back
loading skill details...
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
Vulnerability Scanner
Think like an attacker, defend like an expert. 2025 threat landscape awareness.
๐ง Runtime Scripts
Execute for automated validation:
Script
Purpose
Usage
scripts/security_scan.py
Validate security principles applied
python scripts/security_scan.py <project_path>
๐ Reference Files
File
Purpose
checklists.md
OWASP Top 10, Auth, API, Data protection checklists
1. Security Expert Mindset
Core Principles
Principle
Application
Assume Breach
Design as if attacker already inside
Zero Trust
Never trust, always verify
Defense in Depth
Multiple layers, no single point
Least Privilege
Minimum required access only
Fail Secure
On error, deny access
Threat Modeling Questions
Before scanning, ask:
What are we protecting? (Assets)
Who would attack? (Threat actors)
How would they attack? (Attack vectors)
What's the impact? (Business risk)
2. OWASP Top 10:2025
Risk Categories
Rank
Category
Think About
A01
Broken Access Control
Who can access what? IDOR, SSRF
A02
Security Misconfiguration
Defaults, headers, exposed services
A03
Software Supply Chain ๐
Dependencies, CI/CD, build integrity
A04
Cryptographic Failures
Weak crypto, exposed secrets
A05
Injection
User input โ system commands
A06
Insecure Design
Flawed architecture
A07
Authentication Failures
Session, credential management
A08
Integrity Failures
Unsigned updates, tampered data
A09
Logging & Alerting
Blind spots, no monitoring
A10
Exceptional Conditions ๐
Error handling, fail-open states
2025 Key Changes
2021 โ 2025 Shifts:
โโโ SSRF merged into A01 (Access Control)
โโโ A02 elevated (Cloud/Container configs)
โโโ A03 NEW: Supply Chain (major focus)
โโโ A10 NEW: Exceptional Conditions
โโโ Focus shift: Root causes > Symptoms
3. Supply Chain Security (A03)
Attack Surface
Vector
Risk
Question to Ask
Dependencies
Malicious packages
Do we audit new deps?
Lock files
Integrity attacks
Are they committed?
Build pipeline
CI/CD compromise
Who can modify?
Registry
Typosquatting
Verified sources?
Defense Principles
Verify package integrity (checksums)
Pin versions, audit updates
Use private registries for critical deps
Sign and verify artifacts
4. Attack Surface Mapping
What to Map
Category
Elements
Entry Points
APIs, forms, file uploads
Data Flows
Input โ Process โ Output
Trust Boundaries
Where auth/authz checked
Assets
Secrets, PII, business data
Prioritization Matrix
Risk = Likelihood ร Impact
High Impact + High Likelihood โ CRITICAL
High Impact + Low Likelihood โ HIGH
Low Impact + High Likelihood โ MEDIUM
Low Impact + Low Likelihood โ LOW
5. Risk Prioritization
CVSS + Context
Factor
Weight
Question
CVSS Score
Base severity
How severe is the vuln?
EPSS Score
Exploit likelihood
Is it being exploited?
Asset Value
Business context
What's at risk?
Exposure
Attack surface
Internet-facing?
Prioritization Decision Tree
Is it actively exploited (EPSS >0.5)?
โโโ YES โ CRITICAL: Immediate action
โโโ NO โ Check CVSS
โโโ CVSS โฅ9.0 โ HIGH
โโโ CVSS 7.0-8.9 โ Consider asset value
โโโ CVSS <7.0 โ Schedule for later
6. Exceptional Conditions (A10 - New)
Fail-Open vs Fail-Closed
Scenario
Fail-Open (BAD)
Fail-Closed (GOOD)
Auth error
Allow access
Deny access
Parsing fails
Accept input
Reject input
Timeout
Retry forever
Limit + abort
What to Check
Exception handlers that catch-all and ignore
Missing error handling on security operations
Race conditions in auth/authz
Resource exhaustion scenarios
7. Scanning Methodology
Phase-Based Approach
1. RECONNAISSANCE
โโโ Understand the target
โโโ Technology stack
โโโ Entry points
โโโ Data flows
2. DISCOVERY
โโโ Identify potential issues
โโโ Configuration review
โโโ Dependency analysis
โโโ Code pattern search
3. ANALYSIS
โโโ Validate and prioritize
โโโ False positive elimination
โโโ Risk scoring
โโโ Attack chain mapping
4. REPORTING
โโโ Actionable findings
โโโ Clear reproduction steps
โโโ Business impact
โโโ Remediation guidance
8. Code Pattern Analysis
High-Risk Patterns
Pattern
Risk
Look For
String concat in queries
Injection
"SELECT * FROM " + user_input
Dynamic code execution
RCE
eval(), exec(), Function()
Unsafe deserialization
RCE
pickle.loads(), unserialize()
Path manipulation
Traversal
User input in file paths
Disabled security
Various
verify=False, --insecure
Secret Patterns
Type
Indicators
API Keys
api_key, apikey, high entropy
Tokens
token, bearer, jwt
Credentials
password, secret, key
Cloud
AWS_, AZURE_, GCP_ prefixes
9. Cloud Security Considerations
Shared Responsibility
Layer
You Own
Provider Owns
Data
โ
โ
Application
โ
โ
OS/Runtime
Depends
Depends
Infrastructure
โ
โ
Cloud-Specific Checks
IAM: Least privilege applied?
Storage: Public buckets?
Network: Security groups tightened?
Secrets: Using secrets manager?
10. Anti-Patterns
โ Don't
โ
Do
Scan without understanding
Map attack surface first
Alert on every CVE
Prioritize by exploitability + asset
Ignore false positives
Maintain verified baseline
Fix symptoms only
Address root causes
Scan once before deploy
Continuous scanning
Trust third-party deps blindly
Verify integrity, audit code
11. Reporting Principles
Finding Structure
Each finding should answer:
What? - Clear vulnerability description
Where? - Exact location (file, line, endpoint)
Why? - Root cause explanation
Impact? - Business consequence
How to fix? - Specific remediation
Severity Classification
Severity
Criteria
Critical
RCE, auth bypass, mass data exposure
High
Data exposure, privilege escalation
Medium
Limited scope, requires conditions
Low
Informational, best practice
Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"don't have the plugin yet? install it then click "run inline in claude" again.