Vulnerability Scanner

Advanced vulnerability analysis for OWASP 2025, supply chain security, attack surface mapping, and risk prioritization.

Description

USE WHEN:

• Auditing code for security vulnerabilities
• Reviewing dependencies for supply chain risks
• Scanning for hardcoded secrets or credentials
• Identifying dangerous code patterns (injection, XSS, deserialization)
• Preparing for security audits or penetration tests
• Prioritizing vulnerability remediation by risk

DON'T USE WHEN:

• Need runtime dynamic analysis (use actual pentest tools)
• Scanning compiled binaries (this is source-code focused)
• Need compliance-specific audits (PCI-DSS, HIPAA have dedicated tools)

Scripts

Quick Start

# Full scan
python scripts/security_scan.py /path/to/project

# Just check for secrets
python scripts/security_scan.py /path/to/project --scan-type secrets

# Summary output
python scripts/security_scan.py /path/to/project --output summary

Reference Files

1. Security Expert Mindset

Core Principles

Threat Modeling Questions

Before scanning, ask:

1. What are we protecting? (Assets)
2. Who would attack? (Threat actors)
3. How would they attack? (Attack vectors)
4. What's the impact? (Business risk)

2. OWASP Top 10:2025

Risk Categories

2025 Key Changes

2021 → 2025 Shifts:
├── SSRF merged into A01 (Access Control)
├── A02 elevated (Cloud/Container configs)
├── A03 NEW: Supply Chain (major focus)
├── A10 NEW: Exceptional Conditions
└── Focus shift: Root causes > Symptoms

3. Supply Chain Security (A03)

Attack Surface

Defense Principles

• Verify package integrity (checksums)
• Pin versions, audit updates
• Use private registries for critical deps
• Sign and verify artifacts

4. Attack Surface Mapping

What to Map

Prioritization Matrix

Risk = Likelihood × Impact

High Impact + High Likelihood → CRITICAL
High Impact + Low Likelihood  → HIGH
Low Impact + High Likelihood  → MEDIUM
Low Impact + Low Likelihood   → LOW

5. Risk Prioritization

CVSS + Context

Prioritization Decision Tree

Is it actively exploited (EPSS >0.5)?
├── YES → CRITICAL: Immediate action
└── NO → Check CVSS
         ├── CVSS ≥9.0 → HIGH
         ├── CVSS 7.0-8.9 → Consider asset value
         └── CVSS <7.0 → Schedule for later

6. Exceptional Conditions (A10 - New)

Fail-Open vs Fail-Closed

What to Check

• Exception handlers that catch-all and ignore
• Missing error handling on security operations
• Race conditions in auth/authz
• Resource exhaustion scenarios

7. Scanning Methodology

Phase-Based Approach

1. RECONNAISSANCE
   └── Understand the target
       ├── Technology stack
       ├── Entry points
       └── Data flows

2. DISCOVERY
   └── Identify potential issues
       ├── Configuration review
       ├── Dependency analysis
       └── Code pattern search

3. ANALYSIS
   └── Validate and prioritize
       ├── False positive elimination
       ├── Risk scoring
       └── Attack chain mapping

4. REPORTING
   └── Actionable findings
       ├── Clear reproduction steps
       ├── Business impact
       └── Remediation guidance

8. Code Pattern Analysis

High-Risk Patterns

Secret Patterns

9. Cloud Security Considerations

Shared Responsibility

Cloud-Specific Checks

• IAM: Least privilege applied?
• Storage: Public buckets?
• Network: Security groups tightened?
• Secrets: Using secrets manager?

10. Anti-Patterns

11. Reporting Principles

Finding Structure

Each finding should answer:

1. What? - Clear vulnerability description
2. Where? - Exact location (file, line, endpoint)
3. Why? - Root cause explanation
4. Impact? - Business consequence
5. How to fix? - Specific remediation

Severity Classification

> Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"