Owasp Vulnerability Checker

---
name: OWASP Vulnerability Checker
description: Audit API endpoints for common security vulnerabilities (XSS, SQLi, CSRF).
metadata:
  source: skills/owasp-vulnerability-checker/owasp-vulnerability-checker.md
---

# OWASP Vulnerability Checker

## Prerequisites & Dependencies
- Target API running in a non-production (staging) environment, with test credentials for authed routes and explicit authorization to test
- OWASP ZAP (`ghcr.io/zaproxy/zaproxy:stable`) or `nuclei` for automated scanning
- The API's OpenAPI spec (if available) to drive context-aware coverage

## Execution Steps
1. Map the attack surface: enumerate endpoints, HTTP methods, authentication mechanisms, and input parameters from code or the OpenAPI spec.
2. Run an automated ZAP baseline scan against the staging URL, importing the OpenAPI definition for full endpoint coverage.
3. Manually probe OWASP Top 10 items: SQLi on filter/query parameters, reflected and stored XSS on output fields, CSRF on state-changing endpoints, broken access control via IDOR paths.
4. Check configuration and headers: missing CSP/HSTS, verbose error messages, CORS misconfigurations, exposed debug/admin endpoints.
5. Record findings with severity, reproduction steps, and OWASP category; prioritize anything that exfiltrates or mutates other users' data.
6. Verify fixes with a rescan and provide remediation guidance (parameterized queries, output encoding/escaping, anti-CSRF tokens, proper session flags).

```bash
docker run -u zap -v $(pwd):/zap/wrk ghcr.io/zaproxy/zaproxy:stable \
  zap-scan.py -t https://staging.example.com/api -I -J -r zap-report.html
```

```http
# Manual probes (staging only, with authorization)
GET /api/users?id=1' OR '1'='1                              # SQLi boolean probe
POST /api/comments  {"body":"<img src=x onerror=alert(1)>"} # stored XSS probe
POST /api/account/email  (omit CSRF token, foreign Referer) # CSRF probe
GET /api/users/4711/invoices                                # IDOR / broken access control
```