Imported from securityskills/skills (
web-appsec/owasp/owasp-top10-analysis/SKILL.md). Install upstream withnpx skills add securityskills/skills --skill owasp-top10-analysis. Copyright stays with the author.
OWASP Top 10 Analysis
Work a web application category-by-category so nothing is skipped.
Checklist by Category (2021)
A01 Broken Access Control
- Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts
- Verify server-side enforcement on every endpoint, not just UI hiding
- Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates
- Check forced browsing to admin routes after logout/role downgrade
A02 Cryptographic Failures
- Confirm TLS 1.2+ only, HSTS present
- Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for passwords
- Passwords hashed with bcrypt/argon2 + per-user salt; secrets not in client bundles
A03 Injection
- SQL/NoSQL/ORM injection: parameterized queries verified; test in sort/filter/order params, not just search
- OS command injection in file upload/filename handling, image processing, PDF generators
- Header injection, template injection (SSTI) in email/render features
A04 Insecure Design
- Business logic abuse: negative quantities, currency confusion, race conditions on credits/coupons
- Trust-boundary violations: client-computed prices, unsigned discount tokens
A05 Security Misconfiguration
- Debug modes, default credentials, verbose errors, directory listing
- Unnecessary features enabled (PUT, TRACE), permissive CORS (
*with credentials)
A06 Vulnerable Components
- SBOM against known CVEs; flag unmanaged/EOL dependencies
- Check client-side libs too (npm audit / Retire.js signals)
A07 Authentication Failures
- Credential stuffing resistance (rate limiting, MFA), session fixation, weak password policy
- Session tokens: rotated on login, invalidated on logout, secure/httpOnly flags
- MFA bypass flows: reset, backup codes, OAuth account linking
A08 Integrity Failures
- Unsigned updates/deserialization of untrusted data (pick your targets: memcached, JWT, file parsers)
- CI/CD pipeline: pinned dependencies, verified provenance
A09 Logging & Monitoring
- Auth events, access-control denials, and input-validation failures are logged with context
- Logs don't contain passwords/tokens; alerting exists for brute force
A10 SSRF
- Any URL-fetch feature (webhooks, importers, preview generators): test localhost, link-local (169.254.169.254), IPv6 equivalents, DNS rebinding
- Scheme and redirect handling enforced server-side
Output
Per finding: category, evidence, reproduction, severity, fix. Note verified-negatives per category for coverage evidence.