Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-03
Testing for HTTP Verb Tampering
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
and 5 more in the full report
5 fixed14 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
In the OWASP Web Security Testing Guide, what is the official Test ID and Test Name for testing HTTP Verb Tampering?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Test ID as WSTG-INPV-03. | Missed | Passed |
| Identifies Test Name as Testing for HTTP Verb Tampering. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-03
Testing for HTTP Verb Tampering
HTTP Verb Tampering exploits web servers or applications that respond differently to various HTTP methods (GET, POST, PUT, DELETE, etc.). Attackers may bypass security controls by using alternative HTTP methods that aren't properly restricted, potentially gaining unauthorized access to protected resources.
#!/bin/bash
TARGET="https://target.com"
ENDPOINT="/admin"
# Test common HTTP methods
METHODS=("GET" "POST" "PUT" "DELETE" "PATCH" "HEAD" "OPTIONS" "TRACE" "CONNECT")
echo "[*] Testing HTTP methods on $TARGET$ENDPOINT"
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.