WooYun Legacy: Teaching Claude AI Security Testing with 22,000 Real Vulnerability Cases

Hook

Claude can identify SQL injection vulnerabilities, but it can't tell you that password reset flaws have a 88% critical severity rate in production systems—or that someone once bought a ¥2588 movie package for ¥0.50 through logical payment bypass.

Context

Between 2010 and 2016, WooYun operated as China's most influential vulnerability disclosure platform, archiving 22,132 real-world security cases from actual business systems before shutting down. This wasn't theoretical security research—these were documented exploits against Alipay integrations, telecom BOSS billing systems, government OA platforms, and e-commerce payment flows that processed millions of yuan daily.

When security testers write penetration test reports today using AI assistants like Claude, they face a persuasion problem. Claude knows OWASP methodologies and can generate technically sound testing procedures, but it lacks empirical weight. A CISO doesn't approve budget increases because 'CSRF is a known vulnerability class'—they respond to 'This attack pattern caused 47 documented breaches in similar payment systems, with median losses of ¥180,000.' WooYun Legacy bridges this gap by injecting historical case data directly into Claude Code's context window, transforming generic security advice into data-backed recommendations that resonate with stakeholders who lived through China's early web security chaos.

Technical Insight

WooYun Legacy operates as a Claude Code skill—essentially a knowledge injection layer that activates when the AI detects security-related intent. The architecture uses three tiers of information density. The first tier contains domain references (方法论参考文章.md) that establish high-level testing frameworks. The second tier provides eight technical manuals covering specific attack surfaces like payment logic, authentication flows, and privilege escalation. The third tier is the vulnerability case database itself, organized into 15 categories ranging from CSRF (1,515 cases) to race conditions (113 cases) to the uniquely Chinese 'Arbitrary-X' taxonomy (529 cases covering arbitrary account operations, viewing, modification, and deletion).

The activation logic is smarter than simple keyword matching. The plugin triggers not just on explicit queries like 'test for SQL injection' but also on implicit black-box testing intent. When a developer asks Claude Code to 'test this endpoint' or 'can I bypass this validation' in either Chinese or English, the plugin recognizes the security context and surfaces relevant historical cases. Here's what the lightweight installation structure looks like:

# Marketplace installation (432KB)
wooyun-legacy/
├── domain/              # High-level methodology frameworks
│   └── security-testing-frameworks.md
├── deep/                # 8 technical analysis manuals
│   ├── payment-logic-vulnerabilities.md
│   ├── authentication-bypass-patterns.md
│   └── privilege-escalation-vectors.md
├── index/               # Condensed case indexes by category
│   ├── csrf-cases-summary.json
│   ├── payment-bypass-summary.json
│   └── arbitrary-operation-summary.json
└── activation-patterns.json  # Intent detection rules

The value proposition isn't teaching Claude how to find vulnerabilities—it already knows penetration testing methodologies. Instead, it's about adding quantitative backing and case citations. When Claude generates a security report with the plugin active, recommendations transform from 'Consider testing password reset flows for logic flaws' to 'Prioritize password reset testing: historical data shows 88% critical severity rate across 342 documented cases, compared to 68.7% for payment bypass vulnerabilities (891 cases). Case WY-2014-58372 demonstrates a典型 password reset race condition that allowed arbitrary account takeover on a platform with 2.3M users.'

The full installation (71MB) includes complete case archives if you need to perform custom data analysis:

# Example: Query the full case database
import json
from pathlib import Path

# Load full WooYun case archive
cases = json.loads(Path('wooyun-legacy/data/full-cases.json').read_text())

# Find all payment bypass cases with critical severity
critical_payment = [
    case for case in cases 
    if case['category'] == 'payment-bypass' 
    and case['severity'] == 'critical'
    and 'bypass' in case['attack_vector'].lower()
]

# Analyze common vulnerable endpoints
endpoints = {}
for case in critical_payment:
    endpoint = case.get('vulnerable_endpoint', 'unknown')
    endpoints[endpoint] = endpoints.get(endpoint, 0) + 1

print(f"Most vulnerable payment endpoints:")
for endpoint, count in sorted(endpoints.items(), key=lambda x: x[1], reverse=True)[:5]:
    print(f"  {endpoint}: {count} cases")

This data-driven approach enables time-constrained testers to prioritize efforts efficiently. If you have 4 hours for a bug bounty program, knowing that password reset vulnerabilities have 3.2x higher payout rates than XSS (based on historical case rewards) directly influences where you invest testing time. The plugin surfaces these patterns automatically within Claude's responses rather than requiring manual database queries.

Gotcha

The elephant in the room is dataset obsolescence. WooYun shut down in 2016, meaning the case archive ends seven years before modern attack surfaces like GraphQL mutations, serverless authorization bypass, Kubernetes RBAC misconfigurations, or supply chain attacks emerged. If you're testing a cloud-native application built on AWS Lambda with JWT-based auth, the historical case relevance drops significantly. Business logic attack patterns—like race conditions in payment flows or IDOR in account management—remain somewhat timeless, but the technical implementation details reflect mid-2010s web architecture (PHP sessions, traditional SQL databases, monolithic applications).

The Chinese business context is simultaneously the plugin's greatest strength and a limitation for international users. WooYun cases heavily feature China-specific platforms: Alipay/WeChat payment integrations, telecom BOSS systems, government procurement portals, and SRC (Security Response Center) workflows that follow different disclosure norms than Western bug bounties. If you're testing a SaaS platform in the US with Stripe integration, the empirical case citations lose persuasive power—your CISO hasn't heard of the companies mentioned and doesn't care about RMB-denominated breach losses. Additionally, the plugin only works with Claude Code specifically, not standard Claude chat, API integrations, Cursor, or GitHub Copilot, which limits portability if your team uses different development environments.

Verdict

Use WooYun Legacy if: You're conducting security testing for Chinese companies or platforms with Chinese user bases, writing penetration test reports that need empirical backing to convince stakeholders who respond better to local case examples than international CVE databases, prioritizing bug bounty targets based on historical severity distributions and payout patterns, or working in SRC environments where WooYun's legacy still carries credibility. The plugin excels at making security recommendations persuasive through concrete citations like real company names and specific monetary losses. Install the lightweight Marketplace version first (432KB)—it covers 95% of use cases through condensed indexes. Skip if: You're testing modern cloud-native or serverless architectures where 2010-2016 case relevance is minimal, working primarily outside Chinese business contexts where local case examples lack persuasive weight, not using Claude Code as your primary development environment (the plugin won't work with other AI assistants), or you need current vulnerability intelligence rather than historical pattern analysis. In those scenarios, stick with regularly updated resources like OWASP Testing Guide combined with Claude's native capabilities, or invest time in custom prompt engineering with recent vulnerability disclosures.