vulnerability_scan | Signature-based web vuln scanning | select:mcp__hexstrike-ai__jaeles_vulnerability_scan | | dotdotpwn_scan | Path traversal / LFI scanning | select:mcp__hexstrike-ai__dotdotpwn_scan | | ai_generate_payload | Custom payload generation for any vuln type | select:mcp__hexstrike-ai__ai_generate_payload | | ai_vulnerability_assessment | AI-powered vulnerability assessment | select:mcp__hexstrike-ai__ai_vulnerability_assessment | | advanced_payload_generation | WAF-evasion-aware payloads | `select:mcp__hexstrike-ai__