WooYun Legacy

What the Plugin Actually Adds

Claude's security testing capabilities are already strong. In 12 controlled evaluations, Claude without the plugin passed 98% of domain-specific assertions. Test techniques don't need the plugin.

IT DOES

Transform Claude's security reports from "you should test for payment tampering" into "WooYun payment bypass: 1,056 cases, 68.7% high-severity — M1905 movie site's ¥2,588 subscription was purchased for ¥0.50." Case citations, statistics, and data-driven prioritization — these make reports convincing to stakeholders.

IT DOESN'T

Claude already knows business logic security testing methodology — amount=0.01, IDOR enumeration, state machine step-skipping — these test techniques work without the plugin. The plugin doesn't teach new penetration techniques; it adds data ammunition to existing capabilities.

With Plugin vs Without

Claude already knows the attack techniques. The plugin adds the data layer — backing every judgment with cases and statistics.

Dimension	Without Plugin	With Plugin	Why It Matters
Case References	"Consider testing payment tampering"	"M1905 movie site's ¥2,588 subscription for ¥0.50"	Stakeholders pay attention to real company names
Statistics	"Risk is relatively high"	"Payment bypass: 1,056 cases, 68.7% high-severity"	Quantitative data gives prioritization a factual basis
Taxonomy	Generic OWASP categories	WooYun's "Arbitrary X" taxonomy	Aligns with Chinese security community conventions
Prioritization	Experience-based judgment	Ranked by high-severity % (password reset 88% > payment bypass 68.7%)	When time is limited, data tells you what to test first
Business Scenarios	Generic web scenarios	Alipay/WeChat callbacks, government OA, telecom BOSS	Real targets for Chinese SRC and enterprise testing

Use Cases

No configuration needed. The plugin activates automatically when you ask security-related questions.

Payment Security

E-commerce Payment Testing

"Help me test the payment security of this e-commerce platform with shopping cart, Alipay/WeChat Pay, orders, and refunds."

Authorization

SaaS Authorization Testing

"Multi-tenant SaaS platform with REST APIs. Design a complete authorization test plan — IDOR, vertical privilege escalation, unauthorized access."

Code Audit

Code Security Audit

"Audit this e-commerce order API code for all business logic vulnerabilities."

Reporting

Stakeholder Security Reports

"Found payment tampering, IDOR on orders, and unauthenticated admin panel. Write a convincing report for management."

Prioritization

Time-Constrained Test Priority

"Client gave me two days to test a B2B platform with many features. Can't test everything. Prioritize by risk."

China-Specific

China Business Security Testing

"Test a government services platform with unified auth, admin approvals, license lookup, online payment via Alipay/WeChat."

Bug Bounty

SRC Bug Bounty Hunting

"Targeting a large internet company. Two days. Help me create a vulnerability hunting plan."

Race Condition

Race Condition Testing

"Test a ticketing system for race conditions — ticket purchasing, payment, refunds. Include test scripts."

Compliance

Training & Compliance

"Prepare a payment security training for the dev team" / "How to test business logic for compliance audits"

Three-Layer Progressive Knowledge System

Loads on demand, not all at once. After SKILL.md triggers, Layer 1 loads first, then deeper layers as the task requires.

LAYER 1

Load first

Domain References references/ · 6 files

Methodology + attack pattern matrices + test checklists. Covers authentication, authorization, financial, information, logic, and configuration domains.

LAYER 2

On demand

Deep Analysis Manuals knowledge/ · 8 files

Root cause analysis + payload matrices + WAF bypass. Covers SQL injection, command execution, file upload, XSS, SSRF, and more.

LAYER 3

Case lookup

Vulnerability Case Database categories/ · 15 files

Real case titles + frequent parameters + attack pattern distribution + payload fragments. Only loaded when citing specific cases or payloads.

6 Domains · 33 Vulnerability Classes

Authentication Bypass

8,846 cases

Password reset (88% high-sev), weak passwords, CAPTCHA bypass, session fixation

Authorization Bypass

6,838 cases

IDOR, vertical privilege escalation, arbitrary account/operation/view/modify/delete

Financial Security

2,919 cases

Payment bypass (68.7% high-sev), amount tampering, order tampering, balance manipulation

Information Disclosure

6,446 cases

PII leaks, credential exposure, debug info, API documentation exposure

Logic Flaws

1,679 cases

State machine abuse, race conditions, flow bypass, design flaws

Misconfiguration

1,796 cases

Default credentials, component exposure, hardening gaps, cloud misconfig

Evaluation Benchmarks

12 full-domain controlled evaluations (with_skill vs without_skill), covering all 6 domains.

With Skill

100% (72/72)

Without Skill

64.6% (47/72)

Assertion Category	With Skill	Without Skill
WooYun Case References	12/12 (100%)	0/12 (0%)
WooYun Statistics	12/12 (100%)	0/12 (0%)
Domain-Specific Assertions	48/48 (100%)	47/48 (98%)

The plugin's core value is injecting real WooYun historical data (company cases + quantitative statistics + unique taxonomy), not general security knowledge.

Installation

Two install modes: Lite Install covers all core capabilities. Full Install adds the complete raw case database.

	Lite Install (Marketplace)	Full Install (git clone)
Size	~432KB	~71MB
Domain References (Layer 1)	6 files	6 files
Deep Analysis (Layer 2)	8 files (complete)	8 files (complete)
Case Database (Layer 3)	15 condensed indexes (60KB)	15 complete databases (71MB raw)
Industry Playbooks	Not included	Telecom & banking pentest methodology
Evaluation Data	Not included	12 controlled A/B tests
Best for	Day-to-day testing · Reports · Bug bounty	Full case search · Data analysis · Custom dev

RECOMMENDED

Lite Install

Via Marketplace. 432KB. Full methodology + condensed case indexes.

/plugin marketplace add tanweai/wooyun-legacy

/plugin install wooyun-legacy@tanweai-security

Full Install

Clone the full repo. 71MB. All 22,132 raw case records included.

git clone https://github.com/tanweai/wooyun-legacy.git

claude --plugin-dir ./wooyun-legacy/plugins/wooyun-legacy

Verify: type /skills to see the skill list, or just ask a security testing question.

FAQ

Claude already does security testing without the plugin. Why install it?

Claude already knows security testing methodology (our evaluations show 98% domain assertion pass rate). The plugin doesn't add test techniques — it adds a data layer: real company case references, quantitative statistics, and data-driven prioritization. These are invaluable for stakeholder-facing reports and for explaining "why test this first" to clients.

WooYun data is from 2010–2016. Is it still relevant?

Business logic attack patterns are more stable than tech stacks. "Modify the amount parameter to see if the server validates it" — this test worked in 2012 and still works in 2026. That said, coverage of modern stacks (GraphQL, Serverless, cloud-native) is indeed limited.

Does the plugin auto-trigger?

Yes. The plugin activates when it detects security-related keywords (penetration testing, payment security, IDOR, etc.) as well as implicit black-box testing scenarios (e.g., "help me test this endpoint", "can I change this parameter").

What are the system requirements?

Claude Code CLI (requires Claude Pro / Max / Team / Enterprise subscription). No other external dependencies.

How do I update the plugin?

Run /plugin marketplace update tanweai-security to update the marketplace, then /plugin update wooyun-legacy@tanweai-security to update the plugin.

What's the license?

CC BY-NC-SA 4.0 — free to use for security research, education, and authorized testing. Commercial use prohibited (separate licensing required).

What's the difference between Lite and Full install?

Lite Install (Marketplace, 432KB) includes all methodology, statistics, and condensed case indexes — sufficient for the vast majority of use cases. Full Install (git clone, 71MB) adds the complete raw case database with all 22,132 records, industry penetration playbooks, and evaluation benchmark data. Choose Full if you need to search the complete case database or build custom analysis on the raw data.