Web Application Security Testing
Usage
/greyhatcc:webapp <URL>
Smart Input
{{ARGUMENTS}} is parsed automatically — just provide a target in any format:
URL (https://example.com/path ) → extracted domain + full URL used as target
Domain (example.com) → https:// prepended, used as target
IP (1.2.3.4) → used directly for infrastructure testing
H1 URL (hackerone.com/program) → program handle extracted, scope loaded via H1 API
Empty → error: "Usage: /greyhatcc:<skill> <target>"
No format specification needed from user — detect and proceed.
Context Loading (MANDATORY)
Before executing this skill:
Load scope: .greyhatcc/scope.json — verify target is in scope, note exclusions
Load hunt state: .greyhatcc/hunt-state.json — check active phase, resume context
Load program files: findings_log.md, tested.json, gadgets.json — avoid duplicating work
Load memory: Check MEMORY.md for target-specific notes from previous sessions
Testing Checklist
Quick Checks (delegate to webapp-tester-low)
OWASP Top 10 — Specific Test Cases (delegate to webapp-tester)
A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection
SQL injection — error-based, UNION, blind boolean, blind time-based
NoSQL injection — MongoDB $gt, $regex, $where operators
Command injection — ;, |, &&, $(command), backticks
SSTI — {{7*7}}, ${7*7}, <%= 7*7 %> polyglot detection
LDAP injection — *, )(, wildcard expansion
XPath injection — ' or '1'='1
Header injection — CRLF %0d%0a in header values
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable Components
A07: Authentication Failures
A08: Data Integrity Failures
A09: Security Logging & Monitoring Failures
A10: Server-Side Request Forgery (SSRF)
Beyond OWASP — Advanced Tests (delegate to webapp-tester)
CORS misconfiguration — origin reflection, null origin, wildcard with credentials
JWT vulnerabilities — none alg, RS256-HS256 confusion, kid injection
GraphQL introspection, batching, alias abuse, field-level authz, nested DoS
HTTP request smuggling — CL.TE, TE.CL, H2.CL, HTTP/2 desync
Cache poisoning — unkeyed headers, web cache deception, path confusion
WebSocket hijacking — origin check bypass, CSWSH, message injection
API rate limiting bypass — header rotation, alias batching, IP rotation
Prototype pollution — server-side and client-side chains
Subdomain takeover — dangling CNAMEs found in recon (delegate to /greyhatcc:takeover)
Second-order vulnerabilities — stored payloads triggering in admin contexts
HTTP parameter pollution — duplicate params for WAF bypass and logic manipulation
Mass assignment — extra fields in JSON bodies (role, isAdmin, price)
Host header attacks — password reset poisoning, cache poisoning, routing bypass
Evidence Collection
For each finding, capture:
Full curl command (reproducible) — include program-required headers (e.g., X-HackerOne-Research: overtimedev)
HTTP response (relevant portion)
Impact demonstration
Save to evidence/ directory
Post-Testing Updates
After each test, update engagement state:
tested.json — mark endpoint + vuln class as tested with result
findings_log.md — add any confirmed findings
gadgets.json — add findings with chaining potential (provides/requires tags)
Run dedup-checker — before writing a report, verify finding isn't a duplicate
Run chain analysis — check if new finding chains with existing gadgets
Delegation
Quick security checks → webapp-tester-low (sonnet)
OWASP Top 10 + Advanced → webapp-tester (opus)
Always pass full context (scope, exclusions, existing findings, recon data) to agents via context-loader pattern
Agent Dispatch Protocol
When delegating to agents via Task(), ALWAYS:
Prepend worker preamble : "[WORKER] Execute directly. No sub-agents. Output ≤500 words. Save findings to disk. 3 failures = stop and report."
Set max_turns : haiku=10, sonnet=25, opus=40
Pass full context : scope, exclusions, existing findings, recon data
Route by complexity : Quick checks → haiku agents (-low). Standard work → sonnet agents. Deep analysis/exploitation → opus agents.
State Updates
After completing this skill:
Update tested.json — record what was tested (asset + vuln class)
Update gadgets.json — add any informational findings with provides/requires tags for chaining
Update findings_log.md — log any confirmed findings with severity
Update hunt-state.json if in active hunt — set lastActivity timestamp