Vulnerability Scanner
Think like an attacker, defend like an expert. 2025 threat landscape awareness.
🔧 Runtime Scripts
Execute for automated validation:
| Script |
Purpose |
Usage |
scripts/security_scan.py |
Validate security principles applied |
python scripts/security_scan.py <project_path> |
📋 Reference Files
| File |
Purpose |
| checklists.md |
OWASP Top 10, Auth, API, Data protection checklists |
1. Security Expert Mindset
Core Principles
| Principle |
Application |
| Assume Breach |
Design as if attacker already inside |
| Zero Trust |
Never trust, always verify |
| Defense in Depth |
Multiple layers, no single point |
| Least Privilege |
Minimum required access only |
| Fail Secure |
On error, deny access |
Threat Modeling Questions
Before scanning, ask:
- What are we protecting? (Assets)
- Who would attack? (Threat actors)
- How would they attack? (Attack vectors)
- What's the impact? (Business risk)
2. OWASP Top 10:2025
Risk Categories
| Rank |
Category |
Think About |
| A01 |
Broken Access Control |
Who can access what? IDOR, SSRF |
| A02 |
Security Misconfiguration |
Defaults, headers, exposed services |
| A03 |
Software Supply Chain 🆕 |
Dependencies, CI/CD, build integrity |
| A04 |
Cryptographic Failures |
Weak crypto, exposed secrets |
| A05 |
Injection |
User input → system commands |
| A06 |
Insecure Design |
Flawed architecture |
| A07 |
Authentication Failures |
Session, credential management |
| A08 |
Integrity Failures |
Unsigned updates, tampered data |
| A09 |
Logging & Alerting |
Blind spots, no monitoring |
| A10 |
Exceptional Conditions 🆕 |
Error handling, fail-open states |
2025 Key Changes
2021 → 2025 Shifts:
├── SSRF merged into A01 (Access Control)
├── A02 elevated (Cloud/Container configs)
├── A03 NEW: Supply Chain (major focus)
├── A10 NEW: Exceptional Conditions
└── Focus shift: Root causes > Symptoms
3. Supply Chain Security (A03)
Attack Surface
| Vector |
Risk |
Question to Ask |
| Dependencies |
Malicious packages |
Do we audit new deps? |
| Lock files |
Integrity attacks |
Are they committed? |
| Build pipeline |
CI/CD compromise |
Who can modify? |
| Registry |
Typosquatting |
Verified sources? |
Defense Principles
- Verify package integrity (checksums)
- Pin versions, audit updates
- Use private registries for critical deps
- Sign and verify artifacts
4. Attack Surface Mapping
What to Map
| Category |
Elements |
| Entry Points |
APIs, forms, file uploads |
| Data Flows |
Input → Process → Output |
| Trust Boundaries |
Where auth/authz checked |
| Assets |
Secrets, PII, business data |
Prioritization Matrix
Risk = Likelihood × Impact
High Impact + High Likelihood → CRITICAL
High Impact + Low Likelihood → HIGH
Low Impact + High Likelihood → MEDIUM
Low Impact + Low Likelihood → LOW
5. Risk Prioritization
CVSS + Context
| Factor |
Weight |
Question |
| CVSS Score |
Base severity |
How severe is the vuln? |
| EPSS Score |
Exploit likelihood |
Is it being exploited? |
| Asset Value |
Business context |
What's at risk? |
| Exposure |
Attack surface |
Internet-facing? |
Prioritization Decision Tree
Is it actively exploited (EPSS >0.5)?
├── YES → CRITICAL: Immediate action
└── NO → Check CVSS
├── CVSS ≥9.0 → HIGH
├── CVSS 7.0-8.9 → Consider asset value
└── CVSS <7.0 → Schedule for later
6. Exceptional Conditions (A10 - New)
Fail-Open vs Fail-Closed
| Scenario |
Fail-Open (BAD) |
Fail-Closed (GOOD) |
| Auth error |
Allow access |
Deny access |
| Parsing fails |
Accept input |
Reject input |
| Timeout |
Retry forever |
Limit + abort |
What to Check
- Exception handlers that catch-all and ignore
- Missing error handling on security operations
- Race conditions in auth/authz
- Resource exhaustion scenarios
7. Scanning Methodology
Phase-Based Approach
1. RECONNAISSANCE
└── Understand the target
├── Technology stack
├── Entry points
└── Data flows
2. DISCOVERY
└── Identify potential issues
├── Configuration review
├── Dependency analysis
└── Code pattern search
3. ANALYSIS
└── Validate and prioritize
├── False positive elimination
├── Risk scoring
└── Attack chain mapping
4. REPORTING
└── Actionable findings
├── Clear reproduction steps
├── Business impact
└── Remediation guidance
8. Code Pattern Analysis
High-Risk Patterns
| Pattern |
Risk |
Look For |
| String concat in queries |
Injection |
"SELECT * FROM " + user_input |
| Dynamic code execution |
RCE |
eval(), exec(), Function() |
| Unsafe deserialization |
RCE |
pickle.loads(), unserialize() |
| Path manipulation |
Traversal |
User input in file paths |
| Disabled security |
Various |
verify=False, --insecure |
Secret Patterns
| Type |
Indicators |
| API Keys |
api_key, apikey, high entropy |
| Tokens |
token, bearer, jwt |
| Credentials |
password, secret, key |
| Cloud |
AWS_, AZURE_, GCP_ prefixes |
9. Cloud Security Considerations
Shared Responsibility
| Layer |
You Own |
Provider Owns |
| Data |
✅ |
❌ |
| Application |
✅ |
❌ |
| OS/Runtime |
Depends |
Depends |
| Infrastructure |
❌ |
✅ |
Cloud-Specific Checks
- IAM: Least privilege applied?
- Storage: Public buckets?
- Network: Security groups tightened?
- Secrets: Using secrets manager?
10. Anti-Patterns
| ❌ Don't |
✅ Do |
| Scan without understanding |
Map attack surface first |
| Alert on every CVE |
Prioritize by exploitability + asset |
| Ignore false positives |
Maintain verified baseline |
| Fix symptoms only |
Address root causes |
| Scan once before deploy |
Continuous scanning |
| Trust third-party deps blindly |
Verify integrity, audit code |
11. Reporting Principles
Finding Structure
Each finding should answer:
- What? - Clear vulnerability description
- Where? - Exact location (file, line, endpoint)
- Why? - Root cause explanation
- Impact? - Business consequence
- How to fix? - Specific remediation
Severity Classification
| Severity |
Criteria |
| Critical |
RCE, auth bypass, mass data exposure |
| High |
Data exposure, privilege escalation |
| Medium |
Limited scope, requires conditions |
| Low |
Informational, best practice |
Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
1---2name: vulnerability-scanner3description: Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.4---5
6# Vulnerability Scanner
7
8> Think like an attacker, defend like an expert. 2025 threat landscape awareness.
9
10## 🔧 Runtime Scripts
11
12**Execute for automated validation:**
13
14| Script | Purpose | Usage |
15|--------|---------|-------|
16| `scripts/security_scan.py` | Validate security principles applied | `python scripts/security_scan.py <project_path>` |
17
18## 📋 Reference Files
19
20| File | Purpose |
21|------|---------|
22| [checklists.md](checklists.md) | OWASP Top 10, Auth, API, Data protection checklists |
23
24---
25
26## 1. Security Expert Mindset
27
28### Core Principles
29
30| Principle | Application |
31|-----------|-------------|
32| **Assume Breach** | Design as if attacker already inside |
33| **Zero Trust** | Never trust, always verify |
34| **Defense in Depth** | Multiple layers, no single point |
35| **Least Privilege** | Minimum required access only |
36| **Fail Secure** | On error, deny access |
37
38### Threat Modeling Questions
39
40Before scanning, ask:
411. What are we protecting? (Assets)
422. Who would attack? (Threat actors)
433. How would they attack? (Attack vectors)
444. What's the impact? (Business risk)
45
46---
47
48## 2. OWASP Top 10:2025
49
50### Risk Categories
51
52| Rank | Category | Think About |
53|------|----------|-------------|
54| **A01** | Broken Access Control | Who can access what? IDOR, SSRF |
55| **A02** | Security Misconfiguration | Defaults, headers, exposed services |
56| **A03** | Software Supply Chain 🆕 | Dependencies, CI/CD, build integrity |
57| **A04** | Cryptographic Failures | Weak crypto, exposed secrets |
58| **A05** | Injection | User input → system commands |
59| **A06** | Insecure Design | Flawed architecture |
60| **A07** | Authentication Failures | Session, credential management |
61| **A08** | Integrity Failures | Unsigned updates, tampered data |
62| **A09** | Logging & Alerting | Blind spots, no monitoring |
63| **A10** | Exceptional Conditions 🆕 | Error handling, fail-open states |
64
65### 2025 Key Changes
66
67```
682021 → 2025 Shifts:
69├── SSRF merged into A01 (Access Control)
70├── A02 elevated (Cloud/Container configs)
71├── A03 NEW: Supply Chain (major focus)
72├── A10 NEW: Exceptional Conditions
73└── Focus shift: Root causes > Symptoms
74```
75
76---
77
78## 3. Supply Chain Security (A03)
79
80### Attack Surface
81
82| Vector | Risk | Question to Ask |
83|--------|------|-----------------|
84| **Dependencies** | Malicious packages | Do we audit new deps? |
85| **Lock files** | Integrity attacks | Are they committed? |
86| **Build pipeline** | CI/CD compromise | Who can modify? |
87| **Registry** | Typosquatting | Verified sources? |
88
89### Defense Principles
90
91- Verify package integrity (checksums)
92- Pin versions, audit updates
93- Use private registries for critical deps
94- Sign and verify artifacts
95
96---
97
98## 4. Attack Surface Mapping
99
100### What to Map
101
102| Category | Elements |
103|----------|----------|
104| **Entry Points** | APIs, forms, file uploads |
105| **Data Flows** | Input → Process → Output |
106| **Trust Boundaries** | Where auth/authz checked |
107| **Assets** | Secrets, PII, business data |
108
109### Prioritization Matrix
110
111```
112Risk = Likelihood × Impact
113
114High Impact + High Likelihood → CRITICAL
115High Impact + Low Likelihood → HIGH
116Low Impact + High Likelihood → MEDIUM
117Low Impact + Low Likelihood → LOW
118```
119
120---
121
122## 5. Risk Prioritization
123
124### CVSS + Context
125
126| Factor | Weight | Question |
127|--------|--------|----------|
128| **CVSS Score** | Base severity | How severe is the vuln? |
129| **EPSS Score** | Exploit likelihood | Is it being exploited? |
130| **Asset Value** | Business context | What's at risk? |
131| **Exposure** | Attack surface | Internet-facing? |
132
133### Prioritization Decision Tree
134
135```
136Is it actively exploited (EPSS >0.5)?
137├── YES → CRITICAL: Immediate action
138└── NO → Check CVSS
139 ├── CVSS ≥9.0 → HIGH
140 ├── CVSS 7.0-8.9 → Consider asset value
141 └── CVSS <7.0 → Schedule for later
142```
143
144---
145
146## 6. Exceptional Conditions (A10 - New)
147
148### Fail-Open vs Fail-Closed
149
150| Scenario | Fail-Open (BAD) | Fail-Closed (GOOD) |
151|----------|-----------------|---------------------|
152| Auth error | Allow access | Deny access |
153| Parsing fails | Accept input | Reject input |
154| Timeout | Retry forever | Limit + abort |
155
156### What to Check
157
158- Exception handlers that catch-all and ignore
159- Missing error handling on security operations
160- Race conditions in auth/authz
161- Resource exhaustion scenarios
162
163---
164
165## 7. Scanning Methodology
166
167### Phase-Based Approach
168
169```
1701. RECONNAISSANCE
171 └── Understand the target
172 ├── Technology stack
173 ├── Entry points
174 └── Data flows
175
1762. DISCOVERY
177 └── Identify potential issues
178 ├── Configuration review
179 ├── Dependency analysis
180 └── Code pattern search
181
1823. ANALYSIS
183 └── Validate and prioritize
184 ├── False positive elimination
185 ├── Risk scoring
186 └── Attack chain mapping
187
1884. REPORTING
189 └── Actionable findings
190 ├── Clear reproduction steps
191 ├── Business impact
192 └── Remediation guidance
193```
194
195---
196
197## 8. Code Pattern Analysis
198
199### High-Risk Patterns
200
201| Pattern | Risk | Look For |
202|---------|------|----------|
203| **String concat in queries** | Injection | `"SELECT * FROM " + user_input` |
204| **Dynamic code execution** | RCE | `eval()`, `exec()`, `Function()` |
205| **Unsafe deserialization** | RCE | `pickle.loads()`, `unserialize()` |
206| **Path manipulation** | Traversal | User input in file paths |
207| **Disabled security** | Various | `verify=False`, `--insecure` |
208
209### Secret Patterns
210
211| Type | Indicators |
212|------|-----------|
213| API Keys | `api_key`, `apikey`, high entropy |
214| Tokens | `token`, `bearer`, `jwt` |
215| Credentials | `password`, `secret`, `key` |
216| Cloud | `AWS_`, `AZURE_`, `GCP_` prefixes |
217
218---
219
220## 9. Cloud Security Considerations
221
222### Shared Responsibility
223
224| Layer | You Own | Provider Owns |
225|-------|---------|---------------|
226| Data | ✅ | ❌ |
227| Application | ✅ | ❌ |
228| OS/Runtime | Depends | Depends |
229| Infrastructure | ❌ | ✅ |
230
231### Cloud-Specific Checks
232
233- IAM: Least privilege applied?
234- Storage: Public buckets?
235- Network: Security groups tightened?
236- Secrets: Using secrets manager?
237
238---
239
240## 10. Anti-Patterns
241
242| ❌ Don't | ✅ Do |
243|----------|-------|
244| Scan without understanding | Map attack surface first |
245| Alert on every CVE | Prioritize by exploitability + asset |
246| Ignore false positives | Maintain verified baseline |
247| Fix symptoms only | Address root causes |
248| Scan once before deploy | Continuous scanning |
249| Trust third-party deps blindly | Verify integrity, audit code |
250
251---
252
253## 11. Reporting Principles
254
255### Finding Structure
256
257Each finding should answer:
2581. **What?** - Clear vulnerability description
2592. **Where?** - Exact location (file, line, endpoint)
2603. **Why?** - Root cause explanation
2614. **Impact?** - Business consequence
2625. **How to fix?** - Specific remediation
263
264### Severity Classification
265
266| Severity | Criteria |
267|----------|----------|
268| **Critical** | RCE, auth bypass, mass data exposure |
269| **High** | Data exposure, privilege escalation |
270| **Medium** | Limited scope, requires conditions |
271| **Low** | Informational, best practice |
272
273---
274
275> **Remember:** Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
michaelschecht