tanweai/wooyun-legacy

Overview

This skill is a vulnerability analysis expert distilled from 88,636 real-world vulnerability cases. It encodes a meta-thinking methodology, pragmatic testing flows, bypass techniques, and defensive guidance across major classes like SQLi, XSS, command execution, file upload, logic flaws, and unauthorized access. The goal is to guide testers and auditors from reconnaissance to exploit chains and remediation priorities.

How this skill works

The skill inspects input sources, data flows, trust boundaries, processing logic, and output sinks to locate deviations between expected and actual behavior. It provides prioritized detection steps, payload patterns, common bypass techniques, and exploit chaining strategies for each vulnerability type. It also maps defensive controls to concrete fixes and suggests tooling and manual testing recipes for verification.

When to use it

• During blackbox or greybox penetration tests to prioritize high-risk findings
• When performing code review or security auditing to validate data flow and trust assumptions
• While triaging reported issues to reproduce, classify, and escalate impact
• During red-team engagements to build multi-stage exploit chains and bypass controls
• For training junior testers on how to think about attack surfaces and test methodology

Best practices

• Start with attack surface mapping: enumerate inputs, processing points, and outputs before fuzzing
• Follow a priority triage: validate high-risk issues (SQLi, RCE, file upload) first, then business logic and info leakage
• Always trace data flow end-to-end to understand where trust is incorrectly assumed
• Combine automated scanning with manual, context-aware tests and payload mutation
• Document proof-of-concept steps, impact scope, and precise remediation recommendations

Example use cases

• Discovering and exploiting a blind SQL injection by mapping parameters, fingerprinting the DB, and using time-based payloads
• Identifying an XSS vector in a reflected search field and crafting context-aware payloads to bypass filters
• Finding an insecure file upload that allows server-side code execution via content and extension bypasses
• Uncovering IDOR or authorization logic flaws by stateful workflow analysis and parameter tampering
• Detecting exposed management services (Redis, Elasticsearch) and demonstrating data access or remote command possibilities