Skill: liubo2025code/web-security-pentest-skill-complete (version 1.0.0)

# Web Security Penetration Testing Skill ## Overview A comprehensive web security penetration testing skill for OpenClaw agents. This skill provides automated tools and techniques for identifying, exploiting, and reporting web application vulnerabilities. ## Features ### 1. **Reconnaissance & Discovery** - Subdomain enumeration - Port scanning - Technology fingerprinting - Directory and file discovery ### 2. **Vulnerability Scanning** - Automated vulnerability scanning - Common web vulnerabilities detection - API security testing - Authentication bypass testing ### 3. **Exploitation Tools** - SQL injection testing - XSS (Cross-Site Scripting) testing - Command injection testing - File inclusion testing ### 4. **Reporting & Analysis** - Automated report generation - Risk assessment - Remediation recommendations - Compliance checking ## Prerequisites ### Required Tools - **nmap** - Network discovery and security auditing - **nikto** - Web server scanner - **sqlmap** - SQL injection tool - **gobuster/dirbuster** - Directory/file brute force - **subfinder/amass** - Subdomain enumeration - **whatweb** - Web technology fingerprinting - **curl/wget** - HTTP client tools ### Python Libraries - **requests** - HTTP requests - **beautifulsoup4** - HTML parsing - **scapy** - Packet manipulation - **colorama** - Colored terminal output ## Installation ### 1. Install Required Tools ```bash # Debian/Ubuntu sudo apt update sudo apt install -y nmap nikto sqlmap gobuster subfinder whatweb curl wget # macOS brew install nmap nikto sqlmap gobuster subfinder whatweb curl wget # Python libraries pip install requests beautifulsoup4 scapy colorama ``` ### 2. Install Skill ```bash # Clone or copy the skill to your OpenClaw skills directory cp -r web-security-pentest-skill ~/.openclaw/skills/ ``` ## Usage ### Basic Usage ```bash # Run full penetration test python scripts/full_pentest.py --target https://example.com # Run specific test python scripts/sql_injection_test.py --url https://example.com/login # Generate report python scripts/report_generator.py --input scan_results.json --output report.html ``` ### Command Line Interface ```bash # Help menu python scripts/web_pentest.py --help # Scan single target python scripts/web_pentest.py --target https://example.com --scan-type full # Scan multiple targets python scripts/web_pentest.py --targets targets.txt --scan-type quick # Custom output python scripts/web_pentest.py --target https://example.com --output json --verbose ``` ## Scripts ### 1. **reconnaissance.py** - Subdomain enumeration - Port scanning - Technology detection - Directory brute forcing ### 2. **vulnerability_scanner.py** - Common vulnerability scanning - Security header checking - SSL/TLS configuration testing - API endpoint testing ### 3. **exploitation_tools.py** - SQL injection testing - XSS payload testing - Command injection testing - File upload testing ### 4. **report_generator.py** - HTML report generation - JSON/CSV export - Risk assessment - Remediation guidance ## Configuration ### Configuration File (`config.yaml`) ```yaml # Scanning configuration scanning: threads: 10 timeout: 30 user_agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" # Vulnerability detection vulnerabilities: sql_injection: true xss: true command_injection: true directory_traversal: true file_inclusion: true # Reporting reporting: format: html include_poc: true risk_level: medium compliance: [pci_dss, gdpr] # Target scope scope: include_subdomains: true max_depth: 3 excluded_paths: [/logout, /admin/delete] ``` ## Examples ### Example 1: Full Penetration Test ```python from scripts.web_pentest import WebPentest # Initialize scanner scanner = WebPentest(target="https://example.com") # Run reconnaissance scanner.reconnaissance() # Run vulnerability scan scanner.vulnerability_scan() # Test for specific vulnerabilities scanner.test_sql_injection() scanner.test_xss() scanner.test_command_injection() # Generate report scanner.generate_report(format="html", output="report.html") ``` ### Example 2: API Security Testing ```python from scripts.api_security_tester import APISecurityTester # Initialize API tester tester = APISecurityTester(api_url="https://api.example.com") # Test authentication tester.test_authentication() # Test authorization tester.test_authorization() # Test input validation tester.test_input_validation() # Test rate limiting tester.test_rate_limiting() # Generate API security report tester.generate_api_report() ``` ### Example 3: Custom Payload Testing ```python from scripts.payload_tester import PayloadTester # Initialize payload tester tester = PayloadTester(target_url="https://example.com/search") # Test SQL injection payloads sql_payloads = [ "' OR '1'='1", "'; DROP TABLE users; --", "1' AND SLEEP(5) --" ] tester.test_sql_payloads(sql_payloads) # Test XSS payloads xss_payloads = [ "<script>alert('XSS')</script>", "<img src=x onerror=alert('XSS')>", "<svg onload=alert('XSS')>" ] tester.test_xss_payloads(xss_payloads) # Test command injection payloads cmd_payloads = [ "; ls -la", "| cat /etc/passwd", "`id`" ] tester.test_command_payloads(cmd_payloads) ``` ## Vulnerability Database ### SQL Injection - Error-based SQLi - Union-based SQLi - Blind SQLi - Time-based SQLi - Out-of-band SQLi ### Cross-Site Scripting (XSS) - Reflected XSS - Stored XSS - DOM-based XSS - Blind XSS ### Command Injection - OS command injection - Code injection - Template injection - Expression language injection ### File Inclusion - Local File Inclusion (LFI) - Remote File Inclusion (RFI) - Directory traversal - Path traversal ### Authentication Bypass - SQL injection in login - Session fixation - Credential stuffing - Brute force attacks ### Authorization Issues - Insecure Direct Object References (IDOR) - Missing function level access control - Privilege escalation - Horizontal/vertical privilege escalation ## Risk Assessment ### Risk Levels #### Critical (9.0-10.0) - Remote code execution - SQL injection with data extraction - Authentication bypass - Privilege escalation to admin #### High (7.0-8.9) - Cross-site scripting (stored) - Directory traversal - File upload vulnerability - Information disclosure #### Medium (4.0-6.9) - Cross-site scripting (reflected) - CSRF (Cross-Site Request Forgery) - Insufficient session expiration - Security misconfiguration #### Low (0.1-3.9) - Clickjacking - Information leakage in headers - Missing security headers - Verbose error messages ## Compliance Standards ### PCI DSS (Payment Card Industry) - Requirement 6: Develop and maintain secure systems - Requirement 11: Regularly test security systems ### GDPR (General Data Protection Regulation) - Article 32: Security of processing - Data protection by design and by default ### OWASP Top 10 - A01: Broken Access Control - A02: Cryptographic Failures - A03: Injection - A04: Insecure Design - A05: Security Misconfiguration - A06: Vulnerable and Outdated Components - A07: Identification and Authentication Failures - A08: Software and Data Integrity Failures - A09: Security Logging and Monitoring Failures - A10: Server-Side Request Forgery ### ISO 27001 - A.12.6: Technical vulnerability management - A.14.2: Security in development and support processes ## Reporting ### Report Types #### Executive Summary - High-level overview - Business impact - Risk assessment - Recommendations #### Technical Report - Detailed findings - Proof of concept - Request/response details - Screenshots #### Developer Report - Vulnerability details - Code snippets - Fix recommendations - Testing methodology #### Compliance Report - Compliance status - Gap analysis - Remediation timeline - Evidence collection ### Report Templates #### HTML Report - Interactive dashboard - Searchable findings - Export functionality - Responsive design #### PDF Report - Professional formatting - Print-ready - Watermark support - Table of contents #### JSON Report - Machine-readable - Integration friendly - Version control friendly - Automated processing #### Markdown Report - GitHub/GitLab friendly - Version control friendly - Easy to edit - Lightweight ## Integration ### CI/CD Integration ```yaml # GitHub Actions name: Security Scan on: [push, pull_request] jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Run Security Scan run: | pip install -r requirements.txt python scripts/web_pentest.py --target ${{ secrets.TARGET_URL }} --scan-type quick ``` ### Slack Integration ```python from scripts.slack_notifier import SlackNotifier # Initialize Slack notifier slack = SlackNotifier(webhook_url="SLACK_WEBHOOK_URL") # Send scan results slack.send_scan_results(scan_results) # Send critical alerts slack.send_critical_alert(vulnerability) # Send daily summary slack.send_daily_summary() ``` ### Jira Integration ```python from scripts.jira_integration import JiraIntegration # Initialize Jira integration jira = JiraIntegration( url="JIRA_URL", username="JIRA_USERNAME", [REDACTED_SECRET]" ) # Create vulnerability ticket jira.create_vulnerability_ticket( project="SEC", summary="SQL Injection Vulnerability", description=vulnerability_details, priority="High" ) # Update ticket status jira.update_ticket_status(ticket_id="SEC-123", status="In Progress") ``` ## Best Practices ### Scanning Best Practices 1. **Get Authorization** - Always obtain written permission before testing 2. **Define Scope** - Clearly define what is in scope and out of scope 3. **Use Test Environment** - Test in staging/development environments first 4. **Schedule Tests** - Schedule tests during maintenance windows 5. **Monitor Impact** - Monitor system performance during tests ### Reporting Best Practices 1. **Clear Findings** - Clearly describe each finding 2. **Provide Evidence** - Include screenshots and proof of concept 3. **Risk Assessment** - Assess business impact and risk level 4. **Remediation Steps** - Provide clear remediation steps 5. **Follow-up** - Schedule follow-up verification ### Ethical Considerations 1. **Confidentiality** - Keep findings confidential 2. **Responsible Disclosure** - Follow responsible disclosure practices 3. **Data Protection** - Do not access or exfiltrate sensitive data 4. **Legal Compliance** - Comply with all applicable laws and regulations ## Troubleshooting ### Common Issues #### Issue 1: Connection Timeout ```bash # Increase timeout python scripts/web_pentest.py --target https://example.com --timeout 60 # Use proxy python scripts/web_pentest.py --target https://example.com --proxy http://proxy:8080 ``` #### Issue 2: Rate Limiting ```bash # Reduce threads python scripts/web_pentest.py --target https://example.com --threads 5 # Add delays python scripts/web_pentest.py --target https://example.com --delay 2 ``` #### Issue 3: False Positives ```bash # Tune detection python scripts/web_pentest.py --target https://example.com --confidence 0.8 # Exclude paths python scripts/web_pentest.py --target https://example.com --exclude /static/, /images/ ``` ### Debug Mode ```bash # Enable debug mode python scripts/web_pentest.py --target https://example.com --debug # Verbose output python scripts/web_pentest.py --target https://example.com --verbose # Log to file python scripts/web_pentest.py --target https://example.com --log-file scan.log ``` ## Updates and Maintenance ### Version History #### v1.0.0 (2024-01-01) - Initial release - Basic reconnaissance and scanning - SQL injection and XSS testing - HTML report generation #### v1.1.0 (2024-02-01) - Added API security testing - Enhanced reporting - CI/CD integration - Slack notifications #### v1.2.0 (2024-03-01) - Added compliance checking - Jira integration - Performance improvements - Bug fixes ### Contributing 1. Fork the repository 2. Create a feature branch 3. Make your changes 4. Add tests 5. Submit a pull request ### Support - **Documentation**: [docs.security-pentest.com](https://docs.security-pentest.com) - **Issues**: [GitHub Issues](https://github.com/security-pentest/issues) - **Community**: [Discord Community](https://discord.gg/security-pentest) - **Email**: [REDACTED_SECRET] ## License This skill is licensed under the MIT License. See LICENSE file for details. ## Disclaimer This tool is for educational and authorized testing purposes only. The developers are not responsible for any misuse or damage caused by this tool. Always obtain proper authorization before testing any system. --- **Author**: Security Research Team **Version**: 1.0.0 **Last Updated**: 2024-01-01 **Website**: https://security-pentest.com


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: suspicious | SkillSpector:  ()