- redirects-unvalidated.md: systematic open-redirect probe loop (17 params,
Location-header capture, external-redirect follow, allowlist-substring bypass)
- auth-bypass.md: when to run default/weak creds (after user-enum finds admin;
hand-testable set is not brute force)
- xss.md: URL-valued fields (avatar/link) as stored/blind XSS vectors
- business-logic.md: referral self-referral registration recipe (register A,
refer B, check both sides for credit)
- exhaustive-coverage.md: mandatory auth/registration-flow coverage step so
the routing triggers no matter which playbook the agent reads first
No benchmark names or session inventory; generic OWASP technique only.
- Created a comprehensive playbook for SQL Injection (SQLi) detailing types, detection methods, tools, and remediation strategies.
- Added a playbook for Server-Side Request Forgery (SSRF) covering classification, detection payloads, and remediation guidance.
- Introduced a playbook for Cross-Site Scripting (XSS) including types, detection techniques, and safe proof of concept examples.
- Expanded the test suite with new tests for command history deduplication, scope authorization, and structured argument handling.
- Improved existing tests for engagement and execution tracking, ensuring robust coverage of functionality.
Violin