nathan-gage/wooyun-legacy-english

WooYun Legacy is a Claude Code plugin that enriches AI-generated security testing reports with real-world vulnerability case data, rather than only offering generic advice. It is built on 22,132 business logic vulnerability cases collected by the WooYun platform between 2010 and 2016, covering payment systems, authorization, authentication, and general business logic flaws found in real applications. When you ask Claude to help with security testing, the plugin activates and transforms generic advice into data-backed recommendations citing actual incidents and severity statistics from that historical dataset. For example, instead of a general warning about payment bypass, Claude might reference that WooYun recorded 1,056 such cases with 68.7% rated high severity, and describe a real-world exploit similar to the one being discussed. The plugin explicitly does not teach new testing techniques on its own. Instead, it adds supporting data to make Claude's existing security testing capabilities more persuasive and concrete when reporting findings to stakeholders. There are two installation modes to choose from. A Lite install, around 432 KB, includes methodology files, technical manuals, and condensed case indexes covering the top 15 cases per category plus overall statistics. A Full install, around 71 MB, adds all 22,132 cases in full, along with industry pentest examples for telecom and banking, plus evaluation benchmarks. For most users the Lite install is described as covering all the core capabilities. The plugin activates automatically whenever Claude detects security-related intent in a conversation, whether that is an explicit request for penetration testing or a more implicit one, such as asking to test an endpoint or check a feature for issues. This repository is an English translation of the original WooYun Legacy project, prepared with the help of GPT-5.5. It is licensed under CC BY-NC-SA 4.0, and is intended for authorized security testing, code review, and internal risk assessment only, not for unauthorized use against systems you do not own or have permission to test.