WSTG Data Validation Testing
Test reflected/stored/DOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string
- License 许可
- AGPL-3.0
- 所属仓库
- 0xwi11iam/Suijin
- 最近更新
- 2026-11-14
- Stars
- ★ 24
- Forks
- 4
01 前言 Front Matter
- name
- WSTG Data Validation Testing
- tags
- [ "attack-sql-injection", "attack-prototype-pollution" ]
- author
- suijin-wstg-generator
- cwe_ids
- [ "CWE-79", "CWE-89", "CWE-90", "CWE-77", "CWE-134" ]
- version
- 1.0
- category
- exploitation
- chains_with
- [ "attack-sql-injection", "attack-prototype-pollution" ]
- description
- Test reflected/stored/DOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string
03 SKILL.md 正文
WSTG Data Validation Testing
Test reflected/stored/DOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string
Test Areas
- Test for Reflected XSS (all input vectors: URL params, HTTP headers, form fields)
- Test for Stored XSS (user input that renders for other users)
- Test for DOM-based XSS (client-side sink functions)
- Test for SQL Injection in all data entry points (classic, blind, time-based)
- Test for LDAP Injection (search filters, DN injection)
- Test for ORM Injection (HQL, JPQL, Criteria API)
- Test for OS Command Injection (metacharacters in system calls)
- Test for Format String Injection (%s, %n in user-controlled format strings)
- Test for incubated vulnerabilities (stored payloads that execute later)
- Test for HTTP Splitting/Smuggling (CRLF injection in headers)
Evidence Requirements
- Every finding must have a baseline/exploit diff (http_replay compare)
- 200 OK for both = NOT a vulnerability (no impact difference)
- Filter/blocking = signal to try variants, not a dead end
- Record confirmed findings with catalog_exploit
04 同仓库更多 Skills
WSTG Session Management Testing
Test session tokens for entropy, predictability, fixation, logout, timeout, cookie scope
WSTG Information Gathering
Systematic information gathering: search engine discovery, web server fingerprinting, review page content for info leaka
WSTG Identity & Authentication Testing
Test credential encryption in transit, authentication bypass, weak lockout, password reset, security question, multi-fac
WSTG Error Handling Testing
Test for stack traces, verbose errors, CWE search, improper error handling
WSTG Cryptography Testing
Test for weak SSL/TLS, padding oracle, weak encryption, clear-text transmission
WSTG Configuration & Deployment Management Testing
Test network infrastructure config, application platform config, file handling, admin interfaces, HTTP methods, RIA cros