wstg-web-pentest – Security skill for AI agents

WSTG Web Application Pentest

Full OWASP WSTG-aligned testing methodology. Each phase maps to a WSTG

category and provides concrete commands, expected outputs, pitfalls, and

verification criteria.

The 12 phases:

1.  Information Gathering           WSTG-INFO
2.  Configuration & Deployment       WSTG-CONF
3.  Identity Management              WSTG-IDNT
4.  Authentication                   WSTG-ATHN
5.  Authorization                    WSTG-ATHZ
6.  Session Management               WSTG-SESS
7.  Input Validation                 WSTG-INPV
8.  Error Handling                   WSTG-ERRH
9.  Weak Cryptography                WSTG-CRYP
10. Business Logic                   WSTG-BUSL
11. Client-side                      WSTG-CLNT
12. API Testing                      WSTG-APIT

Classify every observation:

| State | Meaning |

|---|---|

| Signal | Observation justifies follow-up |

| Exposed | Service or behavior reachable in tested context |

| Vulnerable | Security property failed under controlled test |

| Exploitable | Controlled test demonstrated concrete impact |

---

When to Use

• Starting a web application pentest with a defined scope
• Auditing a web application against the OWASP testing standard
• Building a test plan from observed technology and behavior
• When the engagement requires methodology documentation
• Converting automated scanner output into validated findings

Prerequisites

• In-scope domains, IPs, APIs, and test accounts
• Exclusions, rate limits, test windows, and abort conditions
• Permitted actions: passive, active read-only, intrusive, destructive
• Tools installed: curl, subfinder, dnsx, httpx, katana, nuclei,

nmap, ffuf, jq, python3, openssl, tlsx, wappalyzer or whatweb

• Browser with intercepting proxy configured for authenticated testing
• Test accounts for two distinct identities (for authorization testing)

---

How to Run

TARGET="example.com"
OUTPUT_DIR="${OUTPUT_DIR:-./output}/${TARGET}"
mkdir -p "$OUTPUT_DIR"/{assets,http,urls,evidence,reports}

# Run phases sequentially, stopping at scope boundaries:
# 1. INFO  -> 2. CONF -> 3. IDNT -> 4. ATHN -> 5. ATHZ ->
# 6. SESS -> 7. INPV -> 8. ERRH -> 9. CRYP -> 10. BUSL ->
# 11. CLNT -> 12. APIT -> Report

---

Procedure

Phase 1: Information Gathering (WSTG-INFO-01 through INFO-10)

Map the attack surface before testing.

1.1 Search Engine Discovery (WSTG-INFO-01)

# Google dorks (manual in browser)
site:${TARGET}
site:${TARGET} filetype:pdf
site:${TARGET} inurl:admin
site:${TARGET} intitle:"index of"

# GitHub code search
gh search code "example.com" --limit 100 2>/dev/null

Pitfalls: Search results include third-party references. Verify ownership

before treating a result as in-scope.

1.2 Fingerprint Web Server (WSTG-INFO-02)

curl -sS -D - --max-time 10 "https://${TARGET}/" -o /dev/null 2>&1 \
  | grep -iE 'server|x-powered-by|x-aspnet-version|x-generator'

whatweb --max-redirects 2 --no-errors "https://${TARGET}" 2>/dev/null

Expected output: Server header, technology stack hints.

Pitfalls: Headers can be suppressed or spoofed by reverse proxies.

Cross-reference with response behavior and error pages.

Verification: At least two independent signals agree on the technology.

1.3 Review Metafiles (WSTG-INFO-03)

for path in robots.txt sitemap.xml security.txt .well-known/security.txt; do
  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
    "https://${TARGET}/${path}" 2>/dev/null)
  printf '%-30s %s\n' "$path" "$code"
done

Pitfalls: Disallowed paths in robots.txt are hints, not hidden secrets.

sitemap.xml sometimes lists admin or staging endpoints.

1.4 Attack Surface Discovery (WSTG-INFO-04)

subfinder -d "$TARGET" -silent | tee "$OUTPUT_DIR/assets/hostnames.txt"

curl -sS --max-time 30 \
  "https://crt.sh/?q=%.${TARGET}&output=json" 2>/dev/null \
  | jq -r '.[].name_value' 2>/dev/null \
  | sed 's/^\*\.//' | sort -u \
  >> "$OUTPUT_DIR/assets/hostnames.txt"

sort -u "$OUTPUT_DIR/assets/hostnames.txt" -o "$OUTPUT_DIR/assets/hostnames.txt"

Pitfalls: Wildcard entries are patterns, not hosts. Third-party names

appear in SANs. Classify scope and ownership before probing.

1.5 Resolve and Probe (WSTG-INFO-04 continued)

dnsx -l "$OUTPUT_DIR/assets/hostnames.txt" -silent -a -json \
  -o "$OUTPUT_DIR/assets/dns.jsonl"

httpx -l "$OUTPUT_DIR/assets/hostnames.txt" \
  -silent -rate-limit 2 \
  -status-code -title -tech-detect -server -ip -cname -json \
  -o "$OUTPUT_DIR/http/services.jsonl"

# Live URLs only
jq -r '.url // empty' "$OUTPUT_DIR/http/services.jsonl" | sort -u \
  > "$OUTPUT_DIR/http/live-urls.txt"

1.6 Review Page Content (WSTG-INFO-05)

while IFS= read -r url; do
  curl -sS --max-time 10 "$url" 2>/dev/null \
    | grep -oPi '(email|password|secret|key|token|api[_-]?key|authorization|bearer)[^a-z0-9]*[=:]\s*["\x27]?[^\s"'\''<>&]+' \
    | head -5
  sleep 1
done < "$OUTPUT_DIR/http/live-urls.txt"

Pitfalls: Comments, inline scripts, and HTML data attributes frequently

contain false leads. Confirm in context before reporting.

1.7 Identify Entry Points (WSTG-INFO-06)

katana -list "$OUTPUT_DIR/http/live-urls.txt" \
  -silent -jc -c 2 -p 2 -rl 2 \
  -o "$OUTPUT_DIR/urls/katana.txt"

# Historical URLs
echo "$TARGET" | waybackurls 2>/dev/null > "$OUTPUT_DIR/urls/wayback.txt"
gau "$TARGET" --subs 2>/dev/null > "$OUTPUT_DIR/urls/gau.txt"

# Merge and classify
cat "$OUTPUT_DIR/urls/katana.txt" \
    "$OUTPUT_DIR/urls/wayback.txt" \
    "$OUTPUT_DIR/urls/gau.txt" \
  | sort -u > "$OUTPUT_DIR/urls/all.txt"

grep -iE '/api/|/graphql|/rest/|swagger|openapi|/v[0-9]+/' \
  "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/api-candidates.txt"

grep -iE 'login|logout|register|reset|oauth|saml|callback|session|token|mfa|2fa' \
  "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/auth-candidates.txt"

grep -iE '\.js(\?.*)?$' \
  "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/javascript.txt"

grep -E '[?&][a-zA-Z0-9_.-]+=' \
  "$OUTPUT_DIR/urls/all.txt" > "$OUTPUT_DIR/urls/parameterized.txt"

1.8 Fingerprint Framework (WSTG-INFO-08)

httpx -l "$OUTPUT_DIR/http/live-urls.txt" \
  -silent -tech-detect -json \
  | jq -r '[.url, (.tech // [] | join(","))] | @tsv' \
  > "$OUTPUT_DIR/http/frameworks.tsv"

Verification: Confirm framework fingerprint with at least two signals: a

header, a cookie name (e.g. laravel_session, JSESSIONID), a path pattern

(/wp-content/, /_next/), or a unique error page.

1.9 Map Application Architecture (WSTG-INFO-10)

# TLS inspection
tlsx -l "$OUTPUT_DIR/http/live-urls.txt" -silent -san -nc -json \
  -o "$OUTPUT_DIR/assets/tls.jsonl"

# Port scan (when in-scope IPs are provided)
nmap -sT --top-ports 100 --open -T3 \
  -oA "$OUTPUT_DIR/assets/nmap-top100" \
  -iL in-scope-ips.txt 2>/dev/null

Pitfalls: Port scanning is active and detectable. Run only on in-scope IPs

and with conservative timing.

---

Phase 2: Configuration and Deployment (WSTG-CONF-01 through CONF-14)

Test infrastructure and platform configuration.

2.1 Network Infrastructure (WSTG-CONF-01)

# Check for common admin panels
for path in admin administrator admin.php admin.aspx console manager \
  phpmyadmin pma phppgadmin webmin cpanel:2082 whm:2086; do
  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
    "https://${TARGET}/${path}" 2>/dev/null)
  [ "$code" != "404" ] && printf '%-25s %s\n' "$path" "$code"
  sleep 1
done

2.2 Application Platform Configuration (WSTG-CONF-02)

# Common config files
for path in .env .env.local .env.production .env.development \
  config.json config.yml config.yaml settings.py wp-config.php \
  web.config .htaccess Dockerfile docker-compose.yml; do
  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
    "https://${TARGET}/${path}" 2>/dev/null)
  [ "$code" = "200" ] && echo "[!] EXPOSED: $path (HTTP $code)"
  sleep 1
done

Pitfalls: A 200 response with a generic shell or redirect is not a config

leak. Always inspect the body.

Verification: Body contains configuration keys, database credentials,

API keys, or environment variables.

2.3 File Extensions (WSTG-CONF-03)

# Check how the server handles backup and alternate extensions
for ext in bak old backup orig save swp tmp ~; do
  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
    "https://${TARGET}/index.html.${ext}" 2>/dev/null)
  [ "$code" != "404" ] && echo "[*] index.html.${ext}: $code"
  sleep 1
done

2.4 Backup and Unreferenced Files (WSTG-CONF-04)

ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-small-words.txt \
  -u "https://${TARGET}/FUZZ" \
  -e .bak,.old,.backup,.zip,.tar.gz,.sql,.tgz \
  -mc 200,301,302,403 \
  -rate 5 -t 5 \
  -o "$OUTPUT_DIR/evidence/ffuf-backup.json" 2>/dev/nul

… (full content is in the download package)