02-complet-web · 1 day · 7 min

Web pentest: Full mode, for a site or an app.

A marketing site, a shop, a single-tenant app. You want an implementable report, not Express triage. Full Web chains surface, pages, session, API, secrets, dependencies — one day, no payload.

When to open it
  • Site, blog, ecommerce, web app with no B2B isolation promise
  • You want exec + impl + tickets, not just a signal
  • Test account recommended — without it, the whole auth branch stays Untested
Agents
00–04, 06–11 (09 as negative inventory if no agent surface)
Outside this mode
  • No multi-tenant specialist — real tenancy means you switch to SaaS mode
  • Out of scope: hosted payments, third-party IdP — noted, not visited
  • No injection. Reflections are documented, not exploited

The pipeline

Orchestrator, then mapping (cap 800 URLs / origin), threat model, on-page, session if a login exists, API if inventoried, secrets, supply chain. If there is no agent surface, agent 09 writes a negative inventory. QA signs, or there is no report.

Method, not a scan

  • Collect first, findings second. No gut scoring during the crawl.
  • Auth: cookies, reset, MFA if present, observed session fixation — we do not steal sessions.
  • Access control: ids that appear in the test account UI. A guessed id outside the brief = Untested.
  • The only POST/PUT are the documented ones (test-account login).

When this is no longer the right mode

The moment there are orgs, workspaces, “your data stays yours”: it is a SaaS. Switch. A Full Web that confirms a cross-tenant IDOR without two contexts is a fault.

Launch phrase

Full Web on https://example.com. Test account in the brief. Outside + code if the repo is local.

Before you launch

Without source code?
The code path is optional. If missing, repo reading stays Untested. Outside audit and session continue.
How much confidence?
Typically 3–4. 5 only with a test account, inventoried API, 09 handled, QA without a major reservation.

The kit, not the guide.

Open source, MIT. Clone it, open it in Claude, Codex, Cursor or Hermes. A held report — or QA’s silence.

Open sourceMIT0 stars0 forks

github.com/cryptulien/security-kit