web-exploitation

Web Exploitation — Offensive Kill Chain

Architecture

scripts/
├── common_web.sh      # Shared functions (logging, has_tool, phase_done, emit_summary)
└── web_exploit.sh     # PHASES 1-8: injection, XSS, file attacks, auth, logic, RCE

Each script:

• Accepts <TARGET_URL> <OUT> [RECON_OUT] as args
• RECON_OUT is the output directory from a prior web-recon run (optional but preferred)
• Uses checkpoints (.phase_X.done) to avoid repeating completed phases
• Emits a JSON summary via ---EXPLOIT_SUMMARY_JSON--- markers for Claude to parse

---

Initial Setup — Variables and Context

TARGET="https://target.com"          # base URL (with scheme)
DOMAIN="target.com"                  # bare domain

# If web-recon was run previously, point to its output:
RECON_OUT="$(pwd)/target"            # adjust to actual path; leave empty if no prior recon

PROJECT=$(echo "$DOMAIN" \
  | sed -E 's/\.(com\.br|org\.br|net\.br|gov\.br|com|org|net|io|br|co\.uk|co|uk|fr|de|jp|au|us|ca)$//' \
  | sed 's/\./-/g' | tr '[:upper:]' '[:lower:]')

OUT="$(pwd)/${PROJECT}-exploit"
SCRIPTS="$HOME/.claude/skills/web-exploitation/scripts"

mkdir -p "$OUT"/{sqli,xss,lfi,ssrf,xxe,upload,auth,logic,rce,findings}

Create progress tasks with TaskCreate:

"PHASE 1 — Recon Triage (load prior recon or gather baseline)"
"PHASE 2 — Injection Attacks (SQLi, NoSQLi, SSTI, LDAP)"
"PHASE 3 — XSS (Reflected, Stored, DOM)"
"PHASE 4 — File & Path Attacks (LFI, RFI, Upload Bypass)"
"PHASE 5 — Server-Side Attacks (SSRF, XXE, XSLT)"
"PHASE 6 — Authentication & Session Attacks (JWT, OAuth, Broken Auth)"
"PHASE 7 — Logic & Client-Side Attacks (IDOR, CSRF, Race Condition, Deserialization)"
"PHASE 8 — RCE Confirmation & Report"

Mark each task in_progress when starting, completed when done.

---

Tool Priority

1. CLI — always first

sqlmap              — automated SQL injection (use -m for URL list from recon)
dalfox              — XSS detection and exploitation
curl                — manual requests (always available as fallback)
ffuf                — parameter fuzzing, content discovery for exploitation
gf                  — filter URLs by vulnerability pattern (sqli, xss, lfi, ssrf, redirect)
qsreplace           — inject payloads into URL parameters
httpx (Go)          — probe response codes, headers for confirmation
nuclei              — targeted exploitation templates
jwt_tool            — JWT attacks (algorithm confusion, key injection, weak secret)