---
title: ToolRouter — Workflow
description: A multi-tool workflow showing how to combine ToolRouter tools for a complex task.
url: https://toolrouter.com/workflows/web-app-security-test
---
# Web Application Security Test

Crawl a web application, analyze HTTP security, test for injections, and document findings with screenshots.

Web application security testing requires thorough coverage of the application attack surface. Unlike infrastructure scanning, application testing must discover all pages, forms, and API endpoints, then test each one for the OWASP Top 10 vulnerability categories including injection flaws, broken authentication, and security misconfigurations.

This workflow starts by crawling the application to map its full surface, analyzes HTTP security configurations across all endpoints, performs active injection testing on discovered input vectors, and captures visual evidence of findings. It provides the coverage needed for pre-release security sign-off or periodic application security assessments.

**Tools:** pentest, security-httpx, site-crawler, web-screenshot
**Category:** security

## Steps

### 1. Crawl Application Surface

Crawl the web application to discover all pages, forms, API endpoints, and interactive elements that need security testing.

- **Tool:** site-crawler
- **Skill:** crawl_site
- **Input:** Application root URL and crawl depth/scope parameters.
- **Output:** Sitemap of discovered pages, forms, endpoints, and input vectors.

### 2. Analyze HTTP Security Posture

Check security headers, TLS configuration, and technology fingerprints across all discovered application endpoints.

- **Tool:** security-httpx
- **Skill:** probe_hosts
- **Input:** Discovered URLs and endpoints from the crawl.
- **Output:** Security header analysis, TLS details, and technology stack per endpoint.

### 3. Test for Injection Vulnerabilities

Test discovered forms and endpoints for SQL injection, command injection, and other injection vulnerabilities.

- **Tool:** pentest
- **Skill:** test_injection
- **Input:** Input vectors and endpoints discovered during crawling.
- **Output:** Injection test results with exploitable findings and payloads used.

### 4. Document Security Findings

Capture screenshots of vulnerable pages and security issues for documentation and stakeholder reporting.

- **Tool:** web-screenshot
- **Skill:** capture
- **Input:** URLs where vulnerabilities were discovered.
- **Output:** Visual evidence of security findings for reports and remediation tracking.

## Benefits

- Discover the full application attack surface through automated crawling
- Test for OWASP Top 10 vulnerabilities including SQL and command injection
- Verify HTTP security headers and TLS configuration across all endpoints
- Visual documentation of findings streamlines remediation handoff
