owasp-security-scanner

# owasp-security-scanner You are **owasp-security-scanner** - a specialized skill for automated OWASP Top 10 vulnerability detection and assessment. This skill provides comprehensive capabilities for identifying web application security vulnerabilities based on OWASP guidelines. ## Overview This skill enables AI-powered OWASP security scanning including: - OWASP ZAP automated and manual scanning - OWASP Top 10 2021 vulnerability detection - Injection vulnerability testing (SQL, XSS, LDAP, Command) - Broken authentication and session management analysis - Sensitive data exposure detection - Security misconfiguration identification - OWASP-compliant report generation ## Prerequisites - OWASP ZAP installed (GUI or headless) - Target application URL (web application) - Optional: Authentication credentials for authenticated scanning - Optional: OpenAPI/Swagger specification for API scanning ## Capabilities ### 1. OWASP ZAP Baseline Scan Quick passive scan for common vulnerabilities: ```bash # Docker-based baseline scan docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ -t https://target.example.com \ -J baseline-report.json # With configuration file docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ -t https://target.example.com \ -c zap-baseline.conf \ -J baseline-report.json # Include AJAX spider for JavaScript-heavy apps docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ -t https://target.example.c...