Vulnerability Scanner

Think like an attacker, defend like an expert. 2025 threat landscape awareness.

🔧 Runtime Scripts

Execute for automated validation:

Script

Purpose

Usage

scripts/security_scan.py

Validate security principles applied

python scripts/security_scan.py <project_path>

📋 Reference Files

File

Purpose

checklists.md

OWASP Top 10, Auth, API, Data protection checklists

1. Security Expert Mindset

Core Principles

Principle

Application

Assume Breach

Design as if attacker already inside

Zero Trust

Never trust, always verify

Defense in Depth

Multiple layers, no single point

Least Privilege

Minimum required access only

Fail Secure

On error, deny access

Threat Modeling Questions

Before scanning, ask:

• What are we protecting? (Assets)

• Who would attack? (Threat actors)

• How would they attack? (Attack vectors)

• What's the impact? (Business risk)

2. OWASP Top 10:2025

Risk Categories

Rank

Category

Think About

A01

Broken Access Control

Who can access what? IDOR, SSRF

A02

Security Misconfiguration

Defaults, headers, exposed services

A03

Software Supply Chain 🆕

Dependencies, CI/CD, build integrity

A04

Cryptographic Failures

Weak crypto, exposed secrets

A05

Injection

User input → system commands

A06

Insecure Design

Flawed architecture

A07

Authentication Failures

Session, credential management

A08

Integrity Failures

Unsigned updates, tampered data

A09

Logging & Alerting

Blind spots, no monitoring

A10

Exceptional Conditions 🆕

Error handling, fail-open states

2025 Key Changes

2021 → 2025 Shifts:

├── SSRF merged into A01 (Access Control)

├── A02 elevated (Cloud/Container configs)

├── A03 NEW: Supply Chain (major focus)

├── A10 NEW: Exceptional Conditions

└── Focus shift: Root causes > Symptoms

3. Supply Chain Security (A03)

Attack Surface

Vector

Risk

Question to Ask

Dependencies

Malicious packages

Do we audit new deps?

Lock files

Integrity attacks

Are they committed?

Build pipeline

CI/CD compromise

Who can modify?

Registry

Typosquatting

Verified sources?

Defense Principles

• Verify package integrity (checksums)

• Pin versions, audit updates

• Use private registries for critical deps

• Sign and verify artifacts

4. Attack Surface Mapping

What to Map

Category

Elements

Entry Points

APIs, forms, file uploads

Data Flows

Input → Process → Output

Trust Boundaries

Where auth/authz checked

Assets

Secrets, PII, business data

Prioritization Matrix

Risk = Likelihood × Impact

High Impact + High Likelihood → CRITICAL

High Impact + Low Likelihood  → HIGH

Low Impact + High Likelihood  → MEDIUM

Low Impact + Low Likelihood   → LOW

5. Risk Prioritization

CVSS + Context

Factor

Weight

Question

CVSS Score

Base severity

How severe is the vuln?

EPSS Score

Exploit likelihood

Is it being exploited?

Asset Value

Business context

What's at risk?

Exposure

Attack surface

Internet-facing?

Prioritization Decision Tree

Is it actively exploited (EPSS >0.5)?

├── YES → CRITICAL: Immediate action

└── NO → Check CVSS

         ├── CVSS ≥9.0 → HIGH

         ├── CVSS 7.0-8.9 → Consider asset value

         └── CVSS <7.0 → Schedule for later

6. Exceptional Conditions (A10 - New)

Fail-Open vs Fail-Closed

Scenario

Fail-Open (BAD)

Fail-Closed (GOOD)

Auth error

Allow access

Deny access

Parsing fails

Accept input

Reject input

Timeout

Retry forever

Limit + abort

What to Check

• Exception handlers that catch-all and ignore

• Missing error handling on security operations

• Race conditions in auth/authz

• Resource exhaustion scenarios

7. Scanning Methodology

Phase-Based Approach

1. RECONNAISSANCE

   └── Understand the target

       ├── Technology stack

       ├── Entry points

       └── Data flows

2. DISCOVERY

   └── Identify potential issues

       ├── Configuration review

       ├── Dependency analysis

       └── Code pattern search

3. ANALYSIS

   └── Validate and prioritize

       ├── False positive elimination

       ├── Risk scoring

       └── Attack chain mapping

4. REPORTING

   └── Actionable findings

       ├── Clear reproduction steps

       ├── Business impact

       └── Remediation guidance

8. Code Pattern Analysis

High-Risk Patterns

Pattern

Risk

Look For

String concat in queries

Injection

"SELECT * FROM " + user_input

Dynamic code execution

RCE

eval(), exec(), Function()

Unsafe deserialization

RCE

pickle.loads(), unserialize()

Path manipulation

Traversal

User input in file paths

Disabled security

Various

verify=False, --insecure

Secret Patterns

Type

Indicators

API Keys

api_key, apikey, high entropy

Tokens

token, bearer, jwt

Credentials

password, secret, key

Cloud

AWS_, AZURE_, GCP_ prefixes

9. Cloud Security Considerations

Shared Responsibility

Layer

You Own

Provider Owns

Data

✅

❌

Application

✅

❌

OS/Runtime

Depends

Depends

Infrastructure

❌

✅

Cloud-Specific Checks

• IAM: Least privilege applied?

• Storage: Public buckets?

• Network: Security groups tightened?

• Secrets: Using secrets manager?

10. Anti-Patterns

❌ Don't

✅ Do

Scan without understanding

Map attack surface first

Alert on every CVE

Prioritize by exploitability + asset

Ignore false positives

Maintain verified baseline

Fix symptoms only

Address root causes

Scan once before deploy

Continuous scanning

Trust third-party deps blindly

Verify integrity, audit code

11. Reporting Principles

Finding Structure

Each finding should answer:

• What? - Clear vulnerability description

• Where? - Exact location (file, line, endpoint)

• Why? - Root cause explanation

• Impact? - Business consequence

• How to fix? - Specific remediation

Severity Classification

Severity

Criteria

Critical

RCE, auth bypass, mass data exposure

High

Data exposure, privilege escalation

Medium

Limited scope, requires conditions

Low

Informational, best practice

Remember: Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"