vulnerability-scanner

SKILL.md

Vulnerability Scanner

Think like an attacker, defend like an expert. 2025 threat landscape awareness.

🔧 Runtime Scripts

Execute for automated validation:

Script
Purpose
Usage

scripts/security_scan.py
Validate security principles applied
python scripts/security_scan.py <project_path>

📋 Reference Files

File
Purpose

checklists.md
OWASP Top 10, Auth, API, Data protection checklists

1. Security Expert Mindset

Core Principles

Principle
Application

Assume Breach
Design as if attacker already inside

Zero Trust
Never trust, always verify

Defense in Depth
Multiple layers, no single point

Least Privilege
Minimum required access only

Fail Secure
On error, deny access

Threat Modeling Questions

Before scanning, ask:

What are we protecting? (Assets)

Who would attack? (Threat actors)

How would they attack? (Attack vectors)

What's the impact? (Business risk)

2. OWASP Top 10:2025

Risk Categories

Rank
Category
Think About

A01
Broken Access Control
Who can access what? IDOR, SSRF

A02
Security Misconfiguration
Defaults, headers, exposed services

A03
Software Supply Chain 🆕
Dependencies, CI/CD, build integrity

A04
Cryptographic Failures
Weak crypto, exposed secrets

A05
Injection
User input → system commands

A06
Insecure Design
Flawed architecture

A07
Authentication Failures
Session, credential management

A08
Integrity Failures
Unsigned updates, tampered data

A09
Logging & Alerting
Blind spots, no monitoring

A10
Exceptional Conditions 🆕
Error handling, fail-open states

2025 Key Changes

2021 → 2025 Shifts:
├── SSRF merged into A01 (Access Control)
├── A02 elevated (Cloud/Container configs)
├── A03 NEW: Supply Chain (major focus)
├── A10 NEW: Exceptional Conditions
└── Focus shift: Root causes > Symptoms

3. Supply Chain Security (A03)

Attack Surface

Vector
Risk
Question to Ask

Dependencies
Malicious packages
Do we audit new deps?

Lock files
Integrity attacks
Are they committed?

Build pipeline
CI/CD compromise
Who can modify?

Registry
Typosquatting
Verified sources?

Defense Principles

Verify package integrity (checksums)

Pin versions, audit updates

Use private registries for critical deps

Sign and verify artifacts

4. Attack Surface Mapping

What to Map

Category
Elements

Entry Points
APIs, forms, file uploads

Data Flows
Input → Process → Output

Trust Boundaries
Where auth/authz checked

Assets
Secrets, PII, business data

Prioritization Matrix

Risk = Likelihood × Impact

High Impact + High Likelihood → CRITICAL
High Impact + Low Likelihood  → HIGH
Low Impact + High Likelihood  → MEDIUM
Low Impact + Low Likelihood   → LOW

5. Risk Prioritization

CVSS + Context

Factor
Weight
Question

CVSS Score
Base severity
How severe is the vuln?

EPSS Score
Exploit likelihood
Is it being exploited?

Asset Value
Business context
What's at risk?

Exposure
Attack surface
Internet-facing?

Prioritization Decision Tree

Is it actively exploited (EPSS >0.5)?
├── YES → CRITICAL: Immediate action
└── NO → Check CVSS
         ├── CVSS ≥9.0 → HIGH
         ├── CVSS 7.0-8.9 → Consider asset value
         └── CVSS <7.0 → Schedule for later

6. Exceptional Conditions (A10 - New)

Fail-Open vs Fail-Closed

Scenario
Fail-Open (BAD)
Fail-Closed (GOOD)

Auth error
Allow access
Deny access

Parsing fails
Accept input
Reject input

Timeout
Retry forever
Limit + abort

What to Check

Exception handlers that catch-all and ignore

Missing error handling on security operations

Race conditions in auth/authz

Resource exhaustion scenarios

7. Scanning Methodology

Phase-Based Approach

1. RECONNAISSANCE
   └── Understand the target
       ├── Technology stack
       ├── Entry points
       └── Data flows

2. DISCOVERY
   └── Identify potential issues
       ├── Configuration review
       ├── Dependency analysis
       └── Code pattern search

3. ANALYSIS
   └── Validate and prioritize
       ├── False positive elimination
       ├── Risk scoring
       └── Attack chain mapping

4. REPORTING
   └── Actionable findings
       ├── Clear reproduction steps
       ├── Business impact
       └── Remediation guidance

8. Code Pattern Analysis

High-Risk Patterns

Pattern
Risk
Look For

String concat in queries
Injection
"SELECT * FROM " + user_input

Dynamic code execution
RCE
eval(), exec(), Function()

Unsafe deserialization
RCE
pickle.loads(), unserialize()

Path manipulation
Traversal
User input in file paths

Disabled security
Various
verify=False, --insecure

Secret Patterns

Type
Indicators

API Keys
api_key, apikey, high entropy

Tokens
token, bearer, jwt

Credentials
password, secret, key

Cloud
AWS_, AZURE_, GCP_ prefixes

9. Cloud Security Considerations

Shared Responsibility

Layer
You Own
Provider Owns

Data
✅
❌

Application
✅
❌

OS/Runtime
Depends
Depends

Infrastructure
❌
✅

Cloud-Specific Checks

IAM: Least privilege applied?

Storage: Public buckets?

Network: Security groups tightened?

Secrets: Using secrets manager?

10. Anti-Patterns

❌ Don't
✅ Do

Scan without understanding
Map attack surface first

Alert on every CVE
Prioritize by exploitability + asset

Ignore false positives
Maintain verified baseline

Fix symptoms only
Address root causes

Scan once before deploy
Continuous scanning

Trust third-party deps blindly
Verify integrity, audit code

11. Reporting Principles

Finding Structure

Each finding should answer:

What? - Clear vulnerability description

Where? - Exact location (file, line, endpoint)

Why? - Root cause explanation

Impact? - Business consequence

How to fix? - Specific remediation

Severity Classification

Severity
Criteria

Critical
RCE, auth bypass, mass data exposure

High
Data exposure, privilege escalation

Medium
Limited scope, requires conditions

Low
Informational, best practice

Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"