Web Pentesting Payload Arsenal

★ 8.2 · security

security-arsenal supplies Claude Code with ready-to-use payloads, bypass tables, wordlists, and submission rules for web application security testing. It covers XSS (basic probes, cookie theft, CSP bypass, DOM sources and sinks), SSRF (AWS/GCP/Azure metadata endpoints, internal service fingerprinting, IP-filter evasion), SQL injection (detection, union-based, blind time-based, WAF bypass), XXE, NoSQLi, command injection, SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, and MFA bypass. A conditionally-valid-with-chain table and an always-rejected findings list help decide what is and isn't worth submitting in bug bounty programs. The skill is built for manual penetration testing, report preparation, and assessing exploitability of discovered vulnerabilities.