Web App Pentest skill for Codex

Done well, a web app test covers the WSTG categories systematically, confirms each issue with a minimal reproduction, and ties it to a fix. Breadth matters: the bug that gets you is the category you skipped. Work only inside written scope.

Gate 0 — authorization

Confirm before any request leaves your machine: written authorization, exact in-scope hosts/paths, out-of-scope items, allowed techniques (active exploitation? account creation? automated scanning rate?), the testing window, and an emergency contact. If any is missing, stop and ask. For the full checklist and evidence/cleanup discipline, follow pentest-methodology. Most steps need network access; Codex’s sandbox may require approval for tool installs and outbound requests — call that out.

Setup

• Route traffic through an intercepting proxy for repeatable requests and evidence — Burp Suite or OWASP ZAP (see burp-suite-workflows for Burp specifics).
• Map the app first: crawl authenticated and unauthenticated, list every route, parameter, form, API call, file upload and redirect. Note roles (anon, user, admin, other tenant) and get at least two accounts per role for access-control testing.

WSTG checklist

Work category by category; tick each and record findings with request/response evidence.

- [ ] Information gathering — fingerprint stack, headers, comments, exposed files, /robots, maps
- [ ] Configuration — default creds, admin interfaces, HTTP methods, backup files, CORS
- [ ] Identity — user enumeration, weak registration, predictable accounts
- [ ] Authentication — brute-force/lockout, weak reset flow, creds over HTTP, "remember me", default creds
- [ ] Authorization — IDOR/BOLA, path traversal, privilege escalation, forced browsing, missing function-level checks
- [ ] Session management — cookie flags (HttpOnly/Secure/SameSite), fixation, logout/timeout, CSRF tokens
- [ ] Input validation — XSS (reflected/stored/DOM), SQLi, command/template injection, SSRF, open redirect, host-header
- [ ] Error handling — stack traces, verbose errors, differing responses leaking info
- [ ] Cryptography — TLS config, sensitive data over HTTP, weak tokens, padding issues
- [ ] Business logic — workflow bypass, price/quantity tampering, race conditions, replay
- [ ] Client-side — DOM XSS, postMessage, clickjacking, CSP, local storage of secrets

High-yield techniques

Access control is the richest category. With account A and account B of the same role, and an admin account:

• Take any request that references an object ID and replay it with B’s session against A’s object (BOLA/IDOR). Then as a low-priv user against an admin-only action.
• Remove or tamper the auth token/role claim and see if the request still succeeds.
• Force-browse admin paths and API routes that the UI hides.

Injection. For each input, test with a benign probe first, then confirm:

• XSS: reflect a unique marker; if unescaped, confirm with a harmless alert-equivalent in scope. Note stored vs reflected vs DOM.
• SQLi: compare responses to a syntactically-breaking vs balanced payload; confirm with a time-based or boolean oracle rather than dumping data (unless RoE allows).
• SSRF/open redirect/host-header: supply a controlled callback URL (within scope) and watch for the server-side request.

Business logic. Manipulate multi-step flows: skip a step, reuse a one-time token, submit negative/overflow quantities, change price fields the client sends, parallelize a single-use action to test for race conditions.

Confirming and recording

• Minimal proof: the smallest request that demonstrates the issue, captured as full request + response with a timestamp. Mask any PII/secrets in the capture.
• State the exploit in one sentence per finding. If you cannot, mark “needs verification”.
• Note false positives you ruled out (e.g. input reflected but correctly encoded).

Severity

CVSS-aligned: Critical (auth bypass, SQLi on prod path, unauth data exposure), High (BOLA across tenants, stored XSS, privilege escalation), Medium (reflected XSS, CSRF on state change), Low (missing header, verbose error).

Output contract

## Web app pentest — <app> (<window>)
Authorization: <ref>. Scope: <hosts/paths>. Proxy: <tool>.

### Coverage
<WSTG categories tested; any skipped and why>

### Findings
#### [High] BOLA — read other tenants' invoices
Request: `GET /api/invoices/8842` with user B's session returns user A's invoice.
Evidence: req/resp capture `b_bola_invoices.txt`.
Impact: cross-tenant data exposure.
Remediation: scope the query by the authenticated org; return 404 on mismatch.

### Cleanup: <accounts/data removed>

Hard rules

• No authorization or anything out of scope → stop. Never test hosts not listed.
• Prefer harmless proofs; no destructive payloads, mass data dumps or DoS unless the RoE explicitly permits. Keep automated scan rates within agreed limits.
• Remove test accounts, injected stored payloads and uploaded files; confirm removal.
• Escalate immediately if you encounter another tenant’s data or signs of a real breach.