Common Dast ToolingCAUTION

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: common-dast-tooling
description: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.
metadata:
  triggers:
    keywords:
    - DAST
    - dynamic scan
    - zap
    - nuclei
    - nikto
    - curl probe
    - pentest
    - dynamic analysis
    - sqlmap
    - ffuf
    - mobile proxy
---
# DAST Tooling Standard

## **Priority: P1 (HIGH)**

## Always-Apply Rules

- **No Scanning Production**: Never run DAST tools against live production environments. Use local or staging replicas only.
- **No Uncapped Scans**: Always set `max-depth` or `max-duration` to avoid infinite loops on dynamic routes.
- **No Anonymous Probing**: Use authenticated headers (`Authorization`) to test protected surfaces, not public ones.
- **No Mobile on Real Devices in Prod**: Use emulators/simulators for mobile interception testing.

## 1. Backend / API Tools

### Scanner Tools
See [implementation guide](references/implementation.md) for setup commands.

- **Nuclei**: Fast, template-based CVE/misconfiguration scanning.
- **ZAP-CLI**: Deep spidering for SQLi, XSS, CSRF, session issues.
- **Nikto**: Server configuration audit (version disclosure, headers).
- **sqlmap**: Automated SQL injection detection and exploitation (suggest only — human confirms).
- **ffuf / feroxbuster**: Content discovery and endpoint fuzzing.

### API-Specific Probing
- **GraphQL**: Introspection query, nested query depth attack, field suggestion enumeration.
- **gRPC**: `grpcurl` for service enumeration and method probing.
- **WebSocket**: Connection hijacking, message injection testing.

## 2. Frontend / Web Tools

- **Browser DevTools**: Network tab for auth token leakage, console for client-side errors.
- **Playwright/Puppeteer** (suggested): Automated DOM XSS detection, form submission, CSRF testing.
- **Lighthouse**: Security/performance audit (CSP, HTTPS, mixed content).
- **CSP Evaluator**: Validate Content-Security-Policy headers.

## 3. Mobile Interception Tools

- **mitmproxy / Burp Suite**: Proxy mobile traffic for API inspection.
- **Frida**: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass.
- **adb / xcrun simctl**: Device-level inspection, deep link testing, storage extraction.
- **Objection**: Mobile runtime exploration (iOS/Android).

## 4. AI-Driven `curl` Probing (Manual Fallback)

When automated tools unavailable, generate targeted `curl` probes:

- **Bypassing Guards**: Probe with manipulated headers (`X-Forwarded-For`, `X-Custom-Auth`).
- **Data Leakage**: Request `/metrics`, `/health`, `.git`, `/.env`, `/api-docs`.
- **Parameter Tampering**: Modify payload types (String→Object), inject large payloads.
- **JWT Manipulation**: Test with expired token, no token, modified claims.

See [implementation guide](references/implementation.md) for all commands.

## Scoring Impact

| Finding | Severity | Deduction |
|---|---|---|
| Unauthenticated access to private data | P0 | -25 |
| Successful SQLi/RCE via probe | P0 | -20 |
| Mobile API interception (no cert pin) | P1 | -15 |
| DOM XSS confirmed via browser | P1 | -10 |
| Info Leakage (Server versions/Env vars) | P1 | -10 |
| Missing security headers (CSP/HSTS) | P2 | -5 |

## Anti-Patterns

- **No relying solely on static analysis**: Pentesting MUST include dynamic execution feedback.
- **No ignoring non-web protocols**: Check Docker ports, SSH banners, gRPC/RMQ listeners.
- **No skipping mobile**: If mobile app exists, proxy its traffic and inspect API calls.

## References

- [DAST Tooling Implementation](references/implementation.md)
- [OWASP Dynamic Scanning Guide](https://owasp.org/www-community/Vulnerability_Scanning)

CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (4)

- **Frida**: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass.

curl "http://api.app/fetch?url=http://169.254.169.254/latest/meta-data/"

curl "http://api.app/fetch?url=http://127.0.0.1:6379"

curl "http://api.app/fetch?url=http://169.254.169.254/latest/meta-data/"

Gates applied: instruction_override, no_behavioural_pass.