# web-app-penetration-testing

> Claude/Codex skill by [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars · Updated 2026-10-15

Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.

Tags: agents, ai-hacking, ai-penetration-testing, ai-pentesting, ai-security, artificial-intelligence, bug-bounty, code-quality, ctf-tools, cybersecurity, cybersecurity-tools, ethical-hacking, hacking, llm-security, offensive-security, penetration-testing, pentesting-tools, red-teaming, security, security-automation

## Install

```sh
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/web-app-penetration-testing ~/.claude/skills/web-app-penetration-testing
```

## From README

Pentest a web application Black-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage. , LLM , all CLI flags, and the managed-cloud alternative are covered in the penetration-testing-with-strix skill — read it if the target is not a running web app, or if strix --version fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix). This skill is the web-app-specific workflow. Confirm authorization and scope Before running anything, establish: The target is the user's (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch. Which environment. Prefer staging over production; agents send real exploit payloads and will create/modify data.

## Links

- HTML page: https://omgskills.com/skills/usestrix/strix/web-app-penetration-testing/
- GitHub: https://github.com/usestrix/strix
- Author: [@usestrix](https://omgskills.com/library/usestrix/index.md)

## More from this repo

- [api-security-testing](https://omgskills.com/skills/usestrix/strix/api-security-testing/index.md) — Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 72k stars
- [application-security-testing](https://omgskills.com/skills/usestrix/strix/application-security-testing/index.md) — Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars
- [ci-security-scanning-with-strix](https://omgskills.com/skills/usestrix/strix/ci-security-scanning-with-strix/index.md) — Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars