# OWASP ZAP (Zed Attack Proxy)
docker run -t owasp/zap2docker-stable zap-baseline.py \
-t https://example.com \
-r zap-report.html
# Nikto (web server scanner)
nikto -h https://example.com -o nikto-report.txt
# Nuclei (fast vulnerability scanner)
nuclei -u https://example.com -t ~/nuclei-templates/
# Burp Suite (commercial, GUI-based)# Manual testing and automated scanning
DAST Best Practices:
Run against staging environment, not production
Use authenticated scans (provide session cookies)
Schedule regular scans (weekly or per deployment)
Combine with SAST for comprehensive coverage
4. Threat Modeling with STRIDE
STRIDE Framework (Microsoft):
S - Spoofing Identity
✅ Use multi-factor authentication
✅ Implement certificate pinning
❌ Never trust client-provided identity
T - Tampering with Data
✅ Use HTTPS/TLS for all communication
✅ Implement request signing (HMAC)
❌ Never accept unsigned data from clients
R - Repudiation
✅ Log all critical operations with timestamps
✅ Implement audit trails
❌ Never allow users to deny actions
I - Information Disclosure
✅ Encrypt sensitive data at rest and in transit
✅ Implement proper access controls
❌ Never expose internal error details
D - Denial of Service
✅ Implement rate limiting and throttling
✅ Use CDN and DDoS protection (Cloudflare)
❌ Never allow unbounded resource consumption
E - Elevation of Privilege
✅ Follow principle of least privilege
✅ Validate permissions at every access point
❌ Never trust user roles from client
Agentic Security Testing Workflow:
1. Code Analysis
- Read codebase and understand behavior
- Identify potential vulnerability surfaces
2. Test Generation
- Generate test cases targeting vulnerabilities
- Create exploit attempts
3. Test Execution
- Run tests in sandbox environment
- Observe application behavior
4. Reasoning Loop
- Analyze results
- Generate new hypotheses
- Iterate until vulnerability confirmed or ruled out
Benchmark: 92% detection rate on synthetic vulnerabilities
Multi-Agent Security (SecureVibes)
Agent Roles:
1. Architecture Mapper: Build system model
2. Threat Modeler: Apply STRIDE framework
3. Code Reviewer: Static analysis with AI reasoning
4. Penetration Tester: Generate and execute exploits
Result: 16-17 vulnerabilities found (4x vs single-agent)
Common Vulnerabilities & Fixes
SQL Injection
# ❌ Vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"
db.execute(query)
# ✅ Fixed
query = "SELECT * FROM users WHERE id = %s"
db.execute(query, (user_id,))
Cross-Site Scripting (XSS)
// ❌ Vulnerabledocument.innerHTML = userInput;
// ✅ Fixeddocument.textContent = userInput;
// Or use a sanitization libraryimportDOMPurifyfrom'dompurify';
document.innerHTML = DOMPurify.sanitize(userInput);
# ❌ Vulnerableimport xml.etree.ElementTree as ET
tree = ET.parse(user_uploaded_xml)
# ✅ Fixedfrom defusedxml.ElementTree import parse
tree = parse(user_uploaded_xml)
# Security-focused code review checklist:# 1. Authentication# - Are passwords hashed properly?# - Is rate limiting implemented?# - Are sessions managed securely?# 2. Authorization# - Is every endpoint protected?# - Are permissions checked correctly?# - Can users access other users' data?# 3. Input Validation# - Are all inputs validated?# - Is SQL injection prevented?# - Is XSS prevented?# 4. Output Encoding# - Is user data sanitized before display?# - Are error messages generic?# 5. Cryptography# - Are modern algorithms used (AES-256, RSA-2048+)?# - Are keys stored securely?# - Is HTTPS enforced?# 6. Error Handling# - Are exceptions caught and logged?# - Do error messages leak information?# 7. Logging# - Are security events logged?# - Are logs protected from tampering?
Related Skills
test-driven-development: Write security tests first
