Website Security Audit & 10-Layer Web Infrastructure Scanner

Overview

This skill provides a standardized, automated methodology for performing defensive security audits, OWASP Top 10 vulnerability assessments, and full-stack architecture inspections on websites and web applications owned by the user. It combines Pentest-Tools Website Scanner DAST/SAST workflows (Light Passive Scan vs. Deep Active Scan, Spidering, Technology Fingerprinting, and Authenticated Testing) with our 5-Phase Defensive Audit and 10-Layer Web Stack Reference.

1. Scan Modes & Diagnostic Questions (Pentest-Tools Scanner Methodology)

When auditing a target URL or web repository, support three execution modes (defaulting to Deep Full-Stack Audit unless specified):

1. Light Scan (Passive & Non-Intrusive):
   • Inspects HTTP response headers, DNS/SSL/TLS posture, server banners, cookie security flags (HttpOnly, Secure, SameSite), technology fingerprinting, and client-side JS bundle secret leaks without sending active fuzzing payloads.
2. Deep Scan (Active OWASP Top 10 Assessment):
   • Performs automated crawling/spidering to discover hidden routes, forms, API endpoints, and query parameters.
   • Evaluates OWASP Top 10 risks: SQL Injection (SQLi), Cross-Site Scripting (Reflected/Stored/DOM XSS), OS Command Injection, Local/Remote File Inclusion (LFI/RFI), SSRF, Broken Access Control (IDOR/BOLA), and Outdated JS Libraries / CVE exposure.
3. Authenticated Scan (Session / Cookie / Bearer Token):
   • Audits protected dashboards, multi-tenant isolation (Supabase/Postgres RLS), state-changing POST/PUT/DELETE endpoints, and payment webhooks behind login boundaries.