owasp-checker

OWASP Top 10 Checker Skill

Purpose

This skill provides systematic verification of application compliance with the OWASP Top 10 2021 security standards, ensuring comprehensive security coverage across all critical categories.

When to Use

• Final security validation before deployment
• Security certification and compliance
• Security audit preparation
• Post-remediation verification
• Quarterly security reviews
• Pre-release security checklist

OWASP Top 10 2021 Compliance Workflow

A01:2021 - Broken Access Control

Risk: Users can act outside of their intended permissions

Compliance Checks:

1. Authorization Enforcement:

# Check for authorization decorators/middleware
grep -r "@requires_auth\|@login_required\|@permission_required" src/
grep -r "auth_required\|check_permission" src/

# Find routes without authorization
grep -r "@app.route\|@router.get\|@router.post" src/ --include="*.py" -A 5

Checklist:

• Authorization enforced on every endpoint
• Default deny access control
• Server-side authorization (not client-side only)
• Authorization checked on every request
• Role-based access control (RBAC) implemented
• Ownership verified for object access

2. Insecure Direct Object References (IDOR):

# Look for direct ID usage from requests
grep -r "request.*\['id'\]\|request.*\.id\|params\['id'\]" src/

Checklist:

• No direct object references without validation
• Ownership verified before access
• Indirect references used (e.g., session-based)
• UUID instead of sequential IDs where applicable

3. CORS Configuration:

# Check CORS settings
grep -r "Access-Control-Allow-Origin" src/ config/
grep -r "CORS.*origin" src/ --include="*.py" --include="*.js"

Checklist:

• No wildcard (*) CORS unless absolutely necessary
• Specific origin whitelist configured
• Credentials mode properly configured
• Preflight requests handled correctly

4. Disable Directory Listing:

# Check web server config
grep -r "autoindex\|directory.*listing" config/