hoangnguyen0403/common-dast-tooling
skills/common/common-dast-tooling/SKILL.md
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.
$ install --global
skillsauthnpx skillsauth add hoangnguyen0403/agent-skills-standard common-dast-toolingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 15, 2026, 3:22 AM144.7s3 files scanned
SKILL.md
- name:
- common-dast-tooling
- description:
- Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.
DAST Tooling Standard
Priority: P1 (HIGH)
Always-Apply Rules
- No Scanning Production: Never run DAST tools against live production environments. Use local or staging replicas only.
- No Uncapped Scans: Always set
max-depthormax-durationto avoid infinite loops on dynamic routes. - No Anonymous Probing: Use authenticated headers (
Authorization) to test protected surfaces, not public ones. - No Mobile on Real Devices in Prod: Use emulators/simulators for mobile interception testing.
1. Backend / API Tools
Scanner Tools
See implementation guide for setup commands.
- Nuclei: Fast, template-based CVE/misconfiguration scanning.
- ZAP-CLI: Deep spidering for SQLi, XSS, CSRF, session issues.
- Nikto: Server configuration audit (version disclosure, headers).
- sqlmap: Automated SQL injection detection and exploitation (suggest only — human confirms).
- ffuf / feroxbuster: Content discovery and endpoint fuzzing.
API-Specific Probing
- GraphQL: Introspection query, nested query depth attack, field suggestion enumeration.
- gRPC:
grpcurlfor service enumeration and method probing. - WebSocket: Connection hijacking, message injection testing.
2. Frontend / Web Tools
- Browser DevTools: Network tab for auth token leakage, console for client-side errors.
- Playwright/Puppeteer (suggested): Automated DOM XSS detection, form submission, CSRF testing.
- Lighthouse: Security/performance audit (CSP, HTTPS, mixed content).
- CSP Evaluator: Validate Content-Security-Policy headers.
3. Mobile Interception Tools
- mitmproxy / Burp Suite: Proxy mobile traffic for API inspection.
- Frida: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass.
- adb / xcrun simctl: Device-level inspection, deep link testing, storage extraction.
- Objection: Mobile runtime exploration (iOS/Android).
4. AI-Driven curl Probing (Manual Fallback)
When automated tools unavailable, generate targeted curl probes:
- Bypassing Guards: Probe with manipulated headers (
X-Forwarded-For,X-Custom-Auth). - Data Leakage: Request
/metrics,/health,.git,/.env,/api-docs. - Parameter Tampering: Modify payload types (String→Object), inject large payloads.
- JWT Manipulation: Test with expired token, no token, modified claims.
See implementation guide for all commands.
Scoring Impact
| Finding | Severity | Deduction | |---|---|---| | Unauthenticated access to private data | P0 | -25 | | Successful SQLi/RCE via probe | P0 | -20 | | Mobile API interception (no cert pin) | P1 | -15 | | DOM XSS confirmed via browser | P1 | -10 | | Info Leakage (Server versions/Env vars) | P1 | -10 | | Missing security headers (CSP/HSTS) | P2 | -5 |
Anti-Patterns
- No relying solely on static analysis: Pentesting MUST include dynamic execution feedback.
- No ignoring non-web protocols: Check Docker ports, SSH banners, gRPC/RMQ listeners.
- No skipping mobile: If mobile app exists, proxy its traffic and inspect API calls.
References
- DAST Tooling Implementation
- OWASP Dynamic Scanning Guide
Related Skills
hoangnguyen0403/common-operator-profile
testing
VerifiedTrustedCommunity
Infer the requesting operator's technical fluency from message content (never ask directly) and adapt register — business, hybrid, or technical — across SDLC workflow output. Use when starting sdlc, brainstorm-feature, plan-feature, verify-work, publish-notes, or session-report, or whenever a request's phrasing signals a non-technical or cross-stack operator.
524SKILL.mdUpdated Jul 12, 2026
hoangnguyen0403/database-transactions
documentation
VerifiedTrustedCommunity
Define transaction boundaries, locking, and consistency guarantees for multi-step writes. Use when designing atomic operations, retries, idempotency, or concurrent write behavior.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-schema-design
development
VerifiedTrustedCommunity
Design relational or document schemas from access patterns, cardinality, and lifecycle. Use when modeling entities, choosing embed vs normalize, or shaping schema boundaries before implementation.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-query-performance
data-ai
VerifiedTrustedCommunity
Diagnose database latency with explain plans, index ownership, and query-shape review. Use when a query is slow, an index is missing, or scans and N+1 patterns appear.
524SKILL.mdUpdated Jun 19, 2026