02-complet-web · 1 day · 7 min
Web pentest: Full mode, for a site or an app.
A marketing site, a shop, a single-tenant app. You want an implementable report, not Express triage. Full Web chains surface, pages, session, API, secrets, dependencies — one day, no payload.
- When to open it
- Site, blog, ecommerce, web app with no B2B isolation promise
- You want exec + impl + tickets, not just a signal
- Test account recommended — without it, the whole auth branch stays Untested
- Agents
- 00–04, 06–11 (09 as negative inventory if no agent surface)
- Outside this mode
- No multi-tenant specialist — real tenancy means you switch to SaaS mode
- Out of scope: hosted payments, third-party IdP — noted, not visited
- No injection. Reflections are documented, not exploited
The pipeline
Orchestrator, then mapping (cap 800 URLs / origin), threat model, on-page, session if a login exists, API if inventoried, secrets, supply chain. If there is no agent surface, agent 09 writes a negative inventory. QA signs, or there is no report.
Method, not a scan
- Collect first, findings second. No gut scoring during the crawl.
- Auth: cookies, reset, MFA if present, observed session fixation — we do not steal sessions.
- Access control: ids that appear in the test account UI. A guessed id outside the brief = Untested.
- The only POST/PUT are the documented ones (test-account login).
When this is no longer the right mode
The moment there are orgs, workspaces, “your data stays yours”: it is a SaaS. Switch. A Full Web that confirms a cross-tenant IDOR without two contexts is a fault.
Launch phrase
Full Web on https://example.com. Test account in the brief. Outside + code if the repo is local.
Before you launch
- Without source code?
- The code path is optional. If missing, repo reading stays Untested. Outside audit and session continue.
- How much confidence?
- Typically 3–4. 5 only with a test account, inventoried API, 09 handled, QA without a major reservation.
The kit, not the guide.
Open source, MIT. Clone it, open it in Claude, Codex, Cursor or Hermes. A held report — or QA’s silence.