skills-ws/skills/security-pentester/references/1-vulnerability-coverage.md

87 agent skills for AI coding assistants — marketing, growth, web3, dev, design & operations. Built for OpenClaw, Claude Code, Cursor, and Codex.

## Contents

- 1. Vulnerability Coverage
- OWASP Top 10 Testing Matrix
- OWASP Web Security Testing Guide (WSTG) Coverage

## 1. Vulnerability Coverage

### OWASP Top 10 Testing Matrix

| Category | What Shannon Tests | Techniques |
|----------|-------------------|------------|
| **SQL Injection** | Union-based, blind (boolean/time), error-based, second-order | Payload fuzzing, source-guided parameter discovery |
| **Command Injection** | OS command injection via user input | Backtick, pipe, semicolon, `$()` injection patterns |
| **XSS** | Reflected, stored, DOM-based | Context-aware payload generation, filter bypass |
| **SSRF** | Internal network access, cloud metadata | `http://169.254.169.254`, internal service probing |
| **Broken Authentication** | Credential stuffing, session fixation, JWT attacks | Brute force, token manipulation, 2FA bypass — **rate-limit & isolate, see §8** |
| **Broken Authorization** | IDOR, privilege escalation, role bypass | Horizontal/vertical access control testing |

> The high-volume auth tests above (brute force, credential stuffing, 2FA enumeration) and the SSRF metadata probes are **noisy and side-effecting**: they can lock real accounts, blow rate budgets, trigger SMS/email/billing, and page on-call. Do not run them against any environment without the safe-test controls in **§8 — Safe Testing Practices**.

### OWASP Web Security Testing Guide (WSTG) Coverage

```
WSTG-INFO  — Information Gathering            ✓ Automated
WSTG-CONF  — Configuration Management         ✓ Automated
WSTG-IDNT  — Identity Management              ✓ Automated
WSTG-ATHN  — Authentication Testing           ✓ Automated
WSTG-ATHZ  — Authorization Testing            ✓ Automated
WSTG-SESS  — Session Management               ✓ Automated
WSTG-INPV  — Input Validation                 ✓ Automated
WSTG-ERRH  — Error Handling                   ✓ Automated
WSTG-CRYP  — Cryptography                     ◐ Partial (TLS config, weak hashing)
WSTG-BUSN  — Business Logic                   ✗ Manual (no automated tool reliably models domain rules — see §7)
WSTG-CLNT  — Client-Side Testing              ✓ Automated (DOM XSS, open redirects)
WSTG-APIS  — API Testing                      ✓ Automated (REST, limited GraphQL)
```

---