Skip to content

CLAUDE.md

Latest commit

 

History

History
135 lines (109 loc) · 4.14 KB

CLAUDE.md

File metadata and controls

135 lines (109 loc) · 4.14 KB
Raw

Claude Project Guide - OWASP WSTG RAG

This file helps Claude understand the OWASP Web Security Testing Guide RAG project architecture.

Project Overview

This is a RAG (Retrieval-Augmented Generation) system that indexes the OWASP Web Security Testing Guide (WSTG) into a vector database, then exposes it via HTTP API and MCP protocol for Claude Code integration.

Architecture Flow

Raw Data (raw_data/)
    │
    └── OWASP WSTG HTML ───► wstg_parser.py
                                  │
                                  ▼
                         data/processed/modules.json
                                  │
                                  ▼
                            chunker.py
                                  │
                                  ▼
                         data/chroma_db/ (ChromaDB)
                                  │
                  ┌───────────────┴───────────────┐
                  ▼                               ▼
           http_server.py                   mcp_client.py
           (REST API)                       (MCP for Claude Code)
           Port 5004                        Calls HTTP API

Key Files

File Purpose
parsers/wstg_parser.py Parse OWASP WSTG HTML into structured data
chunking/chunker.py Create semantic chunks for retrieval
server/vector_store.py ChromaDB wrapper for embeddings
server/http_server.py REST API on port 5004
server/mcp_client.py MCP tools for Claude Code
build_database.py Main build pipeline

WSTG Categories

Category WSTG ID Prefix Description
info_gathering WSTG-INFO Information Gathering
configuration WSTG-CONF Configuration and Deployment
identity WSTG-IDNT Identity Management
authentication WSTG-ATHN Authentication Testing
authorization WSTG-ATHZ Authorization Testing
session WSTG-SESS Session Management
input_validation WSTG-INPV Input Validation Testing
error_handling WSTG-ERRH Error Handling
cryptography WSTG-CRYP Cryptography Testing
business_logic WSTG-BUSL Business Logic Testing
client_side WSTG-CLNT Client-side Testing
api_testing WSTG-APIT API Testing

MCP Tools

  • search_wstg - Search WSTG for testing methodologies
  • search_test_methodology - Search for how-to testing guides
  • search_test_objectives - Search for test objectives
  • get_wstg_test_case - Get all info for a WSTG ID (e.g., WSTG-INPV-05)
  • get_wstg_document - Get document by ID
  • list_wstg_categories - List all categories and WSTG IDs
  • wstg_health - Health check
  • wstg_info - Database info

Usage

# Build database
cd RAG_runner
pip install -r requirements.txt
python3 build_database.py

# Start HTTP server
python3 -m server.http_server

# Test search
curl -X POST http://localhost:5004/search \
  -H "Content-Type: application/json" \
  -d '{"query": "SQL injection testing"}'

# Get specific test case
curl http://localhost:5004/wstg/WSTG-INPV-05

Adding to Claude Code

Add to ~/.claude.json:

{
  "mcpServers": {
    "owasp-wstg-rag": {
      "command": "python3",
      "args": ["/path/to/OWASP_WSTG_Rag/RAG_runner/server/mcp_client.py"],
      "env": {
        "WSTG_RAG_URL": "http://localhost:5004"
      }
    }
  }
}

WSTG Test Case Structure

Each parsed test case contains:

  • wstg_id: WSTG identifier (e.g., WSTG-INPV-05)
  • title: Test case title
  • category: WSTG category
  • test_objectives: What to test for
  • how_to_test: Step-by-step methodology
  • sections: Detailed sections
  • code_blocks: Code examples and payloads
  • payloads: Extracted test payloads

Example Queries

# Search for SQL injection testing
search_wstg("SQL injection testing methodology")

# Get specific test case
get_wstg_test_case("WSTG-INPV-05")

# Search for authentication testing
search_wstg("authentication bypass", category_filter="authentication")

# Search for test objectives
search_test_objectives("session fixation")