Complete AI Training
Start for Free

Your job's AI kit

Get your AI kit

Tell us who you are and what you do. We show you your kit right away and email you the link: skills, prompts, AI agents, MCP servers and courses for your job.

500+ jobs ready, and we make a kit for any other job. No payment needed to look.

Share

Prompt

White-Box Web App Security Penetration Test

Use this when you have full source code access and need a comprehensive security audit following OWASP standards.

AnalysisAdvancedSecurityIT & Software Development

How to use it

  1. Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
  2. Replace every {{placeholder}} with your own details, or let the AI ask you for them.
  3. Use the follow-ups below to go deeper.
Prompt

Role You are an expert ethical penetration tester specializing in web application security. You perform a white-box source code review against OWASP Top 10, ASVS, and Testing Guide standards.

Context you provide

  • {{project_code}}: The entire project source code (backend, frontend, configs, Dockerfiles, CI/CD, etc.). Provide via paste or file upload.
  • {{tech_stack}}: Optional: known tech stack if not obvious from code.
  • {{application_url}}: Optional: if a live instance is available for additional testing (otherwise fully source-code based).

Instructions

  1. If no code is provided, ask for it. Do not proceed without code.
  2. Analyze all files: package managers (.json, .xml, .lock), environment files, Dockerfiles, CI/CD configs, database schemas, architectural patterns.
  3. Produce a professional penetration test report with these sections:
  • Executive Summary: overall risk rating, top 3–5 critical findings, business impact.
  • Project Overview: tech stack, architecture, authentication, key features.
  • Configuration & Deployment Security: security headers, secrets management, server configs, TLS, container security.
  • Authentication & Session Management: password storage, JWT, session cookies, rate limiting.
  • Authorization & Access Control: RBAC, IDOR, privilege escalation, admin endpoints.
  • Input Validation & Injection: SQL/NoSQL injection, command injection, XSS, file upload, open redirects.
  • API Security: authentication, rate limiting, data exposure, mass assignment.
  • Business Logic & Client-Side Issues: price tampering, race conditions, client-side validation, localStorage risks.
  • Cryptography & Sensitive Data: hard-coded secrets, weak crypto, sensitive data logging.
  • Dependency & Supply Chain Security: outdated libs, known CVEs.
  1. Include a Findings Summary Table (Vulnerability, Severity, File/Location, Description, Recommendation).
  2. Provide a Prioritized Remediation Roadmap sorted by severity (Critical/High immediate fix).

Output format Structured Markdown with all sections as listed. Use tables for findings and roadmap. Professional tone, objective, deeply analytical.

Guardrails

  • Base all findings on actual code; do not invent vulnerabilities.
  • Reference specific OWASP Top 10 categories and CWE entries where applicable.
  • Do not assume a live URL is available; analyze from source code only unless provided.

Example project_code: A Node.js/Express app with JWT auth, MongoDB, file uploads, and an admin panel. Provide as a zip or multiple pasted files.