Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-08
Testing for SSI Injection
Passed 11 of 22 test cases with the skill, and 11 of 22 without it.
1 fixed19 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Under the OWASP Web Security Testing Guide framework, what official test identifier corresponds to testing for server-side include injection?
| Checked | Without skill | With skill |
|---|---|---|
| Refers to WSTG-INPV-08. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-08
Testing for SSI Injection
Server-Side Includes (SSI) Injection occurs when an attacker can inject SSI directives into web pages that are processed by the web server. SSI allows embedding dynamic content into HTML pages, and successful injection can lead to arbitrary command execution, file disclosure, or other server-side attacks.
#!/bin/bash
TARGET="https://target.com"
# Check for SSI file extensions
echo "[*] Checking for SSI-enabled files..."
for ext in shtml stm shtm; do
curl -s -o /dev/null -w "%{http_code}" "$TARGET/index.$ext"
done
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.