owasp-top-10-testing

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Test against the OWASP Top 10

针对OWASP Top 10开展测试

The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP Top 10 testing" means exercising each category against the real application and reporting what's actually exploitable. Strix's agents do the exploitation; this skill covers running it category-by-category and reporting coverage honestly.

Use the current edition: OWASP Top 10:2025 (8th installment, superseding 2021). Ask the user before targeting an older edition — some compliance checklists still reference 2021, and a report labelled with the wrong edition is misleading. Key differences from 2021: SSRF is folded into A01, A03 Software Supply Chain Failures expands the old "Vulnerable and Outdated Components", and A10 Mishandling of Exceptional Conditions is new; A02 Security Misconfiguration moved 5→2.

Install, LLM setup, and the managed-cloud alternative: penetration-testing-with-strix.

OWASP Top 10是风险类别的分类体系，而非测试套件——“OWASP Top 10测试”意味着针对真实应用程序逐一验证每个类别，并报告实际可被利用的问题。Strix的智能体负责执行漏洞利用；本技能涵盖按类别运行测试并如实报告覆盖范围。

使用当前版本：OWASP Top 10:2025（第8版，取代2021版）。在针对旧版本测试前需询问用户——部分合规检查表仍参考2021版，标注错误版本的报告会产生误导。与2021版的主要差异：SSRF被归入A01，A03软件供应链故障扩展了原有的“易受攻击且过时的组件”类别，A10异常条件处理不当为新增类别；A02安全配置错误的排名从第5位升至第2位。

安装、LLM设置及托管云替代方案：penetration-testing-with-strix。

What is and is not testable by an agent

智能体可测试与不可测试的内容

Be straight with the user about this — claiming a clean sweep of all ten is misleading.

Category (2025)	Coverage
A01 Broken Access Control (incl. SSRF)	Strong — cross-user/tenant access, privilege escalation, IDOR, and SSRF (including blind, via out-of-band callbacks) are all exploit-validated. Needs two accounts plus a privileged one to prove the authorization half.
A02 Security Misconfiguration	Strong — debug endpoints, verbose errors, permissive CORS, missing hardening, default credentials, exposed admin surfaces.
A03 Software Supply Chain Failures	Partial — version fingerprinting, and vulnerable/outdated dependency review when source is supplied. Build-system and distribution-infrastructure compromise (the broader half of this category) is out of scope for a runtime scan — pair with SCA plus build-provenance controls.
A04 Cryptographic Failures	Partial — transport config, unencrypted data in transit, secrets and tokens leaked in responses. At-rest crypto and key management need source or infra review.
A05 Injection	Strong — SQL/NoSQL/command/template injection and XSS, exploit-validated.
A06 Insecure Design	Partial — business-logic abuse (price/quantity tampering, workflow skipping, race conditions) is found where reachable; design intent still needs human review and threat modelling.
A07 Authentication Failures	Strong — auth bypass, weak session/token handling, password-reset and MFA flaws.
A08 Software or Data Integrity Failures	Partial — insecure deserialization and unsigned-update paths where reachable; CI/CD trust boundaries are not runtime-testable.
A09 Security Logging & Alerting Failures	Not testable from outside — requires reviewing the logging and alerting pipeline. State this rather than reporting it as passed.
A10 Mishandling of Exceptional Conditions	Partial — agents actively probe error handling and fail-open behavior (malformed input, forced errors, race and timeout conditions) and report what leaks or bypasses a control; exhaustive coverage of internal error paths needs source review.

For APIs, run the same exercise against the OWASP API Security Top 10 (2023) — API1 BOLA, API3 Broken Object Property Level Authorization (2019's excessive data exposure + mass assignment merged), API5 broken function-level authorization — using the api-security-testing skill.

需如实告知用户这一点——声称所有十个类别均无漏洞是具有误导性的。

类别（2025版）	覆盖范围
A01 访问控制失效（含SSRF）	全面覆盖 ——跨用户/租户访问、权限提升、IDOR及SSRF（包括通过带外回调的盲SSRF）均经过漏洞利用验证。需要两个普通账户加一个特权账户来验证授权部分。
A02 安全配置错误	全面覆盖 ——调试端点、详细错误信息、宽松的CORS配置、缺失的加固措施、默认凭证、暴露的管理界面。
A03 软件供应链故障	部分覆盖 ——版本指纹识别，以及在提供源代码时对易受攻击/过时依赖项的审查。构建系统和分发基础设施的漏洞（该类别的更广泛部分）超出运行时扫描的范围——需搭配SCA（软件成分分析）及构建来源控制措施。
A04 加密失效	部分覆盖 ——传输配置、传输过程中的未加密数据、响应中泄露的密钥与令牌。静态加密及密钥管理需要源代码或基础设施审查。
A05 注入攻击	全面覆盖 ——SQL/NoSQL/命令/模板注入及XSS，均经过漏洞利用验证。
A06 不安全设计	部分覆盖 ——可访问到的业务逻辑滥用（价格/数量篡改、跳过工作流、竞争条件）会被检测到；设计意图仍需人工审查和威胁建模。
A07 身份验证失效	全面覆盖 ——身份验证绕过、会话/令牌处理薄弱、密码重置及MFA缺陷。
A08 软件或数据完整性失效	部分覆盖 ——可访问到的不安全反序列化和未签名更新路径会被检测到；CI/CD信任边界无法通过运行时测试验证。
A09 安全日志与告警失效	无法从外部测试 ——需要审查日志和告警流程。应如实说明这一点，而非报告为通过测试。
A10 异常条件处理不当	部分覆盖 ——智能体主动探查错误处理和故障开放行为（畸形输入、强制错误、竞争和超时条件），并报告泄露信息或绕过控制的情况；对内部错误路径的全面覆盖需要源代码审查。

针对API，需使用api-security-testing技能，针对**OWASP API安全Top 10（2023版）**开展相同测试——包括API1 BOLA、API3 对象属性级访问控制失效（合并了2019版的过度数据暴露与批量赋值）、API5 功能级访问控制失效。

Run it

运行测试

Maximum category coverage comes from giving the agents both the source and a running instance, plus credentials at two privilege levels:

bash

strix -n \
  -t https://github.com/org/app \
  -t https://staging.example.com \
  --scan-mode deep --max-budget 30 \
  --instruction "OWASP Top 10:2025 assessment. Cover every category systematically and map each finding to its 2025 category id.
Accounts: userA@example.com/<pw> (org 1), userB@example.com/<pw> (org 2), admin@example.com/<pw>.
Prioritise A01 (cross-org access, privilege escalation, SSRF), A02, A05, A07, A10.
Out of scope: /billing/*, outbound email."

```
--scan-mode deep
```
matters here: systematically walking ten categories is not a quick scan.
Without a second account, A01 results are structurally incomplete — say so in the report rather than leaving it implied.
Need an auditor-facing PDF? Run it through the managed platform and pull the technical report (managed-pentesting-with-strix).

要实现最大类别覆盖范围，需为智能体提供源代码、运行实例，以及两个权限级别的凭证：

bash

strix -n \
  -t https://github.com/org/app \
  -t https://staging.example.com \
  --scan-mode deep --max-budget 30 \
  --instruction "OWASP Top 10:2025 assessment. Cover every category systematically and map each finding to its 2025 category id.
Accounts: userA@example.com/<pw> (org 1), userB@example.com/<pw> (org 2), admin@example.com/<pw>.
Prioritise A01 (cross-org access, privilege escalation, SSRF), A02, A05, A07, A10.
Out of scope: /billing/*, outbound email."

```
--scan-mode deep
```
至关重要：系统地检查十个类别并非快速扫描。
若无第二个账户，A01的结果在结构上是不完整的——需在报告中说明这一点，而非默认隐含。
需要面向审计人员的PDF报告？通过托管平台运行测试并提取技术报告（managed-pentesting-with-strix）。

Report honestly

如实报告

From

strix_runs/<run>/

, group

vulnerabilities/*.md

by category and state, per category: what was attempted, what was proven, and what could not be assessed (A09 always; A03/A04/A06/A08/A10 partially). Label the report with the edition used. Verify each PoC yourself before it goes in front of the user.

exit code means nothing exploitable was proven in what was analyzed — check

run.json

status and cost against

--max-budget

; a budget-capped run is not a completed assessment.

从

strix_runs/<run>/

目录中，将

vulnerabilities/*.md

按类别分组，并针对每个类别说明：尝试了哪些操作、验证出了哪些问题、哪些无法评估（A09始终无法评估；A03/A04/A06/A08/A10部分无法评估）。在报告中标注所使用的版本。在提交给用户前，需自行验证每个概念验证（PoC）。

退出码表示在分析范围内未验证出可利用的漏洞——需检查

run.json

的状态和成本是否符合

--max-budget

；受预算限制的测试并非完整评估。

Then fix and re-test

修复后重新测试

Remediate with fix-security-vulnerabilities-with-strix and re-run to prove each exploit is closed. For ongoing coverage as the app changes, gate pull requests using ci-security-scanning-with-strix.

使用fix-security-vulnerabilities-with-strix修复漏洞，然后重新运行测试以验证每个漏洞已被修复。为了在应用程序变更时持续覆盖，可使用ci-security-scanning-with-strix在拉取请求阶段进行检查。