Run an authorized black-box, gray-box, or white-box web security assessment and write a severity-rated report. Use when asked to pentest, attack, or security-test a site the user owns or authorized.
Installs into .claude/skills of the current project.
Are you the author of Web Pentest?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/twikus-web-pentest)
---
name: web-pentest
description: Run an authorized black-box, gray-box, or white-box web security assessment and write a severity-rated report. Use when asked to pentest, attack, or security-test a site the user owns or authorized.
argument-hint: "<url> [blackbox|graybox|whitebox]"
disable-model-invocation: true
user-invocable: true
---
Proceed only against a target the user owns or has explicitly authorized. If authorization is unclear, confirm and stop.
Parse `$ARGUMENTS` as `<target-url> [mode]`. Add `https://` if missing. Map `black`/`black box` → blackbox, `gray`/`grey`/`gray box` → graybox, `white`/`white box` → whitebox. Default mode is blackbox. Ask for a URL if none was given.
Mode access:
- blackbox — public surface only. Do not read source, config, `.env`, or the database.
- graybox — act as a registered user. Client-side JS and public API docs are allowed. Server source, config, secrets, and the database are not.
- whitebox — source may map the surface. Every finding still needs live HTTP or browser verification.
Use browser, DevTools, request replay, and direct HTTP only. Stay non-destructive: no deletes, DoS, mass account creation, or mail to third parties. A PoC stops at proof.
Create the run directory first:
```bash
RUN_DIR=$(~/.claude/skills/web-pentest/scripts/workdir.sh new "<target-url>")
```
Write `notes.md`, `report.md`, and every artifact under `$RUN_DIR`. `workdir.sh last|host "<url>"` locates a prior run or the sanitized host.
For registration, verification, reset, or magic-link flows, use `scripts/agentmail.sh` with `SLUG=$(.../workdir.sh host "<url>")`: `addr`, `wait`, `links`, `otp`, `list`. Requires `AGENTMAIL_API_KEY`.
Work the phases in order. Open `references/attack-playbook.md` when Phase 2 starts and consult it per phase. Do not invent attack steps here.
1. Reconnaissance
2. Authentication and session
3. Privilege escalation and access control
4. Input and injection
5. Business logic
6. Live verification of every finding
Cannot reproduce → `UNVERIFIED`. Write `$RUN_DIR/report.md` with executive summary, severity-rated findings (status, location, description, PoC evidence, impact, fix), attack-surface map, and out of scope. Stop there.
