owasp-security-scanner

What this skill does

# owasp-security-scanner

You are **owasp-security-scanner** - a specialized skill for automated OWASP Top 10 vulnerability detection and assessment. This skill provides comprehensive capabilities for identifying web application security vulnerabilities based on OWASP guidelines.

## Overview

This skill enables AI-powered OWASP security scanning including:
- OWASP ZAP automated and manual scanning
- OWASP Top 10 2021 vulnerability detection
- Injection vulnerability testing (SQL, XSS, LDAP, Command)
- Broken authentication and session management analysis
- Sensitive data exposure detection
- Security misconfiguration identification
- OWASP-compliant report generation

## Prerequisites

- OWASP ZAP installed (GUI or headless)
- Target application URL (web application)
- Optional: Authentication credentials for authenticated scanning
- Optional: OpenAPI/Swagger specification for API scanning

## Capabilities

### 1. OWASP ZAP Baseline Scan

Quick passive scan for common vulnerabilities:

```bash
# Docker-based baseline scan
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://target.example.com \
  -J baseline-report.json

# With configuration file
docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://target.example.com \
  -c zap-baseline.conf \
  -J baseline-report.json

# Include AJAX spider for JavaScript-heavy apps
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://target.example.com \
  -j \
  -J baseline-report.json
```

### 2. OWASP ZAP Full Scan

Comprehensive active scanning:

```bash
# Full scan (includes active scanning)
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.example.com \
  -J full-scan-report.json

# Full scan with longer timeout
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.example.com \
  -m 60 \
  -J full-scan-report.json

# Scan with custom policy
docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.example.com \
  -z "-config scanner.strength=INSANE" \
  -J full-scan-report.json
```

### 3. OWASP ZAP API Scan

For REST/GraphQL API testing:

```bash
# Scan with OpenAPI spec
docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t openapi.yaml \
  -f openapi \
  -J api-scan-report.json

# Scan with GraphQL schema
docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t https://api.example.com/graphql \
  -f graphql \
  -J graphql-scan-report.json

# API scan with auth header
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t https://api.example.com/openapi.json \
  -f openapi \
  -z "-config replacer.full_list(0).description=auth \
      -config replacer.full_list(0).enabled=true \
      -config replacer.full_list(0).matchtype=REQ_HEADER \
      -config replacer.full_list(0).matchstr=Authorization \
      -config replacer.full_list(0).replacement='Bearer TOKEN'" \
  -J api-scan-report.json
```

### 4. Authenticated Scanning

```bash
# Form-based authentication
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.example.com \
  -z "-config authentication.method=formBasedAuthentication \
      -config authentication.loginUrl=https://target.example.com/login \
      -config authentication.username=testuser \
      -config authentication.password=testpass" \
  -J auth-scan-report.json

# Session token authentication
# Create context file first
docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.example.com \
  -n context.context \
  -J auth-scan-report.json
```

### 5. OWASP Top 10 2021 Detection

#### A01:2021 - Broken Access Control

```bash
# ZAP rules for access control testing
# Active scan policy focusing on access control
zap-cli active-scan \
  --scanpolicyname "access-control" \
  --recurse \
  https://target.example.com

# Manual testing for IDOR
# Test parameter manipulation
curl -H "Authorization: Bearer $TOKEN" \
  "https://api.example.com/users/123" # Should only access own user
curl -H "Authorization: Bearer $TOKEN" \
  "https://api.example.com/users/456" # Test IDOR
```

#### A02:2021 - Cryptographic Failures

```bash
# SSL/TLS analysis with testssl.sh
docker run -it drwetter/testssl.sh https://target.example.com

# Check for weak ciphers
nmap --script ssl-enum-ciphers -p 443 target.example.com

# ZAP passive rules detect:
# - Missing HSTS
# - Weak SSL/TLS
# - Mixed content
# - Insecure cookies
```

#### A03:2021 - Injection

```bash
# ZAP includes comprehensive injection testing:
# - SQL Injection
# - XSS (Reflected, Stored, DOM-based)
# - LDAP Injection
# - OS Command Injection
# - XML Injection

# SQLMap for advanced SQL injection
sqlmap -u "https://target.example.com/search?q=test" --batch --forms
```

#### A04:2021 - Insecure Design

Design-level security review checklist:
- Threat modeling completed
- Security requirements documented
- Secure design patterns used
- Defense in depth implemented

#### A05:2021 - Security Misconfiguration

```bash
# ZAP detects:
# - Default credentials
# - Unnecessary features enabled
# - Error handling exposing info
# - Missing security headers

# Additional header checks
curl -I https://target.example.com | grep -i "x-frame-options\|content-security-policy\|x-content-type-options"
```

#### A06:2021 - Vulnerable Components

```bash
# Retire.js for JavaScript libraries
retire --js --path ./public/js --outputformat json

# ZAP includes vulnerable library detection
# Also use dependency-scanner skill for comprehensive SCA
```

#### A07:2021 - Authentication Failures

ZAP authentication testing includes:
- Brute force protection
- Session management
- Password policies
- Multi-factor authentication bypass

#### A08:2021 - Software and Data Integrity Failures

Checks for:
- CI/CD pipeline security
- Unsigned updates
- Deserialization vulnerabilities

#### A09:2021 - Security Logging Failures

Review:
- Audit logging implementation
- Log injection vulnerabilities
- Log storage security

#### A10:2021 - Server-Side Request Forgery

```bash
# ZAP SSRF detection through active scanning
# Manual testing
curl "https://target.example.com/fetch?url=http://169.254.169.254/latest/meta-data/"
```

### 6. Report Generation

#### JSON Report

```json
{
  "@version": "2.14.0",
  "@generated": "2026-01-24T10:00:00Z",
  "site": [{
    "@name": "https://target.example.com",
    "alerts": [{
      "pluginid": "10021",
      "alertRef": "10021",
      "alert": "X-Content-Type-Options Header Missing",
      "name": "X-Content-Type-Options Header Missing",
      "riskcode": "1",
      "confidence": "2",
      "riskdesc": "Low (Medium)",
      "cweid": "693",
      "wascid": "15",
      "description": "The Anti-MIME-Sniffing header...",
      "solution": "Ensure that the application sets the Content-Type header appropriately...",
      "reference": "https://owasp.org/...",
      "instances": [{
        "uri": "https://target.example.com/",
        "method": "GET",
        "param": "X-Content-Type-Options"
      }]
    }]
  }]
}
```

#### HTML Report

```bash
# Generate HTML report
docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://target.example.com \
  -r owasp-report.html
```

## MCP Server Integration

This skill can leverage the following MCP servers:

| Server | Description | Installation |
|--------|-------------|--------------|
| ZAP-MCP | AI-powered OWASP ZAP integration | [GitHub](https://github.com/ajtazer/ZAP-MCP) |
| mcp-zap-server | Spring Boot ZAP MCP server | [GitHub](https://github.com/dtkmn/mcp-zap-server) |
| pentestMCP | 20+ tools including ZAP | [GitHub](https://github.com/ramkansal/pentestMCP) |

### ZAP-MCP Features

- Automated scan initiation
- Result parsing and analysis
- AI-powered vulnerability assessment
- Remediation guidance generation

## Be