Agent-Skills.md

Agent Skills: DAST Tooling Standard

Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.

UncategorizedID: hoangnguyen0403/agent-skills-standard/common-dast-tooling

Repository

hoangnguyen0403/agent-skills-standard
HoangNguyen0403License: MIT
567164

Install this agent skill to your local

pnpm dlx add-skill https://github.com/HoangNguyen0403/agent-skills-standard/tree/HEAD/.codex/skills/common/common-dast-tooling

Skill Files

Browse the full folder contents for common-dast-tooling.

Download Skill

Loading file tree…

.codex/skills/common/common-dast-tooling/SKILL.md

Skill Metadata

Name
common-dast-tooling
Description
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.

DAST Tooling Standard

Priority: P1 (HIGH)

Always-Apply Rules

  • No Scanning Production: Never run DAST tools against live production environments. Use local or staging replicas only.
  • No Uncapped Scans: Always set max-depth or max-duration to avoid infinite loops on dynamic routes.
  • No Anonymous Probing: Use authenticated headers (Authorization) to test protected surfaces, not public ones.
  • No Mobile on Real Devices in Prod: Use emulators/simulators for mobile interception testing.
  • Authorization & Finite Bounds ([DAST-AUTH-01]): Dynamic scanning requires explicit target authorization, finite runtime/payload caps, and cancellation. Missing authorization or bounds BLOCKS dependent active execution (status: BLOCKED); offline planning continues; agents cannot self-authorize.

1. Backend / API Tools

Scanner Tools

See implementation guide for setup commands.

  • Nuclei: Fast, template-based CVE/misconfiguration scanning.
  • ZAP-CLI: Deep spidering for SQLi, XSS, CSRF, session issues.
  • Nikto: Server configuration audit (version disclosure, headers).
  • sqlmap: Automated SQL injection detection and exploitation (suggest only — human confirms).
  • ffuf / feroxbuster: Content discovery and parameter enumeration; does not replace structured robustness/fuzz testing (see quality-engineering-api-fuzz-testing).

API-Specific Probing

  • GraphQL: Introspection query, nested query depth attack, field suggestion enumeration.
  • gRPC: grpcurl for service enumeration and method probing.
  • WebSocket: Connection hijacking, message injection testing.

2. Frontend / Web Tools

  • Browser DevTools: Network tab for auth token leakage, console for client-side errors.
  • Playwright/Puppeteer (suggested): Automated DOM XSS detection, form submission, CSRF testing.
  • Lighthouse: Security/performance audit (CSP, HTTPS, mixed content).
  • CSP Evaluator: Validate Content-Security-Policy headers.

3. Mobile Interception Tools

  • mitmproxy / Burp Suite: Proxy mobile traffic for API inspection.
  • Frida: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass.
  • adb / xcrun simctl: Device-level inspection, deep link testing, storage extraction.
  • Objection: Mobile runtime exploration (iOS/Android).

4. AI-Driven curl Probing (Manual Fallback)

When automated tools unavailable, generate targeted curl probes:

  • Bypassing Guards: Probe with manipulated headers (X-Forwarded-For, X-Custom-Auth).
  • Data Leakage: Request /metrics, /health, .git, /.env, /api-docs.
  • Parameter Tampering: Modify payload types (String→Object), inject large payloads.
  • JWT Manipulation: Test with expired token, no token, modified claims.

See implementation guide for all commands.

Scoring Impact

| Finding | Severity | Deduction | |---|---|---| | Unauthenticated access to private data | P0 | -25 | | Successful SQLi/RCE via probe | P0 | -20 | | Mobile API interception (no cert pin) | P1 | -15 | | DOM XSS confirmed via browser | P1 | -10 | | Info Leakage (Server versions/Env vars) | P1 | -10 | | Missing security headers (CSP/HSTS) | P2 | -5 |

Anti-Patterns

  • No relying solely on static analysis: Pentesting MUST include dynamic execution feedback.
  • No equating content discovery with fuzz testing: Wordlist path bruteforce discovers surface names; structured fuzzing validates schema invariants, state transitions, and hang resistance under malformed inputs.
  • No self-authorization: If authorization or runtime bounds are absent, stop active execution and mark BLOCKED.
  • No ignoring non-web protocols: Check Docker ports, SSH banners, gRPC/RMQ listeners.
  • No skipping mobile: If mobile app exists, proxy its traffic and inspect API calls.

References