[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M79TY5ARBHTT3DA0Z33GX32T":3,"skill-same:01M79TY5ARBHTT3DA0Z33GX32T":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":40,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":43,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M79TY5ARBHTT3DA0Z33GX32T","WSTG Data Validation Testing",null,"Test reflected\u002Fstored\u002FDOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string","0xwi11iam\u002FSuijin","0xwi11iam","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F209588302?v=4","01M79TJ12BMH55AZF1B12GWK42","William Jiang","01M79TJ130WSYMC9XRHSET2TRD",24,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-data-validation\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: WSTG Data Validation Testing\ndescription: \"Test reflected\u002Fstored\u002FDOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string\"\ncategory: \"exploitation\"\nversion: \"1.0\"\nauthor: \"suijin-wstg-generator\"\ntags:\n  - attack-sql-injection\n  - attack-prototype-pollution\ncwe_ids:\n  - CWE-79\n  - CWE-89\n  - CWE-90\n  - CWE-77\n  - CWE-134\nchains_with:\n  - attack-sql-injection\n  - attack-prototype-pollution\n---\n\n# WSTG Data Validation Testing\n\nTest reflected\u002Fstored\u002FDOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string\n\n## Test Areas\n\n1. Test for Reflected XSS (all input vectors: URL params, HTTP headers, form fields)\n2. Test for Stored XSS (user input that renders for other users)\n3. Test for DOM-based XSS (client-side sink functions)\n4. Test for SQL Injection in all data entry points (classic, blind, time-based)\n5. Test for LDAP Injection (search filters, DN injection)\n6. Test for ORM Injection (HQL, JPQL, Criteria API)\n7. Test for OS Command Injection (metacharacters in system calls)\n8. Test for Format String Injection (%s, %n in user-controlled format strings)\n9. Test for incubated vulnerabilities (stored payloads that execute later)\n10. Test for HTTP Splitting\u002FSmuggling (CRLF injection in headers)\n\n## Evidence Requirements\n- Every finding must have a baseline\u002Fexploit diff (http_replay compare)\n- 200 OK for both = NOT a vulnerability (no impact difference)\n- Filter\u002Fblocking = signal to try variants, not a dead end\n- Record confirmed findings with catalog_exploit\n","# WSTG Data Validation Testing\n\nTest reflected\u002Fstored\u002FDOM XSS, SQL injection, LDAP injection, ORM injection, command injection, format string\n\n## Test Areas\n\n1. Test for Reflected XSS (all input vectors: URL params, HTTP headers, form fields)\n2. Test for Stored XSS (user input that renders for other users)\n3. Test for DOM-based XSS (client-side sink functions)\n4. Test for SQL Injection in all data entry points (classic, blind, time-based)\n5. Test for LDAP Injection (search filters, DN injection)\n6. Test for ORM Injection (HQL, JPQL, Criteria API)\n7. Test for OS Command Injection (metacharacters in system calls)\n8. Test for Format String Injection (%s, %n in user-controlled format strings)\n9. Test for incubated vulnerabilities (stored payloads that execute later)\n10. Test for HTTP Splitting\u002FSmuggling (CRLF injection in headers)\n\n## Evidence Requirements\n- Every finding must have a baseline\u002Fexploit diff (http_replay compare)\n- 200 OK for both = NOT a vulnerability (no impact difference)\n- Filter\u002Fblocking = signal to try variants, not a dead end\n- Record confirmed findings with catalog_exploit\n",{"name":5,"tags":24,"author":27,"cwe_ids":28,"version":34,"category":35,"chains_with":36,"description":7},[25,26],"attack-sql-injection","attack-prototype-pollution","suijin-wstg-generator",[29,30,31,32,33],"CWE-79","CWE-89","CWE-90","CWE-77","CWE-134","1.0","exploitation",[25,26],"main","aad9c80e194eaa5df87f75b0c2d21353dd03bfe8","suijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-data-validation",4,"https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin","https:\u002F\u002Fgithub.com\u002F0xwi11iam","0xwi11iam.vercel.app","Nothing good in life comes free.","2026-11-14 21:30:06",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add 0xwi11iam\u002FSuijin --skill \"WSTG Data Validation Testing\"",{"tool":52,"command":53},"bunx","bunx skills add 0xwi11iam\u002FSuijin --skill \"WSTG Data Validation Testing\"",{"tool":55,"command":56},"pnpm","pnpm dlx skills add 0xwi11iam\u002FSuijin --skill \"WSTG Data Validation Testing\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-data-validation\u002FSKILL.md",true,[],[61,68,75,82,89,96],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":19},"01M79TYP6NA2P0T637YQBVRMTW","WSTG Session Management Testing","Test session tokens for entropy, predictability, fixation, logout, timeout, cookie scope","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-session-mgmt\u002FSKILL.md",[],[],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M79TYJSQ3D6013V73Y0Y0XP5","WSTG Information Gathering","Systematic information gathering: search engine discovery, web server fingerprinting, review page content for info leaka","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-info-gathering\u002FSKILL.md",[],[],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M79TYCAC17VNZYDNECPM0JQ6","WSTG Identity & Authentication Testing","Test credential encryption in transit, authentication bypass, weak lockout, password reset, security question, multi-fac","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-identity-auth\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M79TY9RWTNY08VR1BQDAZHZZ","WSTG Error Handling Testing","Test for stack traces, verbose errors, CWE search, improper error handling","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-error-handling\u002FSKILL.md",[],[],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M79TY2PCE6KNDXZXEE3J1D76","WSTG Cryptography Testing","Test for weak SSL\u002FTLS, padding oracle, weak encryption, clear-text transmission","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-cryptography\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M79TXZGCQYNN2GKFZWY9JN9Y","WSTG Configuration & Deployment Management Testing","Test network infrastructure config, application platform config, file handling, admin interfaces, HTTP methods, RIA cros","https:\u002F\u002Fgithub.com\u002F0xwi11iam\u002FSuijin\u002Fblob\u002Fmain\u002Fsuijin\u002Fserver\u002Fagent\u002Flib\u002Fskills\u002Fwstg-config-deployment\u002FSKILL.md",[],[]]