Individual skill

web-security-advanced

0upvotes

Web高级安全测试 — 注入攻击族、协议安全、认证与逻辑漏洞、文件与部署安全、现代Web攻击面，含完整Playbook

deepsec/spear/skills/specialized/web-security-advanced/SKILL.md

Read pinned source

Source commit fff031fc01fb36b95348214c8ee359f6ede8aa8b

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 511
Repository last updated: Aug 24, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent Repository topic
ai Repository topic
ai-agents Repository topic
aisecurity Repository topic
cybersecurity Repository topic
plugin Repository topic
security Repository topic
vscode Repository topic
vulnerability Repository topic
hacker Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 3,831 bytes
references/web-ai-attack-map.mddoc · 562 bytes
references/web-deployment-security.mddoc · 15,331 bytes
references/web-file-infra.mddoc · 18,303 bytes
references/web-injection.mddoc · 26,581 bytes
references/web-logic-auth.mddoc · 16,770 bytes
references/web-modern-protocols.mddoc · 10,589 bytes
references/web-playbook-01-clickjacking.mddoc · 1,397 bytes
references/web-playbook-02-supply-chain-attacks.mddoc · 2,272 bytes
references/web-playbook-03-cache-and-cdn-security.mddoc · 1,565 bytes
references/web-playbook-04-open-redirect.mddoc · 1,554 bytes
references/web-playbook-05-framework-vulnerabilities.mddoc · 8,298 bytes
references/web-playbook-06-request-smuggling.mddoc · 2,277 bytes
references/web-playbook-07-authentication-vulnerabilities.mddoc · 4,441 bytes
references/web-playbook-08-file-vulnerabilities.mddoc · 4,322 bytes
references/web-playbook-09-business-logic-vulnerabilities.mddoc · 3,552 bytes
references/web-playbook-10-prototype-pollution.mddoc · 2,341 bytes
references/web-playbook-11-cloud-security-vulnerabilities.mddoc · 2,962 bytes
references/web-playbook-12-ai-security.mddoc · 3,212 bytes
references/web-playbook-13-api-security.mddoc · 5,524 bytes
references/web-playbook-14-csrf-cross-site-request-forgery.mddoc · 3,796 bytes
references/web-playbook-15-jwt-security.mddoc · 2,893 bytes
references/web-playbook-16-lfi-rfi-file-inclusion.mddoc · 5,495 bytes
references/web-playbook-17-rce-remote-code-execution.mddoc · 5,426 bytes
references/web-playbook-18-sql-nosql-injection.mddoc · 7,944 bytes
references/web-playbook-19-ssrf-server-side-request-forgery.mddoc · 5,531 bytes
references/web-playbook-20-ssti-template-injection.mddoc · 4,815 bytes
references/web-playbook-21-websocket-security.mddoc · 2,420 bytes
references/web-playbook-22-xss-cross-site-scripting.mddoc · 5,342 bytes
references/web-playbook-23-xxe-entity-injection.mddoc · 3,683 bytes
references/web-playbook-24-php-regex-bypass.mddoc · 3,561 bytes
references/web-playbook-index.mddoc · 1,517 bytes
references/web-security-playbook-openai.yamlasset · 296 bytes
references/web-security-playbook-skill.mddoc · 3,735 bytes

Read excerpt


# Web 高级安全测试 Skill

当目标是 Web 应用、API、网关或浏览器面向服务，且需要系统性的漏洞测试时使用本 Skill。

**前置条件**：如果请求仍由客户端控制且重放未稳定，先使用 `client-reverse` Skill。

## CTF 场景路由

> 当目标为 CTF 题目（已知有 flag，需要绕过特定过滤）时，优先使用 `ctf-web` Skill 获取具体绕过值和 payload：

| CTF 场景 | 路由到 ctf-web | 参考文档 |
|---------|---------------|---------|
| PHP 弱比较/类型绕过 | `ctf-web` | `references/php-bypass-cheatsheet.md` |
| 命令注入空格绕过 | `ctf-web` | `references/command-injection-bypass.md` |