# Wooyun Legacy

Provides web vulnerability testing methodology distilled from 88,636 real-world cases...

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Testing
- License: see repository
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill wooyun-legacy -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill wooyun-legacy -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill wooyun-legacy -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill wooyun-legacy -g -a gemini-cli -y`

## Description

Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# WooYun Vulnerability Analysis Knowledge Base

Methodology and testing patterns extracted from 88,636 real-world
vulnerability cases reported to the WooYun platform (2010-2016).

---

## When to Use

> All testing described here must be performed only against systems you
> have written authorization to test.

- Penetration testing web applications
- Security code review (server-side or client-side)
- Vulnerability research against web targets you have explicit authorization to test
- Building security test cases or checklists
- Assessing web application attack surface
- Reviewing remediation effectiveness
- Training or education in authorized security testing contexts

## When NOT to Use

- Network infrastructure testing (firewalls, routers, switches)
- Mobile application binary analysis
- Malware analysis or reverse engineering
- Compliance-only assessments (PCI-DSS, SOC2 checklists without testing)
- Physical security assessments
- Social engineering campaigns
- Cloud infrastructure misconfigurations (IAM, S3 buckets), these
  require cloud-specific tooling, not web vuln patterns

## Rationalizations to Reject

These shortcuts lead to missed findings. Reject them:

The rest: https://github.com/vigolium/vigolium/blob/HEAD/platform/vigolium-audit/src/content/skills/wooyun-legacy/SKILL.md