AtulPurohit Security Auditor
Purpose
Systematically identify and document security vulnerabilities with clear severity ratings and remediation guidance.
⚠️ IMPORTANT: Only perform security testing on systems you have explicit written authorization to test.
Audit Framework
1️⃣ OWASP Top 10 (2021)
A01: Broken Access Control
- IDOR (access user B's data as user A)
- Missing authorization on admin endpoints
- CORS misconfiguration
A02: Cryptographic Failures
- HTTP instead of HTTPS
- Weak cipher suites (RC4, MD5)
- Passwords stored as plain text or MD5
- Sensitive data in URL params/logs
A03: Injection
- SQL injection
- Command injection
- LDAP injection
- Template injection
A04: Insecure Design
- Missing rate limiting
- Business logic bypasses
- Missing input validation
A05: Security Misconfiguration
- Default credentials
- Exposed debug endpoints
- Verbose error messages
- Unnecessary services running
A06: Vulnerable Components
- npm/pip packages with known CVEs
- Outdated frameworks
- Unpatched dependencies
2️⃣ Automated Scanning Tools
# Dependency vulnerability scan
npm audit --audit-level=high
pip-audit
bundle audit
# SAST (Static analysis)
semgrep --config=auto ./src
# Secret scanning
truffleHog scan --disk .
git-secrets --scan
# Docker image scanning
docker scout cves my-image:latest
# DAST (Dynamic analysis)
nikto -h https://api.example.com
owasp-zap-scan https://api.example.com
3️⃣ Manual Testing Checklist
Authentication:
[ ] Brute force protection (lockout after N failures)
[ ] Secure password reset flow (time-limited tokens)
[ ] JWT algorithm confusion possible?
[ ] Session invalidation on logout
Authorization:
[ ] Every endpoint checks authorization
[ ] IDOR possible (access /orders/123 as different user)
[ ] Admin endpoints accessible to non-admins?
Input Validation:
[ ] SQL injection in all query parameters
[ ] XSS in all user-controlled display fields
[ ] File upload: MIME type, size, content validation
[ ] Path traversal in file operations
4️⃣ Vulnerability Report Format
## [CRITICAL] SQL Injection — POST /api/search
**CVSS Score:** 9.8 (Critical)
**CWE:** CWE-89
### Steps to Reproduce
1. POST /api/search with body: {"query": "test' OR '1'='1"}
2. Observe: Returns all records
### Impact
Full database read/write access as database user
### Evidence
Response includes records from other users
### Remediation
Use parameterized queries:
❌ db.query(`WHERE name = '${input}'`)
✅ db.query('WHERE name = ?', [input])
### References
- OWASP: https://owasp.org/www-community/attacks/SQL_Injection
Outputs
- Executive summary with risk rating
- Technical vulnerability report (CVSS scored)
- Prioritized remediation roadmap
- Verification test cases
- Security baseline recommendations