Security & Vulnerability Testing

Production-grade security testing with agentic vulnerability detection, SAST/DAST tools, OWASP Top 10 coverage, threat modeling, and AI-powered security analysis achieving 92% detection accuracy (OpenAI Aardvark benchmark 2024)

bobmatnyc Updated Sep 10, 2026 71 repo stars

Install

Press C to copy

$ npx skillmds@latest add bobmatnyc/security-vulnerability-testing

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download SKILL.md

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/bobmatnyc/security-vulnerability-testing.svg)](https://skillmd.com/skills/bobmatnyc/security-vulnerability-testing)

Trust & safety

1 of 3 audits passed

Last audited Sep 25, 2026 · commit e744669

Permissions this skill uses

Makes network calls
The instructions fetch remote URLs or call external services.
Reads secrets
The instructions read tokens, keys, or other credentials.

License: MIT
Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Security & Vulnerability Testing

Overview

Master security testing with AI-powered vulnerability detection, automated SAST/DAST scanning, and threat modeling. OpenAI's Aardvark achieves 92% vulnerability detection accuracy (2024), and multi-agent security tools find 4x more vulnerabilities than traditional scanners.

When to Use This Skill

Performing security audits on web applications and APIs
Identifying OWASP Top 10 vulnerabilities before production
Implementing security gates in CI/CD pipelines
Conducting threat modeling for new features
Reviewing code for security anti-patterns
Testing authentication and authorization logic
Scanning infrastructure as code for misconfigurations
Preparing for penetration testing or security compliance

Core Principles

1. OWASP Top 10 (2021) Coverage

# A01:2021 – Broken Access Control
# ❌ BAD: Missing authorization check
@app.get("/api/users/{user_id}/profile")
async def get_profile(user_id: int):
    return await db.get(User, user_id)  # Anyone can access any profile!

# ✅ GOOD: Verify user authorization
@app.get("/api/users/{user_id}/profile")
async def get_profile(user_id: int, current_user: User = Depends(get_current_user)):
    if current_user.id != user_id and not current_user.is_admin:
        raise HTTPException(403, "Forbidden")
    return await db.get(User, user_id)

# A02:2021 – Cryptographic Failures
# ❌ BAD: Weak password hashing
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()  # NEVER USE MD5!

# ✅ GOOD: Strong password hashing with bcrypt
from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
password_hash = pwd_context.hash(password)

# A03:2021 – Injection
# ❌ BAD: SQL injection vulnerability
query = f"SELECT * FROM users WHERE email = '{email}'"  # NEVER!
cursor.execute(query)

# ✅ GOOD: Parameterized queries
query = "SELECT * FROM users WHERE email = %s"
cursor.execute(query, (email,))

# Or use ORM (SQLAlchemy, Django ORM)
user = await db.execute(select(User).where(User.email == email))

# A04:2021 – Insecure Design
# ✅ Implement rate limiting
from slowapi import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.post("/api/login")
@limiter.limit("5/minute")
async def login(credentials: LoginRequest):
    # Prevent brute force attacks
    pass

# A05:2021 – Security Misconfiguration
# ❌ BAD: Debug mode in production
app = FastAPI(debug=True)  # NEVER in production!

# ✅ GOOD: Environment-aware configuration
app = FastAPI(debug=settings.DEBUG)

# A06:2021 – Vulnerable and Outdated Components
# ✅ Run: pip-audit, snyk test, npm audit

# A07:2021 – Identification and Authentication Failures
# ✅ Use OAuth2 with JWT, implement MFA

# A08:2021 – Software and Data Integrity Failures
# ✅ Sign releases, verify checksums, use SRI for CDN resources

# A09:2021 – Security Logging and Monitoring Failures
# ✅ Log all authentication attempts, failed access, sensitive operations

# A10:2021 – Server-Side Request Forgery (SSRF)
# ❌ BAD: Unchecked URL fetching
url = request.json.get("url")
response = await httpx.get(url)  # Can access internal services!

# ✅ GOOD: Whitelist allowed domains
ALLOWED_DOMAINS = ["api.example.com", "cdn.example.com"]

def is_safe_url(url: str) -> bool:
    parsed = urllib.parse.urlparse(url)
    return parsed.netloc in ALLOWED_DOMAINS

if not is_safe_url(url):
    raise HTTPException(400, "Invalid URL")

2. Static Analysis Security Testing (SAST)

# Python: Bandit
pip install bandit
bandit -r ./app -f json -o security-report.json

# Example issues Bandit detects:
# - Hardcoded passwords
# - Use of eval() or exec()
# - SQL injection risks
# - Weak cryptography

# JavaScript/TypeScript: ESLint Security Plugin
npm install --save-dev eslint-plugin-security
# Add to .eslintrc.json:
# "plugins": ["security"]

# Infrastructure: Checkov (Terraform, CloudFormation, Kubernetes)
pip install checkov
checkov -d ./terraform --output json

# Secrets: GitGuardian or detect-secrets
pip install detect-secrets
detect-secrets scan --baseline .secrets.baseline

# Multi-language: Snyk
npm install -g snyk
snyk test
snyk code test  # SAST
snyk container test myapp:latest  # Container scanning

SAST Integration in CI/CD:

# GitHub Actions
- name: Run Bandit Security Scan
  run: |
    pip install bandit
    bandit -r . -f json -o bandit-report.json
  continue-on-error: true

- name: Upload Security Report
  uses: actions/upload-artifact@v3
  with:
    name: security-reports
    path: bandit-report.json

3. Dynamic Analysis Security Testing (DAST)

# OWASP ZAP (Zed Attack Proxy)
docker run -t owasp/zap2docker-stable zap-baseline.py \
  -t https://example.com \
  -r zap-report.html

# Nikto (web server scanner)
nikto -h https://example.com -o nikto-report.txt

# Nuclei (fast vulnerability scanner)
nuclei -u https://example.com -t ~/nuclei-templates/

# Burp Suite (commercial, GUI-based)
# Manual testing and automated scanning

DAST Best Practices:

Run against staging environment, not production
Use authenticated scans (provide session cookies)
Schedule regular scans (weekly or per deployment)
Combine with SAST for comprehensive coverage

4. Threat Modeling with STRIDE

STRIDE Framework (Microsoft):

S - Spoofing Identity
  ✅ Use multi-factor authentication
  ✅ Implement certificate pinning
  ❌ Never trust client-provided identity

T - Tampering with Data
  ✅ Use HTTPS/TLS for all communication
  ✅ Implement request signing (HMAC)
  ❌ Never accept unsigned data from clients

R - Repudiation
  ✅ Log all critical operations with timestamps
  ✅ Implement audit trails
  ❌ Never allow users to deny actions

I - Information Disclosure
  ✅ Encrypt sensitive data at rest and in transit
  ✅ Implement proper access controls
  ❌ Never expose internal error details

D - Denial of Service
  ✅ Implement rate limiting and throttling
  ✅ Use CDN and DDoS protection (Cloudflare)
  ❌ Never allow unbounded resource consumption

E - Elevation of Privilege
  ✅ Follow principle of least privilege
  ✅ Validate permissions at every access point
  ❌ Never trust user roles from client

Threat Modeling Process:

Diagram system architecture (data flows)
Identify threats using STRIDE for each component
Prioritize threats (likelihood × impact)
Mitigate high-priority threats
Validate mitigations with testing

5. Secret Management

# ❌ BAD: Secrets in code
API_KEY = "sk-1234567890abcdef"  # NEVER!
DATABASE_URL = "postgresql://user:pass@host/db"

# ❌ BAD: Secrets in version control
# .env file committed to git

# ✅ GOOD: Environment variables (12-factor app)
import os
API_KEY = os.getenv("API_KEY")
DATABASE_URL = os.getenv("DATABASE_URL")

# ✅ GOOD: Secret management services
# AWS Secrets Manager
import boto3
client = boto3.client('secretsmanager')
secret = client.get_secret_value(SecretId='prod/api-key')
API_KEY = secret['SecretString']

# HashiCorp Vault
import hvac
client = hvac.Client(url='http://vault:8200', token=vault_token)
secret = client.secrets.kv.v2.read_secret_version(path='api-key')
API_KEY = secret['data']['data']['key']

# Kubernetes Secrets
# Mounted as files or environment variables

Secret Scanning:

# GitGuardian (detects 500+ secret types)
pip install ggshield
ggshield secret scan path .

# TruffleHog (git history scanning)
docker run -it trufflesecurity/trufflehog:latest github --repo https://github.com/myorg/myrepo

# Gitleaks
gitleaks detect --source . --report-path gitleaks-report.json

Security Testing Checklist

Authentication & Authorization

✅ Password strength requirements enforced
✅ Rate limiting on login endpoints (5 attempts/minute)
✅ MFA available for sensitive operations
✅ JWT tokens expire (15-60 minutes)
✅ Refresh tokens rotated on use
✅ Authorization checked on every endpoint
✅ Session invalidated on logout
✅ CSRF tokens implemented for state-changing operations

Input Validation

✅ All inputs validated (length, type, format)
✅ Parameterized queries (no string concatenation)
✅ File upload restrictions (type, size, virus scanning)
✅ HTML/JavaScript sanitized before rendering
✅ URL validation (whitelist allowed domains)
✅ API rate limiting per user/IP

Data Protection

✅ HTTPS/TLS 1.2+ enforced
✅ Sensitive data encrypted at rest (AES-256)
✅ Passwords hashed with bcrypt/argon2
✅ PII minimized and properly protected
✅ Database backups encrypted
✅ Secure cookie flags (HttpOnly, Secure, SameSite)

Infrastructure

✅ Firewall rules follow least privilege
✅ Security groups/network policies configured
✅ Unused services disabled
✅ Regular security patches applied
✅ Secrets not in version control
✅ Container images scanned for vulnerabilities

Logging & Monitoring

✅ Failed authentication attempts logged
✅ Authorization failures logged
✅ Sensitive operations audited
✅ Security alerts configured
✅ Logs centralized and tamper-proof
✅ GDPR/compliance requirements met

AI-Powered Security Testing (2024)

OpenAI Aardvark Architecture

Agentic Security Testing Workflow:

1. Code Analysis
   - Read codebase and understand behavior
   - Identify potential vulnerability surfaces

2. Test Generation
   - Generate test cases targeting vulnerabilities
   - Create exploit attempts

3. Test Execution
   - Run tests in sandbox environment
   - Observe application behavior

4. Reasoning Loop
   - Analyze results
   - Generate new hypotheses
   - Iterate until vulnerability confirmed or ruled out

Benchmark: 92% detection rate on synthetic vulnerabilities

Multi-Agent Security (SecureVibes)

Agent Roles:
1. Architecture Mapper: Build system model
2. Threat Modeler: Apply STRIDE framework
3. Code Reviewer: Static analysis with AI reasoning
4. Penetration Tester: Generate and execute exploits

Result: 16-17 vulnerabilities found (4x vs single-agent)

Common Vulnerabilities & Fixes

SQL Injection

# ❌ Vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"
db.execute(query)

# ✅ Fixed
query = "SELECT * FROM users WHERE id = %s"
db.execute(query, (user_id,))

Cross-Site Scripting (XSS)

// ❌ Vulnerable
document.innerHTML = userInput;

// ✅ Fixed
document.textContent = userInput;
// Or use a sanitization library
import DOMPurify from 'dompurify';
document.innerHTML = DOMPurify.sanitize(userInput);

Insecure Direct Object Reference (IDOR)

# ❌ Vulnerable
@app.get("/files/{file_id}")
async def download(file_id: int):
    return FileResponse(f"/uploads/{file_id}.pdf")

# ✅ Fixed
@app.get("/files/{file_id}")
async def download(file_id: int, user: User = Depends(get_current_user)):
    file = await db.get(File, file_id)
    if file.owner_id != user.id:
        raise HTTPException(403, "Forbidden")
    return FileResponse(file.path)

XML External Entity (XXE)

# ❌ Vulnerable
import xml.etree.ElementTree as ET
tree = ET.parse(user_uploaded_xml)

# ✅ Fixed
from defusedxml.ElementTree import parse
tree = parse(user_uploaded_xml)

Penetration Testing Workflow

# 1. Reconnaissance
nmap -sV -sC target.com
whatweb target.com
whois target.com

# 2. Vulnerability Scanning
nuclei -u https://target.com -t ~/nuclei-templates/
nikto -h https://target.com

# 3. Exploitation (ethical, authorized only!)
# Use Metasploit, Burp Suite, custom scripts

# 4. Post-Exploitation
# Document findings, severity, remediation

# 5. Reporting
# Create detailed report with PoC, impact, fixes

Security Code Review Guidelines

# Security-focused code review checklist:

# 1. Authentication
# - Are passwords hashed properly?
# - Is rate limiting implemented?
# - Are sessions managed securely?

# 2. Authorization
# - Is every endpoint protected?
# - Are permissions checked correctly?
# - Can users access other users' data?

# 3. Input Validation
# - Are all inputs validated?
# - Is SQL injection prevented?
# - Is XSS prevented?

# 4. Output Encoding
# - Is user data sanitized before display?
# - Are error messages generic?

# 5. Cryptography
# - Are modern algorithms used (AES-256, RSA-2048+)?
# - Are keys stored securely?
# - Is HTTPS enforced?

# 6. Error Handling
# - Are exceptions caught and logged?
# - Do error messages leak information?

# 7. Logging
# - Are security events logged?
# - Are logs protected from tampering?

Related Skills

test-driven-development: Write security tests first
systematic-debugging: Debug security issues systematically
fastapi-web-development: Secure FastAPI applications
terraform-infrastructure: Scan IaC for security issues

Additional Resources

OWASP Top 10: https://owasp.org/www-project-top-ten
OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide
OWASP ZAP: https://www.zaproxy.org
Snyk: https://snyk.io
GitGuardian: https://www.gitguardian.com
OpenAI Aardvark (2024): https://openai.com/index/agentic-ai-for-security-research

Example Questions

"How do I prevent SQL injection in this endpoint?"
"Scan this code for OWASP Top 10 vulnerabilities"
"Show me how to implement rate limiting for authentication"
"How do I securely store API keys in production?"
"What's the difference between SAST and DAST?"
"Perform a threat model using STRIDE for this feature"
"How do I detect secrets accidentally committed to git?"

---name: security-vulnerability-testingdescription: Production-grade security testing with agentic vulnerability detection, SAST/DAST tools, OWASP Top 10 coverage, threat modeling, and AI-powered security analysis achieving 92% detection accuracy (OpenAI Aardvark benchmark 2024)license: MIT---# Security & Vulnerability Testing## OverviewMaster security testing with AI-powered vulnerability detection, automated SAST/DAST scanning, and threat modeling. OpenAI's Aardvark achieves 92% vulnerability detection accuracy (2024), and multi-agent security tools find 4x more vulnerabilities than traditional scanners.## When to Use This Skill- Performing security audits on web applications and APIs- Identifying OWASP Top 10 vulnerabilities before production- Implementing security gates in CI/CD pipelines- Conducting threat modeling for new features- Reviewing code for security anti-patterns- Testing authentication and authorization logic- Scanning infrastructure as code for misconfigurations- Preparing for penetration testing or security compliance## Core Principles### 1. OWASP Top 10 (2021) Coverage```python# A01:2021 – Broken Access Control# ❌ BAD: Missing authorization check@app.get("/api/users/{user_id}/profile")async def get_profile(user_id: int): return await db.get(User, user_id) # Anyone can access any profile!# ✅ GOOD: Verify user authorization@app.get("/api/users/{user_id}/profile")async def get_profile(user_id: int, current_user: User = Depends(get_current_user)): if current_user.id != user_id and not current_user.is_admin: raise HTTPException(403, "Forbidden") return await db.get(User, user_id)# A02:2021 – Cryptographic Failures# ❌ BAD: Weak password hashingimport hashlibpassword_hash = hashlib.md5(password.encode()).hexdigest() # NEVER USE MD5!# ✅ GOOD: Strong password hashing with bcryptfrom passlib.context import CryptContextpwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")password_hash = pwd_context.hash(password)# A03:2021 – Injection# ❌ BAD: SQL injection vulnerabilityquery = f"SELECT * FROM users WHERE email = '{email}'" # NEVER!cursor.execute(query)# ✅ GOOD: Parameterized queriesquery = "SELECT * FROM users WHERE email = %s"cursor.execute(query, (email,))# Or use ORM (SQLAlchemy, Django ORM)user = await db.execute(select(User).where(User.email == email))# A04:2021 – Insecure Design# ✅ Implement rate limitingfrom slowapi import Limiterlimiter = Limiter(key_func=get_remote_address)@app.post("/api/login")@limiter.limit("5/minute")async def login(credentials: LoginRequest): # Prevent brute force attacks pass# A05:2021 – Security Misconfiguration# ❌ BAD: Debug mode in productionapp = FastAPI(debug=True) # NEVER in production!# ✅ GOOD: Environment-aware configurationapp = FastAPI(debug=settings.DEBUG)# A06:2021 – Vulnerable and Outdated Components# ✅ Run: pip-audit, snyk test, npm audit# A07:2021 – Identification and Authentication Failures# ✅ Use OAuth2 with JWT, implement MFA# A08:2021 – Software and Data Integrity Failures# ✅ Sign releases, verify checksums, use SRI for CDN resources# A09:2021 – Security Logging and Monitoring Failures# ✅ Log all authentication attempts, failed access, sensitive operations# A10:2021 – Server-Side Request Forgery (SSRF)# ❌ BAD: Unchecked URL fetchingurl = request.json.get("url")response = await httpx.get(url) # Can access internal services!# ✅ GOOD: Whitelist allowed domainsALLOWED_DOMAINS = ["api.example.com", "cdn.example.com"]def is_safe_url(url: str) -> bool: parsed = urllib.parse.urlparse(url) return parsed.netloc in ALLOWED_DOMAINSif not is_safe_url(url): raise HTTPException(400, "Invalid URL")```### 2. Static Analysis Security Testing (SAST)```bash# Python: Banditpip install banditbandit -r ./app -f json -o security-report.json# Example issues Bandit detects:# - Hardcoded passwords# - Use of eval() or exec()# - SQL injection risks# - Weak cryptography# JavaScript/TypeScript: ESLint Security Pluginnpm install --save-dev eslint-plugin-security# Add to .eslintrc.json:# "plugins": ["security"]# Infrastructure: Checkov (Terraform, CloudFormation, Kubernetes)pip install checkovcheckov -d ./terraform --output json# Secrets: GitGuardian or detect-secretspip install detect-secretsdetect-secrets scan --baseline .secrets.baseline# Multi-language: Snyknpm install -g snyksnyk testsnyk code test # SASTsnyk container test myapp:latest # Container scanning```**SAST Integration in CI/CD**:```yaml# GitHub Actions- name: Run Bandit Security Scan run: | pip install bandit bandit -r . -f json -o bandit-report.json continue-on-error: true- name: Upload Security Report uses: actions/upload-artifact@v3 with: name: security-reports path: bandit-report.json```### 3. Dynamic Analysis Security Testing (DAST)```bash# OWASP ZAP (Zed Attack Proxy)docker run -t owasp/zap2docker-stable zap-baseline.py \ -t https://example.com \ -r zap-report.html# Nikto (web server scanner)nikto -h https://example.com -o nikto-report.txt# Nuclei (fast vulnerability scanner)nuclei -u https://example.com -t ~/nuclei-templates/# Burp Suite (commercial, GUI-based)# Manual testing and automated scanning```**DAST Best Practices**:- Run against staging environment, not production- Use authenticated scans (provide session cookies)- Schedule regular scans (weekly or per deployment)- Combine with SAST for comprehensive coverage### 4. Threat Modeling with STRIDE```STRIDE Framework (Microsoft):S - Spoofing Identity ✅ Use multi-factor authentication ✅ Implement certificate pinning ❌ Never trust client-provided identityT - Tampering with Data ✅ Use HTTPS/TLS for all communication ✅ Implement request signing (HMAC) ❌ Never accept unsigned data from clientsR - Repudiation ✅ Log all critical operations with timestamps ✅ Implement audit trails ❌ Never allow users to deny actionsI - Information Disclosure ✅ Encrypt sensitive data at rest and in transit ✅ Implement proper access controls ❌ Never expose internal error detailsD - Denial of Service ✅ Implement rate limiting and throttling ✅ Use CDN and DDoS protection (Cloudflare) ❌ Never allow unbounded resource consumptionE - Elevation of Privilege ✅ Follow principle of least privilege ✅ Validate permissions at every access point ❌ Never trust user roles from client```**Threat Modeling Process**:1. Diagram system architecture (data flows)2. Identify threats using STRIDE for each component3. Prioritize threats (likelihood × impact)4. Mitigate high-priority threats5. Validate mitigations with testing### 5. Secret Management```python# ❌ BAD: Secrets in codeAPI_KEY = "sk-1234567890abcdef" # NEVER!DATABASE_URL = "postgresql://user:pass@host/db"# ❌ BAD: Secrets in version control# .env file committed to git# ✅ GOOD: Environment variables (12-factor app)import osAPI_KEY = os.getenv("API_KEY")DATABASE_URL = os.getenv("DATABASE_URL")# ✅ GOOD: Secret management services# AWS Secrets Managerimport boto3client = boto3.client('secretsmanager')secret = client.get_secret_value(SecretId='prod/api-key')API_KEY = secret['SecretString']# HashiCorp Vaultimport hvacclient = hvac.Client(url='http://vault:8200', token=vault_token)secret = client.secrets.kv.v2.read_secret_version(path='api-key')API_KEY = secret['data']['data']['key']# Kubernetes Secrets# Mounted as files or environment variables```**Secret Scanning**:```bash# GitGuardian (detects 500+ secret types)pip install ggshieldggshield secret scan path .# TruffleHog (git history scanning)docker run -it trufflesecurity/trufflehog:latest github --repo https://github.com/myorg/myrepo# Gitleaksgitleaks detect --source . --report-path gitleaks-report.json```## Security Testing Checklist### Authentication & Authorization- ✅ Password strength requirements enforced- ✅ Rate limiting on login endpoints (5 attempts/minute)- ✅ MFA available for sensitive operations- ✅ JWT tokens expire (15-60 minutes)- ✅ Refresh tokens rotated on use- ✅ Authorization checked on every endpoint- ✅ Session invalidated on logout- ✅ CSRF tokens implemented for state-changing operations### Input Validation- ✅ All inputs validated (length, type, format)- ✅ Parameterized queries (no string concatenation)- ✅ File upload restrictions (type, size, virus scanning)- ✅ HTML/JavaScript sanitized before rendering- ✅ URL validation (whitelist allowed domains)- ✅ API rate limiting per user/IP### Data Protection- ✅ HTTPS/TLS 1.2+ enforced- ✅ Sensitive data encrypted at rest (AES-256)- ✅ Passwords hashed with bcrypt/argon2- ✅ PII minimized and properly protected- ✅ Database backups encrypted- ✅ Secure cookie flags (HttpOnly, Secure, SameSite)### Infrastructure- ✅ Firewall rules follow least privilege- ✅ Security groups/network policies configured- ✅ Unused services disabled- ✅ Regular security patches applied- ✅ Secrets not in version control- ✅ Container images scanned for vulnerabilities### Logging & Monitoring- ✅ Failed authentication attempts logged- ✅ Authorization failures logged- ✅ Sensitive operations audited- ✅ Security alerts configured- ✅ Logs centralized and tamper-proof- ✅ GDPR/compliance requirements met## AI-Powered Security Testing (2024)### OpenAI Aardvark Architecture```Agentic Security Testing Workflow:1. Code Analysis - Read codebase and understand behavior - Identify potential vulnerability surfaces2. Test Generation - Generate test cases targeting vulnerabilities - Create exploit attempts3. Test Execution - Run tests in sandbox environment - Observe application behavior4. Reasoning Loop - Analyze results - Generate new hypotheses - Iterate until vulnerability confirmed or ruled outBenchmark: 92% detection rate on synthetic vulnerabilities```### Multi-Agent Security (SecureVibes)```Agent Roles:1. Architecture Mapper: Build system model2. Threat Modeler: Apply STRIDE framework3. Code Reviewer: Static analysis with AI reasoning4. Penetration Tester: Generate and execute exploitsResult: 16-17 vulnerabilities found (4x vs single-agent)```## Common Vulnerabilities & Fixes### SQL Injection```python# ❌ Vulnerablequery = f"SELECT * FROM users WHERE id = {user_id}"db.execute(query)# ✅ Fixedquery = "SELECT * FROM users WHERE id = %s"db.execute(query, (user_id,))```### Cross-Site Scripting (XSS)```javascript// ❌ Vulnerabledocument.innerHTML = userInput;// ✅ Fixeddocument.textContent = userInput;// Or use a sanitization libraryimport DOMPurify from 'dompurify';document.innerHTML = DOMPurify.sanitize(userInput);```### Insecure Direct Object Reference (IDOR)```python# ❌ Vulnerable@app.get("/files/{file_id}")async def download(file_id: int): return FileResponse(f"/uploads/{file_id}.pdf")# ✅ Fixed@app.get("/files/{file_id}")async def download(file_id: int, user: User = Depends(get_current_user)): file = await db.get(File, file_id) if file.owner_id != user.id: raise HTTPException(403, "Forbidden") return FileResponse(file.path)```### XML External Entity (XXE)```python# ❌ Vulnerableimport xml.etree.ElementTree as ETtree = ET.parse(user_uploaded_xml)# ✅ Fixedfrom defusedxml.ElementTree import parsetree = parse(user_uploaded_xml)```## Penetration Testing Workflow```bash# 1. Reconnaissancenmap -sV -sC target.comwhatweb target.comwhois target.com# 2. Vulnerability Scanningnuclei -u https://target.com -t ~/nuclei-templates/nikto -h https://target.com# 3. Exploitation (ethical, authorized only!)# Use Metasploit, Burp Suite, custom scripts# 4. Post-Exploitation# Document findings, severity, remediation# 5. Reporting# Create detailed report with PoC, impact, fixes```## Security Code Review Guidelines```python# Security-focused code review checklist:# 1. Authentication# - Are passwords hashed properly?# - Is rate limiting implemented?# - Are sessions managed securely?# 2. Authorization# - Is every endpoint protected?# - Are permissions checked correctly?# - Can users access other users' data?# 3. Input Validation# - Are all inputs validated?# - Is SQL injection prevented?# - Is XSS prevented?# 4. Output Encoding# - Is user data sanitized before display?# - Are error messages generic?# 5. Cryptography# - Are modern algorithms used (AES-256, RSA-2048+)?# - Are keys stored securely?# - Is HTTPS enforced?# 6. Error Handling# - Are exceptions caught and logged?# - Do error messages leak information?# 7. Logging# - Are security events logged?# - Are logs protected from tampering?```## Related Skills- **test-driven-development**: Write security tests first- **systematic-debugging**: Debug security issues systematically- **fastapi-web-development**: Secure FastAPI applications- **terraform-infrastructure**: Scan IaC for security issues## Additional Resources- OWASP Top 10: https://owasp.org/www-project-top-ten- OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide- OWASP ZAP: https://www.zaproxy.org- Snyk: https://snyk.io- GitGuardian: https://www.gitguardian.com- OpenAI Aardvark (2024): https://openai.com/index/agentic-ai-for-security-research## Example Questions- "How do I prevent SQL injection in this endpoint?"- "Scan this code for OWASP Top 10 vulnerabilities"- "Show me how to implement rate limiting for authentication"- "How do I securely store API keys in production?"- "What's the difference between SAST and DAST?"- "Perform a threat model using STRIDE for this feature"- "How do I detect secrets accidentally committed to git?"

bobmatnyc/mcp-skillset/tree/main/docs/skill-templates/security-testing commit e7446691ca

Frequently asked questions

npx skillmds@latest add bobmatnyc/security-vulnerability-testing