OWASP Vulnerability Checker

OWASP Vulnerability Checker

Prerequisites & Dependencies

• Target API running in a non-production (staging) environment, with test credentials for authed routes and explicit authorization to test
• OWASP ZAP (ghcr.io/zaproxy/zaproxy:stable) or nuclei for automated scanning
• The API's OpenAPI spec (if available) to drive context-aware coverage

Execution Steps

1. Map the attack surface: enumerate endpoints, HTTP methods, authentication mechanisms, and input parameters from code or the OpenAPI spec.
2. Run an automated ZAP baseline scan against the staging URL, importing the OpenAPI definition for full endpoint coverage.
3. Manually probe OWASP Top 10 items: SQLi on filter/query parameters, reflected and stored XSS on output fields, CSRF on state-changing endpoints, broken access control via IDOR paths.
4. Check configuration and headers: missing CSP/HSTS, verbose error messages, CORS misconfigurations, exposed debug/admin endpoints.
5. Record findings with severity, reproduction steps, and OWASP category; prioritize anything that exfiltrates or mutates other users' data.
6. Verify fixes with a rescan and provide remediation guidance (parameterized queries, output encoding/escaping, anti-CSRF tokens, proper session flags).

docker run -u zap -v $(pwd):/zap/wrk ghcr.io/zaproxy/zaproxy:stable \
  zap-scan.py -t https://staging.example.com/api -I -J -r zap-report.html

# Manual probes (staging only, with authorization)
GET /api/users?id=1' OR '1'='1                              # SQLi boolean probe
POST /api/comments  {"body":"<img src=x # stored XSS probe
POST /api/account/email  (omit CSRF token, foreign Referer) # CSRF probe
GET /api/users/4711/invoices                                # IDOR / broken access control