Owasp Check

OWASP Top 10 Checker

Scan web application source code for the OWASP Top 10 (2021) vulnerability categories.

Process

1. Detect the web framework to understand common vulnerability patterns.
2. Scan each OWASP category using pattern matching and code analysis.
3. Classify findings by severity and provide fix recommendations.
4. Generate a security report with actionable remediation steps.

OWASP Top 10 (2021) Scan Rules

A01 — Broken Access Control

Patterns to detect:

• Missing authorization checks on route handlers / API endpoints
• Direct object references without ownership validation (e.g., /api/users/:id without verifying the requester owns the resource)
• Missing @Secured, @PreAuthorize, authMiddleware, or equivalent decorators on sensitive routes
• CORS misconfiguration: Access-Control-Allow-Origin: * in production code
• Directory traversal: user input used in file paths without sanitization (path.join(userInput), open(user_path))
• Forced browsing: sensitive routes without auth (/admin, /api/internal)

A02 — Cryptographic Failures

Patterns to detect:

• Weak hashing: MD5, SHA1 used for passwords or sensitive data
• Hardcoded encryption keys or salts
• HTTP URLs for sensitive data transmission (non-HTTPS)
• Missing encryption for PII storage
• Weak random number generation (Math.random(), random.random() for security purposes)
• Deprecated crypto algorithms (DES, RC4, 3DES)

A03 — Injection

Patterns to detect:

• SQL Injection: string concatenation/interpolation in SQL queries ("SELECT * FROM users WHERE id=" + id, f-strings in queries)
• NoSQL Injection: unsanitized user input in MongoDB queries ({$where}, {$gt})
• Command Injection: user input in exec(), system(), child_process.exec(), subprocess.run(shell=True)
• LDAP Injection: unsanitized input in LDAP queries
• Template Injection: user input in template strings (render_template_string(user_input))
• XPath Injection: user input in XPath queries

A04 — Insecure Design

Patterns to detect:

• Missing rate limiting on authentication endpoints
• No account lockout after failed login attempts
• Missing CAPTCHA on public forms
• Unrestricted file upload (no type/size validation)
• Missing input validation on API endpoints
• Business logic that can be bypassed client-side

A05 — Security Misconfiguration

Patterns to detect:

• Debug mode enabled: DEBUG=True, NODE_ENV=development in production configs
• Default credentials: admin/admin, root/root, password in code
• Verbose error messages exposed to users (stack traces in API responses)
• Unnecessary HTTP headers exposed (X-Powered-By, Server)
• Missing security headers (X-Frame-Options, Content-Security-Policy, X-Content-Type-Options)
• Open directory listings

A06 — Vulnerable and Outdated Components

Patterns to detect:

• Known vulnerable library versions imported
• CDN links to unversioned or very old libraries
• Deprecated API usage flagged by linters
• Components with known CVEs

A07 — Identification and Authentication Failures

Patterns to detect:

• Passwords stored in plaintext or with weak hashing
• Missing password complexity validation
• Session tokens in URLs
• Session not invalidated on logout
• Missing MFA on sensitive operations
• JWT without expiration (exp claim)
• JWT secret hardcoded in source

A08 — Software and Data Integrity Failures

Patterns to detect:

• eval(), Function(), exec() with dynamic input
• dangerouslySetInnerHTML in React without sanitization
• innerHTML assignment with user data
• Deserialization of untrusted data (pickle.loads(), ObjectInputStream, JSON.parse of unvalidated input)
• Missing integrity checks on CDN resources (no integrity attribute on script tags)
• CI/CD pipeline without signed commits or verified actions

A09 — Security Logging and Monitoring Failures

Patterns to detect:

• No logging on authentication events (login, logout, failed attempts)
• Sensitive data in logs (passwords, tokens, PII)
• Missing error logging in catch blocks (empty catch {})
• No audit trail for admin operations
• Logging credentials or secrets

A10 — Server-Side Request Forgery (SSRF)

Patterns to detect:

• User input used in URL construction for server-side requests (fetch(userUrl), requests.get(user_input))
• No URL validation/allowlisting for outbound requests
• Internal service URLs accessible via user input
• Redirect URLs without validation

Exclusion Rules

• Skip node_modules/, vendor/, .git/, dist/, build/
• Skip test files for most checks (except secrets in test fixtures)
• Skip commented-out code
• Skip documentation files

Output Format

## OWASP Security Scan Report

**Project:** 
**Framework:** 
**Scanned:**  files
**Date:** 

### Risk Summary
| OWASP Category | Findings | Severity |
|----------------|----------|----------|
| A01 Broken Access Control | X | HIGH |
| A03 Injection | X | CRITICAL |
| ... | ... | ... |

### Critical Findings

#### [A03] SQL Injection in user query
**File:** `src/routes/users.js:45`
**Code:**

const query = SELECT * FROM users WHERE id = ${req.params.id};

**Risk:** Attacker can execute arbitrary SQL commands.
**Fix:** Use parameterized queries:

const query = SELECT * FROM users WHERE id = $1; db.query(query, [req.params.id]);

### High Findings
...

### Medium Findings
...

### Security Checklist
- [ ] All SQL queries use parameterized statements
- [ ] User input is sanitized before rendering in HTML
- [ ] Authentication required on all sensitive endpoints
- [ ] Security headers configured
- [ ] No secrets hardcoded in source
- [ ] Logging enabled for auth events

### Recommended Next Steps
1. Fix critical findings immediately
2. Add security headers middleware
3. Enable SAST in CI pipeline
4. Schedule regular dependency audits

Rules

• If $ARGUMENTS is provided, scan only that directory.
• Focus on real, exploitable patterns — not theoretical risks.
• Always provide a concrete fix for each finding.
• Rate findings honestly — not everything is critical.
• If the project is clean: "No significant OWASP vulnerabilities detected. Good security hygiene."

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pulkit0x
• Source: pulkit0x/claude-armory
• License: MIT

Install and usage instructions live in the source repository linked above.