Vulnerability Scanner
Think like an attacker, defend like an expert. 2025 threat landscape awareness.
🔧 Runtime Scripts
Execute for automated validation:
| Script |
Purpose |
Usage |
security_scan.py |
Validate security principles applied |
python security_scan.py <project_path> |
📋 Reference Files
| File |
Purpose |
| checklist.md |
OWASP Top 10, Auth, API, Data protection checklists |
1. Security Expert Mindset
Core Principles
| Principle |
Application |
| Assume Breach |
Design as if attacker already inside |
| Zero Trust |
Never trust, always verify |
| Defense in Depth |
Multiple layers, no single point |
| Least Privilege |
Minimum required access only |
| Fail Secure |
On error, deny access |
Threat Modeling Questions
Before scanning, ask:
- What are we protecting? (Assets)
- Who would attack? (Threat actors)
- How would they attack? (Attack vectors)
- What's the impact? (Business risk)
2. OWASP Top 10:2025
Risk Categories
| Rank |
Category |
Think About |
| A01 |
Broken Access Control |
Who can access what? IDOR, SSRF |
| A02 |
Security Misconfiguration |
Defaults, headers, exposed services |
| A03 |
Software Supply Chain 🆕 |
Dependencies, CI/CD, build integrity |
| A04 |
Cryptographic Failures |
Weak crypto, exposed secrets |
| A05 |
Injection |
User input → system commands |
| A06 |
Insecure Design |
Flawed architecture |
| A07 |
Authentication Failures |
Session, credential management |
| A08 |
Integrity Failures |
Unsigned updates, tampered data |
| A09 |
Logging & Alerting |
Blind spots, no monitoring |
| A10 |
Exceptional Conditions 🆕 |
Error handling, fail-open states |
2025 Key Changes
2021 → 2025 Shifts:
├── SSRF merged into A01 (Access Control)
├── A02 elevated (Cloud/Container configs)
├── A03 NEW: Supply Chain (major focus)
├── A10 NEW: Exceptional Conditions
└── Focus shift: Root causes > Symptoms
3. Supply Chain Security (A03)
Attack Surface
| Vector |
Risk |
Question to Ask |
| Dependencies |
Malicious packages |
Do we audit new deps? |
| Lock files |
Integrity attacks |
Are they committed? |
| Build pipeline |
CI/CD compromise |
Who can modify? |
| Registry |
Typosquatting |
Verified sources? |
Defense Principles
- Verify package integrity (checksums)
- Pin versions, audit updates
- Use private registries for critical deps
- Sign and verify artifacts
4. Attack Surface Mapping
What to Map
| Category |
Elements |
| Entry Points |
APIs, forms, file uploads |
| Data Flows |
Input → Process → Output |
| Trust Boundaries |
Where auth/authz checked |
| Assets |
Secrets, PII, business data |
Prioritization Matrix
Risk = Likelihood × Impact
High Impact + High Likelihood → CRITICAL
High Impact + Low Likelihood → HIGH
Low Impact + High Likelihood → MEDIUM
Low Impact + Low Likelihood → LOW
5. Risk Prioritization
CVSS + Context
| Factor |
Weight |
Question |
| CVSS Score |
Base severity |
How severe is the vuln? |
| EPSS Score |
Exploit likelihood |
Is it being exploited? |
| Asset Value |
Business context |
What's at risk? |
| Exposure |
Attack surface |
Internet-facing? |
Prioritization Decision Tree
Is it actively exploited (EPSS >0.5)?
├── YES → CRITICAL: Immediate action
└── NO → Check CVSS
├── CVSS ≥9.0 → HIGH
├── CVSS 7.0-8.9 → Consider asset value
└── CVSS <7.0 → Schedule for later
6. Exceptional Conditions (A10 - New)
Fail-Open vs Fail-Closed
| Scenario |
Fail-Open (BAD) |
Fail-Closed (GOOD) |
| Auth error |
Allow access |
Deny access |
| Parsing fails |
Accept input |
Reject input |
| Timeout |
Retry forever |
Limit + abort |
What to Check
- Exception handlers that catch-all and ignore
- Missing error handling on security operations
- Race conditions in auth/authz
- Resource exhaustion scenarios
7. Scanning Methodology
Phase-Based Approach
1. RECONNAISSANCE
└── Understand the target
├── Technology stack
├── Entry points
└── Data flows
2. DISCOVERY
└── Identify potential issues
├── Configuration review
├── Dependency analysis
└── Code pattern search
3. ANALYSIS
└── Validate and prioritize
├── False positive elimination
├── Risk scoring
└── Attack chain mapping
4. REPORTING
└── Actionable findings
├── Clear reproduction steps
├── Business impact
└── Remediation guidance
8. Code Pattern Analysis
High-Risk Patterns
| Pattern |
Risk |
Look For |
| String concat in queries |
Injection |
"SELECT * FROM " + user_input |
| Dynamic code execution |
RCE |
eval(), exec(), Function() |
| Unsafe deserialization |
RCE |
pickle.loads(), unserialize() |
| Path manipulation |
Traversal |
User input in file paths |
| Disabled security |
Various |
verify=False, --insecure |
Secret Patterns
| Type |
Indicators |
| API Keys |
api_key, apikey, high entropy |
| Tokens |
token, bearer, jwt |
| Credentials |
password, secret, key |
| Cloud |
AWS_, AZURE_, GCP_ prefixes |
9. Cloud Security Considerations
Shared Responsibility
| Layer |
You Own |
Provider Owns |
| Data |
✅ |
❌ |
| Application |
✅ |
❌ |
| OS/Runtime |
Depends |
Depends |
| Infrastructure |
❌ |
✅ |
Cloud-Specific Checks
- IAM: Least privilege applied?
- Storage: Public buckets?
- Network: Security groups tightened?
- Secrets: Using secrets manager?
10. Anti-Patterns
| ❌ Don't |
✅ Do |
| Scan without understanding |
Map attack surface first |
| Alert on every CVE |
Prioritize by exploitability + asset |
| Ignore false positives |
Maintain verified baseline |
| Fix symptoms only |
Address root causes |
| Scan once before deploy |
Continuous scanning |
| Trust third-party deps blindly |
Verify integrity, audit code |
11. Reporting Principles
Finding Structure
Each finding should answer:
- What? - Clear vulnerability description
- Where? - Exact location (file, line, endpoint)
- Why? - Root cause explanation
- Impact? - Business consequence
- How to fix? - Specific remediation
Severity Classification
| Severity |
Criteria |
| Critical |
RCE, auth bypass, mass data exposure |
| High |
Data exposure, privilege escalation |
| Medium |
Limited scope, requires conditions |
| Low |
Informational, best practice |
Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
When to Use
This skill is applicable to execute the workflow or actions described in the overview.
1---2name: vulnerability-scanner3description: Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.4---5
6# Vulnerability Scanner
7
8> Think like an attacker, defend like an expert. 2025 threat landscape awareness.
9
10## 🔧 Runtime Scripts
11
12**Execute for automated validation:**
13
14| Script | Purpose | Usage |
15|--------|---------|-------|
16| `security_scan.py` | Validate security principles applied | `python security_scan.py <project_path>` |
17
18## 📋 Reference Files
19
20| File | Purpose |
21|------|---------|
22| [checklist.md](checklist.md) | OWASP Top 10, Auth, API, Data protection checklists |
23
24---
25
26## 1. Security Expert Mindset
27
28### Core Principles
29
30| Principle | Application |
31|-----------|-------------|
32| **Assume Breach** | Design as if attacker already inside |
33| **Zero Trust** | Never trust, always verify |
34| **Defense in Depth** | Multiple layers, no single point |
35| **Least Privilege** | Minimum required access only |
36| **Fail Secure** | On error, deny access |
37
38### Threat Modeling Questions
39
40Before scanning, ask:
411. What are we protecting? (Assets)
422. Who would attack? (Threat actors)
433. How would they attack? (Attack vectors)
444. What's the impact? (Business risk)
45---
46
47## 2. OWASP Top 10:2025
48
49### Risk Categories
50
51| Rank | Category | Think About |
52|------|----------|-------------|
53| **A01** | Broken Access Control | Who can access what? IDOR, SSRF |
54| **A02** | Security Misconfiguration | Defaults, headers, exposed services |
55| **A03** | Software Supply Chain 🆕 | Dependencies, CI/CD, build integrity |
56| **A04** | Cryptographic Failures | Weak crypto, exposed secrets |
57| **A05** | Injection | User input → system commands |
58| **A06** | Insecure Design | Flawed architecture |
59| **A07** | Authentication Failures | Session, credential management |
60| **A08** | Integrity Failures | Unsigned updates, tampered data |
61| **A09** | Logging & Alerting | Blind spots, no monitoring |
62| **A10** | Exceptional Conditions 🆕 | Error handling, fail-open states |
63
64### 2025 Key Changes
65
66```
672021 → 2025 Shifts:
68├── SSRF merged into A01 (Access Control)
69├── A02 elevated (Cloud/Container configs)
70├── A03 NEW: Supply Chain (major focus)
71├── A10 NEW: Exceptional Conditions
72└── Focus shift: Root causes > Symptoms
73```
74
75---
76
77## 3. Supply Chain Security (A03)
78
79### Attack Surface
80
81| Vector | Risk | Question to Ask |
82|--------|------|-----------------|
83| **Dependencies** | Malicious packages | Do we audit new deps? |
84| **Lock files** | Integrity attacks | Are they committed? |
85| **Build pipeline** | CI/CD compromise | Who can modify? |
86| **Registry** | Typosquatting | Verified sources? |
87
88### Defense Principles
89
90- Verify package integrity (checksums)
91- Pin versions, audit updates
92- Use private registries for critical deps
93- Sign and verify artifacts
94---
95
96## 4. Attack Surface Mapping
97
98### What to Map
99
100| Category | Elements |
101|----------|----------|
102| **Entry Points** | APIs, forms, file uploads |
103| **Data Flows** | Input → Process → Output |
104| **Trust Boundaries** | Where auth/authz checked |
105| **Assets** | Secrets, PII, business data |
106
107### Prioritization Matrix
108
109```
110Risk = Likelihood × Impact
111
112High Impact + High Likelihood → CRITICAL
113High Impact + Low Likelihood → HIGH
114Low Impact + High Likelihood → MEDIUM
115Low Impact + Low Likelihood → LOW
116```
117
118---
119
120## 5. Risk Prioritization
121
122### CVSS + Context
123
124| Factor | Weight | Question |
125|--------|--------|----------|
126| **CVSS Score** | Base severity | How severe is the vuln? |
127| **EPSS Score** | Exploit likelihood | Is it being exploited? |
128| **Asset Value** | Business context | What's at risk? |
129| **Exposure** | Attack surface | Internet-facing? |
130
131### Prioritization Decision Tree
132
133```
134Is it actively exploited (EPSS >0.5)?
135├── YES → CRITICAL: Immediate action
136└── NO → Check CVSS
137 ├── CVSS ≥9.0 → HIGH
138 ├── CVSS 7.0-8.9 → Consider asset value
139 └── CVSS <7.0 → Schedule for later
140```
141
142---
143
144## 6. Exceptional Conditions (A10 - New)
145
146### Fail-Open vs Fail-Closed
147
148| Scenario | Fail-Open (BAD) | Fail-Closed (GOOD) |
149|----------|-----------------|---------------------|
150| Auth error | Allow access | Deny access |
151| Parsing fails | Accept input | Reject input |
152| Timeout | Retry forever | Limit + abort |
153
154### What to Check
155
156- Exception handlers that catch-all and ignore
157- Missing error handling on security operations
158- Race conditions in auth/authz
159- Resource exhaustion scenarios
160---
161
162## 7. Scanning Methodology
163
164### Phase-Based Approach
165
166```
1671. RECONNAISSANCE
168 └── Understand the target
169 ├── Technology stack
170 ├── Entry points
171 └── Data flows
172
1732. DISCOVERY
174 └── Identify potential issues
175 ├── Configuration review
176 ├── Dependency analysis
177 └── Code pattern search
178
1793. ANALYSIS
180 └── Validate and prioritize
181 ├── False positive elimination
182 ├── Risk scoring
183 └── Attack chain mapping
184
1854. REPORTING
186 └── Actionable findings
187 ├── Clear reproduction steps
188 ├── Business impact
189 └── Remediation guidance
190```
191
192---
193
194## 8. Code Pattern Analysis
195
196### High-Risk Patterns
197
198| Pattern | Risk | Look For |
199|---------|------|----------|
200| **String concat in queries** | Injection | `"SELECT * FROM " + user_input` |
201| **Dynamic code execution** | RCE | `eval()`, `exec()`, `Function()` |
202| **Unsafe deserialization** | RCE | `pickle.loads()`, `unserialize()` |
203| **Path manipulation** | Traversal | User input in file paths |
204| **Disabled security** | Various | `verify=False`, `--insecure` |
205
206### Secret Patterns
207
208| Type | Indicators |
209|------|-----------|
210| API Keys | `api_key`, `apikey`, high entropy |
211| Tokens | `token`, `bearer`, `jwt` |
212| Credentials | `password`, `secret`, `key` |
213| Cloud | `AWS_`, `AZURE_`, `GCP_` prefixes |
214
215---
216
217## 9. Cloud Security Considerations
218
219### Shared Responsibility
220
221| Layer | You Own | Provider Owns |
222|-------|---------|---------------|
223| Data | ✅ | ❌ |
224| Application | ✅ | ❌ |
225| OS/Runtime | Depends | Depends |
226| Infrastructure | ❌ | ✅ |
227
228### Cloud-Specific Checks
229
230- IAM: Least privilege applied?
231- Storage: Public buckets?
232- Network: Security groups tightened?
233- Secrets: Using secrets manager?
234---
235
236## 10. Anti-Patterns
237
238| ❌ Don't | ✅ Do |
239|----------|-------|
240| Scan without understanding | Map attack surface first |
241| Alert on every CVE | Prioritize by exploitability + asset |
242| Ignore false positives | Maintain verified baseline |
243| Fix symptoms only | Address root causes |
244| Scan once before deploy | Continuous scanning |
245| Trust third-party deps blindly | Verify integrity, audit code |
246
247---
248
249## 11. Reporting Principles
250
251### Finding Structure
252
253Each finding should answer:
2541. **What?** - Clear vulnerability description
2552. **Where?** - Exact location (file, line, endpoint)
2563. **Why?** - Root cause explanation
2574. **Impact?** - Business consequence
2585. **How to fix?** - Specific remediation
259### Severity Classification
260
261| Severity | Criteria |
262|----------|----------|
263| **Critical** | RCE, auth bypass, mass data exposure |
264| **High** | Data exposure, privilege escalation |
265| **Medium** | Limited scope, requires conditions |
266| **Low** | Informational, best practice |
267
268---
269
270> **Remember:** Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
271
272## When to Use
273This skill is applicable to execute the workflow or actions described in the overview.
aibot88