Vulnerability Scanner
Think like an attacker, defend like an expert. 2025 threat landscape awareness.
🔧 Runtime Scripts
Execute for automated validation:
| Script |
Purpose |
Usage |
scripts/security_scan.py |
Validate security principles applied |
python scripts/security_scan.py <project_path> |
📋 Reference Files
| File |
Purpose |
| checklists.md |
OWASP Top 10, Auth, API, Data protection checklists |
1. Security Expert Mindset
Core Principles
| Principle |
Application |
| Assume Breach |
Design as if attacker already inside |
| Zero Trust |
Never trust, always verify |
| Defense in Depth |
Multiple layers, no single point |
| Least Privilege |
Minimum required access only |
| Fail Secure |
On error, deny access |
Threat Modeling Questions
Before scanning, ask:
- What are we protecting? (Assets)
- Who would attack? (Threat actors)
- How would they attack? (Attack vectors)
- What's the impact? (Business risk)
2. OWASP Top 10:2025
Risk Categories
| Rank |
Category |
Think About |
| A01 |
Broken Access Control |
Who can access what? IDOR, SSRF |
| A02 |
Security Misconfiguration |
Defaults, headers, exposed services |
| A03 |
Software Supply Chain 🆕 |
Dependencies, CI/CD, build integrity |
| A04 |
Cryptographic Failures |
Weak crypto, exposed secrets |
| A05 |
Injection |
User input → system commands |
| A06 |
Insecure Design |
Flawed architecture |
| A07 |
Authentication Failures |
Session, credential management |
| A08 |
Integrity Failures |
Unsigned updates, tampered data |
| A09 |
Logging & Alerting |
Blind spots, no monitoring |
| A10 |
Exceptional Conditions 🆕 |
Error handling, fail-open states |
2025 Key Changes
2021 → 2025 Shifts:
├── SSRF merged into A01 (Access Control)
├── A02 elevated (Cloud/Container configs)
├── A03 NEW: Supply Chain (major focus)
├── A10 NEW: Exceptional Conditions
└── Focus shift: Root causes > Symptoms
3. Supply Chain Security (A03)
Attack Surface
| Vector |
Risk |
Question to Ask |
| Dependencies |
Malicious packages |
Do we audit new deps? |
| Lock files |
Integrity attacks |
Are they committed? |
| Build pipeline |
CI/CD compromise |
Who can modify? |
| Registry |
Typosquatting |
Verified sources? |
Defense Principles
- Verify package integrity (checksums)
- Pin versions, audit updates
- Use private registries for critical deps
- Sign and verify artifacts
4. Attack Surface Mapping
What to Map
| Category |
Elements |
| Entry Points |
APIs, forms, file uploads |
| Data Flows |
Input → Process → Output |
| Trust Boundaries |
Where auth/authz checked |
| Assets |
Secrets, PII, business data |
Prioritization Matrix
Risk = Likelihood × Impact
High Impact + High Likelihood → CRITICAL
High Impact + Low Likelihood → HIGH
Low Impact + High Likelihood → MEDIUM
Low Impact + Low Likelihood → LOW
5. Risk Prioritization
CVSS + Context
| Factor |
Weight |
Question |
| CVSS Score |
Base severity |
How severe is the vuln? |
| EPSS Score |
Exploit likelihood |
Is it being exploited? |
| Asset Value |
Business context |
What's at risk? |
| Exposure |
Attack surface |
Internet-facing? |
Prioritization Decision Tree
Is it actively exploited (EPSS >0.5)?
├── YES → CRITICAL: Immediate action
└── NO → Check CVSS
├── CVSS ≥9.0 → HIGH
├── CVSS 7.0-8.9 → Consider asset value
└── CVSS <7.0 → Schedule for later
6. Exceptional Conditions (A10 - New)
Fail-Open vs Fail-Closed
| Scenario |
Fail-Open (BAD) |
Fail-Closed (GOOD) |
| Auth error |
Allow access |
Deny access |
| Parsing fails |
Accept input |
Reject input |
| Timeout |
Retry forever |
Limit + abort |
What to Check
- Exception handlers that catch-all and ignore
- Missing error handling on security operations
- Race conditions in auth/authz
- Resource exhaustion scenarios
7. Scanning Methodology
Phase-Based Approach
1. RECONNAISSANCE
└── Understand the target
├── Technology stack
├── Entry points
└── Data flows
2. DISCOVERY
└── Identify potential issues
├── Configuration review
├── Dependency analysis
└── Code pattern search
3. ANALYSIS
└── Validate and prioritize
├── False positive elimination
├── Risk scoring
└── Attack chain mapping
4. REPORTING
└── Actionable findings
├── Clear reproduction steps
├── Business impact
└── Remediation guidance
8. Code Pattern Analysis
High-Risk Patterns
| Pattern |
Risk |
Look For |
| String concat in queries |
Injection |
"SELECT * FROM " + user_input |
| Dynamic code execution |
RCE |
eval(), exec(), Function() |
| Unsafe deserialization |
RCE |
pickle.loads(), unserialize() |
| Path manipulation |
Traversal |
User input in file paths |
| Disabled security |
Various |
verify=False, --insecure |
Secret Patterns
| Type |
Indicators |
| API Keys |
api_key, apikey, high entropy |
| Tokens |
token, bearer, jwt |
| Credentials |
password, secret, key |
| Cloud |
AWS_, AZURE_, GCP_ prefixes |
9. Cloud Security Considerations
Shared Responsibility
| Layer |
You Own |
Provider Owns |
| Data |
✅ |
❌ |
| Application |
✅ |
❌ |
| OS/Runtime |
Depends |
Depends |
| Infrastructure |
❌ |
✅ |
Cloud-Specific Checks
- IAM: Least privilege applied?
- Storage: Public buckets?
- Network: Security groups tightened?
- Secrets: Using secrets manager?
10. Anti-Patterns
| ❌ Don't |
✅ Do |
| Scan without understanding |
Map attack surface first |
| Alert on every CVE |
Prioritize by exploitability + asset |
| Ignore false positives |
Maintain verified baseline |
| Fix symptoms only |
Address root causes |
| Scan once before deploy |
Continuous scanning |
| Trust third-party deps blindly |
Verify integrity, audit code |
11. Reporting Principles
Finding Structure
Each finding should answer:
- What? - Clear vulnerability description
- Where? - Exact location (file, line, endpoint)
- Why? - Root cause explanation
- Impact? - Business consequence
- How to fix? - Specific remediation
Severity Classification
| Severity |
Criteria |
| Critical |
RCE, auth bypass, mass data exposure |
| High |
Data exposure, privilege escalation |
| Medium |
Limited scope, requires conditions |
| Low |
Informational, best practice |
Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
1---2name: vulnerability-scanner3description: Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.4---56# Vulnerability Scanner78> Think like an attacker, defend like an expert. 2025 threat landscape awareness.910## 🔧 Runtime Scripts1112**Execute for automated validation:**1314| Script | Purpose | Usage |15|--------|---------|-------|16| `scripts/security_scan.py` | Validate security principles applied | `python scripts/security_scan.py <project_path>` |1718## 📋 Reference Files1920| File | Purpose |21|------|---------|22| [checklists.md](checklists.md) | OWASP Top 10, Auth, API, Data protection checklists |2324---2526## 1. Security Expert Mindset2728### Core Principles2930| Principle | Application |31|-----------|-------------|32| **Assume Breach** | Design as if attacker already inside |33| **Zero Trust** | Never trust, always verify |34| **Defense in Depth** | Multiple layers, no single point |35| **Least Privilege** | Minimum required access only |36| **Fail Secure** | On error, deny access |3738### Threat Modeling Questions3940Before scanning, ask:411. What are we protecting? (Assets)422. Who would attack? (Threat actors)433. How would they attack? (Attack vectors)444. What's the impact? (Business risk)4546---4748## 2. OWASP Top 10:20254950### Risk Categories5152| Rank | Category | Think About |53|------|----------|-------------|54| **A01** | Broken Access Control | Who can access what? IDOR, SSRF |55| **A02** | Security Misconfiguration | Defaults, headers, exposed services |56| **A03** | Software Supply Chain 🆕 | Dependencies, CI/CD, build integrity |57| **A04** | Cryptographic Failures | Weak crypto, exposed secrets |58| **A05** | Injection | User input → system commands |59| **A06** | Insecure Design | Flawed architecture |60| **A07** | Authentication Failures | Session, credential management |61| **A08** | Integrity Failures | Unsigned updates, tampered data |62| **A09** | Logging & Alerting | Blind spots, no monitoring |63| **A10** | Exceptional Conditions 🆕 | Error handling, fail-open states |6465### 2025 Key Changes6667```682021 → 2025 Shifts:69├── SSRF merged into A01 (Access Control)70├── A02 elevated (Cloud/Container configs)71├── A03 NEW: Supply Chain (major focus)72├── A10 NEW: Exceptional Conditions73└── Focus shift: Root causes > Symptoms74```7576---7778## 3. Supply Chain Security (A03)7980### Attack Surface8182| Vector | Risk | Question to Ask |83|--------|------|-----------------|84| **Dependencies** | Malicious packages | Do we audit new deps? |85| **Lock files** | Integrity attacks | Are they committed? |86| **Build pipeline** | CI/CD compromise | Who can modify? |87| **Registry** | Typosquatting | Verified sources? |8889### Defense Principles9091- Verify package integrity (checksums)92- Pin versions, audit updates93- Use private registries for critical deps94- Sign and verify artifacts9596---9798## 4. Attack Surface Mapping99100### What to Map101102| Category | Elements |103|----------|----------|104| **Entry Points** | APIs, forms, file uploads |105| **Data Flows** | Input → Process → Output |106| **Trust Boundaries** | Where auth/authz checked |107| **Assets** | Secrets, PII, business data |108109### Prioritization Matrix110111```112Risk = Likelihood × Impact113114High Impact + High Likelihood → CRITICAL115High Impact + Low Likelihood → HIGH116Low Impact + High Likelihood → MEDIUM117Low Impact + Low Likelihood → LOW118```119120---121122## 5. Risk Prioritization123124### CVSS + Context125126| Factor | Weight | Question |127|--------|--------|----------|128| **CVSS Score** | Base severity | How severe is the vuln? |129| **EPSS Score** | Exploit likelihood | Is it being exploited? |130| **Asset Value** | Business context | What's at risk? |131| **Exposure** | Attack surface | Internet-facing? |132133### Prioritization Decision Tree134135```136Is it actively exploited (EPSS >0.5)?137├── YES → CRITICAL: Immediate action138└── NO → Check CVSS139 ├── CVSS ≥9.0 → HIGH140 ├── CVSS 7.0-8.9 → Consider asset value141 └── CVSS <7.0 → Schedule for later142```143144---145146## 6. Exceptional Conditions (A10 - New)147148### Fail-Open vs Fail-Closed149150| Scenario | Fail-Open (BAD) | Fail-Closed (GOOD) |151|----------|-----------------|---------------------|152| Auth error | Allow access | Deny access |153| Parsing fails | Accept input | Reject input |154| Timeout | Retry forever | Limit + abort |155156### What to Check157158- Exception handlers that catch-all and ignore159- Missing error handling on security operations160- Race conditions in auth/authz161- Resource exhaustion scenarios162163---164165## 7. Scanning Methodology166167### Phase-Based Approach168169```1701. RECONNAISSANCE171 └── Understand the target172 ├── Technology stack173 ├── Entry points174 └── Data flows1751762. DISCOVERY177 └── Identify potential issues178 ├── Configuration review179 ├── Dependency analysis180 └── Code pattern search1811823. ANALYSIS183 └── Validate and prioritize184 ├── False positive elimination185 ├── Risk scoring186 └── Attack chain mapping1871884. REPORTING189 └── Actionable findings190 ├── Clear reproduction steps191 ├── Business impact192 └── Remediation guidance193```194195---196197## 8. Code Pattern Analysis198199### High-Risk Patterns200201| Pattern | Risk | Look For |202|---------|------|----------|203| **String concat in queries** | Injection | `"SELECT * FROM " + user_input` |204| **Dynamic code execution** | RCE | `eval()`, `exec()`, `Function()` |205| **Unsafe deserialization** | RCE | `pickle.loads()`, `unserialize()` |206| **Path manipulation** | Traversal | User input in file paths |207| **Disabled security** | Various | `verify=False`, `--insecure` |208209### Secret Patterns210211| Type | Indicators |212|------|-----------|213| API Keys | `api_key`, `apikey`, high entropy |214| Tokens | `token`, `bearer`, `jwt` |215| Credentials | `password`, `secret`, `key` |216| Cloud | `AWS_`, `AZURE_`, `GCP_` prefixes |217218---219220## 9. Cloud Security Considerations221222### Shared Responsibility223224| Layer | You Own | Provider Owns |225|-------|---------|---------------|226| Data | ✅ | ❌ |227| Application | ✅ | ❌ |228| OS/Runtime | Depends | Depends |229| Infrastructure | ❌ | ✅ |230231### Cloud-Specific Checks232233- IAM: Least privilege applied?234- Storage: Public buckets?235- Network: Security groups tightened?236- Secrets: Using secrets manager?237238---239240## 10. Anti-Patterns241242| ❌ Don't | ✅ Do |243|----------|-------|244| Scan without understanding | Map attack surface first |245| Alert on every CVE | Prioritize by exploitability + asset |246| Ignore false positives | Maintain verified baseline |247| Fix symptoms only | Address root causes |248| Scan once before deploy | Continuous scanning |249| Trust third-party deps blindly | Verify integrity, audit code |250251---252253## 11. Reporting Principles254255### Finding Structure256257Each finding should answer:2581. **What?** - Clear vulnerability description2592. **Where?** - Exact location (file, line, endpoint)2603. **Why?** - Root cause explanation2614. **Impact?** - Business consequence2625. **How to fix?** - Specific remediation263264### Severity Classification265266| Severity | Criteria |267|----------|----------|268| **Critical** | RCE, auth bypass, mass data exposure |269| **High** | Data exposure, privilege escalation |270| **Medium** | Limited scope, requires conditions |271| **Low** | Informational, best practice |272273---274275> **Remember:** Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
HaoNgo232