Web Attack Methods
Gives an agent a reference of web-app attack techniques (injection, auth bypass, WAF/CDN bypass) for security testing.
- Repository
- AIPentest/CyberStrikeAI
- Stars
- 8,323
- Licence
- Apache-2.0
- Files
- 1 file
What it does
This is a cheat sheet that teaches an AI agent a broad set of web attack techniques, written mostly in Chinese with some English terms. It covers injection flaws (SQL, command, template, XSS, SSRF, NoSQL), authentication and authorization bypasses (JWT, OAuth, SAML, IDOR), server-side issues (file inclusion, file upload), and ways to get around CDNs and web application firewalls. When installed, the agent can answer questions about these techniques and suggest concrete payloads and commands while helping with a penetration test.
Great for
- Authorized penetration testers and red teams who want a quick reference of web attack methods
- Security students studying how web vulnerabilities and bypasses work
- Security teams reviewing which classes of bypass their own web apps should defend against
Skip it if
- Testing any website or system you do not own or have explicit written permission to test, since the techniques are offensive and unauthorized use may be illegal
- Beginners looking for safe, defensive guidance, because the file is written as an attacker playbook with exploit steps and no mitigation advice
- Automated scanning of production systems without a scoped plan, because some steps (such as sqlmap with high risk and level settings, or OS shell upload) can damage data or availability
Try asking
- “Explain how a JWT alg none attack works and what a tester should check for on an authorized target”
- “Give me a checklist of 401/403 bypass techniques to try against an admin path in my approved test scope”
- “Walk me through testing an OAuth redirect_uri for weaknesses in my own staging app”
- “How do I tell whether a CDN 502 is URL-pattern filtering or a backend failure during an authorized assessment?”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
web-attack-methods.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip web-attack-methods.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip web-attack-methods.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- State your authorization and target scope up front so the agent frames its answers around an approved engagement
- Ask for the reasoning behind a technique and how to verify it, rather than only raw payloads, to get more usable results
- Pair this with a defensive reference or your own test notes so findings can be turned into remediation advice
What's inside
- SKILL.md
Redistributed unmodified from AIPentest/CyberStrikeAI under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.