Vulnerability Analysis
Systematic identification and verification of security weaknesses based on the OWASP Top 10 and other common vulnerability classes.
Why Vulnerability Analysis Matters
Pro Tip: This phase connects reconnaissance and scanning with exploitation. The goal is to identify and validate vulnerabilities before attempting to exploit them.
Essential Vulnerability Analysis Tools
Vulnerability Analysis Process
Interactive OWASP Top 10 Dashboard
Explore the OWASP Top 10 (2021) categories. Click on each to see testing techniques and common vulnerabilities.
OWASP Top 10 (2021)
Click any category for details, breach examples, and quick test checklists
What Vulnerability Am I Looking At?
Not sure what vulnerability you have found? Use this decision tree to identify it based on observed behavior.
Vulnerability Decision Tree
Answer questions to identify the vulnerability
What behavior are you observing?
Select the primary indicator you noticed during testing
Manual Testing Methodology
Systematic testing ensures comprehensive coverage. Test each input type against relevant vulnerability classes.
Testing Checklist by Input Type
URL Parameters
- SQL injection
- XSS (reflected)
- Path traversal
- IDOR
- Open redirect
- SSRF
Form Fields
- SQL injection
- XSS (stored/reflected)
- Command injection
- File upload bypass
- CSRF
- Input validation bypass
Headers
- Host header injection
- X-Forwarded-For manipulation
- User-Agent injection
- Referer injection
Cookies
- Session hijacking
- Cookie manipulation
- Missing Secure/HttpOnly
- Predictable session tokens
Automated Scanning Commands
# Nuclei - comprehensive vulnerability scan
nuclei -u https://example.com -t cves/ -t vulnerabilities/
# Nikto - web server misconfiguration
nikto -h https://example.com -o nikto_report.html -Format htm
# SQLMap - SQL injection detection
sqlmap -u "https://example.com/page?id=1" --batch --level=3
# Wapiti - black-box scanning
wapiti -u https://example.com -o wapiti_report -f html# Nuclei - comprehensive vulnerability scan
nuclei -u https://example.com -t cves/ -t vulnerabilities/
# Nikto - web server misconfiguration
nikto -h https://example.com -o nikto_report.html -Format htm
# SQLMap - SQL injection detection
sqlmap -u "https://example.com/page?id=1" --batch --level=3
# Wapiti - black-box scanning
wapiti -u https://example.com -o wapiti_report -f htmlDAST vs SAST vs Manual Testing
No single approach catches all vulnerabilities. A mature testing methodology combines automated and manual techniques.
| Approach | Strengths | Weaknesses | Best For |
|---|---|---|---|
| DAST (Dynamic) | Finds runtime issues, no source needed, tests real deployment | Slow, noisy, misses logic flaws, coverage depends on crawling | SQLi, XSS, misconfigurations, header issues |
| SAST (Static) | Fast, finds code-level flaws early, good coverage of codebase | High false-positive rate, can't find runtime/config issues | Hardcoded secrets, insecure patterns, injection sinks |
| IAST (Interactive) | Combines runtime + code context, lower false positives | Requires agent in app, complex setup | CI/CD integration, complex data flows |
| Manual Testing | Finds logic flaws, chained attacks, understands context | Time-intensive, depends on tester skill, not scalable | Business logic, auth bypass, complex attack chains |
Information
SAST & Modern Analysis Tools
When source code or CI/CD pipeline access is available, integrate these tools for deeper coverage:
Semgrep
Lightweight SAST with 2,000+ community rules for injection, auth flaws, secrets, and more.
semgrep --config=auto . Website → CodeQL
Semantic code analysis engine by GitHub; ideal for tracing taint flows from source to sink.
codeql database analyze GitHub → Snyk Code
Real-time SAST with IDE integration; catches vulnerabilities during development.
snyk code test Website → AI-Assisted Analysis
Threat Modeling Primer
Before diving into testing, a brief threat model helps prioritize where to spend time. Ask these questions:
1. What are we protecting?
- • User PII, credentials, financial data
- • Business logic integrity (transactions, pricing)
- • Infrastructure access (admin panels, APIs)
2. What can go wrong? (STRIDE)
- • Spoofing — impersonate users/services
- • Tampering — modify data in transit/at rest
- • Repudiation — deny performing an action
- • Information Disclosure — leak sensitive data
- • Denial of Service — disrupt availability
- • Elevation of Privilege — gain unauthorized access
3. Who are the threat actors?
- • Anonymous external attacker
- • Authenticated low-privilege user
- • Malicious insider / partner
- • Automated bot / script kiddie
4. Where are the trust boundaries?
- • Client → Server (never trust the client)
- • Frontend → API (authorization enforcement)
- • App → Database (parameterized queries)
- • Internal → External services (SSRF surface)
OWASP Category → Exploitation Guides
Once you identify a potential vulnerability class, jump to the relevant exploitation guide:
| OWASP Category | Exploitation Guides |
|---|---|
| A01: Broken Access Control | IDOR · Privilege Escalation · CORS |
| A02: Cryptographic Failures | JWT Attacks · Session Attacks |
| A03: Injection | SQLi · XSS · Command Injection · SSTI · XXE · LDAP |
| A04: Insecure Design | Business Logic · Race Conditions |
| A05: Security Misconfiguration | Security Headers · CORS · WAF Bypass |
| A06: Vulnerable Components | Deserialization · Dependency Confusion |
| A07: Auth Failures | Auth Bypass · CSRF · Client-Side Attacks |
| A08: Data Integrity | Deserialization · Supply Chain |
| A09: Logging/Monitoring | Addressed in Reporting (detection gap analysis) |
| A10: SSRF | SSRF · Lateral Movement |
Next Steps