mcpField
O
owasp-top10-analysis

owasp-top10-analysis

github.com/securityskillsSecurity0606 installsUpdated 9w ago
Repository

About owasp-top10-analysis

A category-by-category checklist for reviewing web applications against the OWASP Top 10 (2021). It helps security reviewers record evidence, reproduction steps, severity, fixes, and verified negatives for each area.

Key features

  1. 01Coverage across all ten categories
  2. 02Access-control and injection test prompts
  3. 03Authentication and cryptography checks
  4. 04Logging and SSRF review prompts
  5. 05Finding evidence and reproduction fields
  6. 06Verified-negative coverage notes

Use cases

  1. 01Structure a web application security review
  2. 02Check endpoints for access-control flaws
  3. 03Review URL-fetch features for SSRF
  4. 04Document findings and remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill owasp-top10-analysis

After installing, type/owasp-top10-analysisin Claude Code to confirm it loaded.

Details

From the project README

OWASP Top 10 Analysis

Work a web application category-by-category so nothing is skipped.

Checklist by Category (2021)

A01 Broken Access Control
  • Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts
  • Verify server-side enforcement on every endpoint, not just UI hiding
  • Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates
  • Check forced browsing to admin routes after logout/role downgrade
A02 Cryptographic Failures
  • Confirm TLS 1.2+ only, HSTS present
  • Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for passwords
  • Passwords hashed with bcrypt/argon2 + per-user salt; secrets not in client bundles
A03 Injection
  • SQL/NoSQL/ORM injection: parameterized queries verified; test in sort/filter/order params, not just search
  • OS command injection in file upload/filename handling, image processing, PDF generators
  • Header injection, template injection (SSTI) in email/render features
A04 Insecure Design
  • Business logic abuse: negative quantities, currency confusion, race conditions on credits/coupons
  • Trust-boundary violations: client-computed prices, unsigned discount tokens
A05 Security Misconfiguration
  • Debug modes, default credentials, verbose errors, directory listing
  • Unnecessary features enabled (PUT, TRACE), permissive CORS (* with credentials)
A06 Vulnerable Components
  • SBOM against known CVEs; flag unmanaged/EOL dependencies
  • Check client-side libs too (npm audit / Retire.js signals)
A07 Authentication Failures
  • Credential stuffing resistance (rate limiting, MFA), session fixation, weak password policy
  • Session tokens: rotated on login, invalidated on logout, secure/httpOnly flags
  • MFA bypass flows: reset, backup codes, OAuth account linking
A08 Integrity Failures
  • Unsigned updates/deserialization of untrusted data (pick your targets: memcached, JWT, file parsers)
  • CI/CD pipeline: pinned dependencies, verified provenance
A09 Logging & Monitoring
  • Auth events, access-control denials, and input-validation failures are logged with context
  • Logs don't contain passwords/tokens; alerting exists for brute force
A10 SSRF
  • Any URL-fetch feature (webhooks, importers, preview generators): test localhost, link-local (169.254.169.254), IPv6 equivalents, DNS rebinding
  • Scheme and redirect handling enforced server-side

Output

Per finding: category, evidence, reproduction, severity, fix. Note verified-negatives per category for coverage evidence.

Comments

Markdown supported