# Web App Penetration Testing

Pentest a web app or website end to end, black-box testing of a live URL, staging...

- Repository: https://github.com/usestrix/strix (73218 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add usestrix/strix --skill web-app-penetration-testing -g -a claude-code -y`
Codex: `npx skills add usestrix/strix --skill web-app-penetration-testing -g -a codex -y`
Cursor: `npx skills add usestrix/strix --skill web-app-penetration-testing -g -a cursor -y`
Gemini CLI: `npx skills add usestrix/strix --skill web-app-penetration-testing -g -a gemini-cli -y`

## Description

Pentest a web app or website end to end, black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Pentest a web application

Black-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage.

Install, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the **penetration-testing-with-strix** skill, read it if the target is not a running web app, or if `strix --version` fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). This skill is the web-app-specific workflow.

## 1. Confirm authorization and scope

Before running anything, establish:

- **The target is the user's** (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch.
- **Which environment.** Prefer staging over production; agents send real exploit payloads and will create/modify data.
- **Out-of-scope paths**, payment flows, mass-email endpoints, admin destructive actions, third-party SSO providers.
- **Credentials.** Most real vulnerabilities live behind login. Without a test account, the agents only ever see the marketing surface.

Ask for anything missing rather than guessing.

## 2. Run the scan

```bash
strix -n -t https://staging.example.com --max-budget 20 \
  --instruction "Test account: qa@example.com / <password>. In scope: /app/*, /api/*. Do not touch /billing or send email. Focus on access control between the two seeded orgs."
```

Notes that matter for web apps specifically:

The rest: https://github.com/usestrix/strix/blob/HEAD/skills/web-app-penetration-testing/SKILL.md