CWE exhaustive testing

Use when the ask names a CWE, OWASP/WSTG mapping to CWE, a CVE that maps to CWE, SAST output with CWE IDs, or "test this app/binary/firmware against CWE". Pair with sast-code-scans when source exists and web-application-penetration-testing when the surface is HTTP.

When to use

• "CWE-79", "test for SQLi", "map findings to CWE"
• CVE analysis that must name the underlying weakness
• Coverage pass: every CWE that applies to this stack

Methodologies

Catalog	Role
CWE List 4.20	weakness IDs, views, categories — source of each reference
OWASP WSTG / ASVS	web mapping onto CWE IDs
NIST SP 800-115	technical assessment techniques wrapping these tests
ATT&CK / CAPEC	attacker technique; still report the CWE

How to look up a CWE

Each CWE number is a file in this skill:

references/CWE-<id>.md

Examples: references/CWE-79.md, references/CWE-89.md, references/CWE-787.md. Open that file and follow its procedure end-to-end. Do not improvise a one-line "XSS test" when the reference exists. references/INDEX.md lists every ID.

Exhaustive catalog procedure

1. Identify the target class (web, API, native, firmware, cloud, human).
2. Pick a CWE view (CWE-1000 Research Concepts, CWE-699 Software Development, CWE-1194 Hardware Design, CWE-1326 CWE Top 25, etc.) from references/.
3. For every applicable member, run references/CWE-<id>.md.
4. Record N/A with a reason when the platform does not exist.
5. Findings cite the member CWE, not only the view/category.
6. Re-read saved evidence before calling the CWE tested.

Tooling

• Always: skills_recall this skill, then read the CWE reference file.
• HTTP: PWN::Plugins::BurpSuite or TransparentBrowser.
• Source: PWN::SAST::Factory.start / pwn_sast.
• Authz: PWN::Bounty::LifecycleAuthzReplay.
• Native: PWN::Plugins::Assembly, gdb via shell.
• Hardware: PWN::Plugins::Serial, BusPirate.

Pitfalls

• Scanner output is inventory, not a test.
• Categories and views are groupings; they are not vulnerabilities.
• One payload on one parameter is not exhaustive for a Base CWE.
• Do not skip deprecated IDs without following the replacement.

Verification

A CWE is done when its reference checklist is ticked and evidence paths were re-read. The engagement is CWE-complete when every applicable ID in the chosen view is tested or N/A.

Catalog size (CWE 4.20)

• Weaknesses: 969
• Categories: 422
• Views: 59

Full table: references/INDEX.md.