Security Test Scanner

Automated security vulnerability testing covering OWASP Top 10, SQL injection, XSS, CSRF, authentication issues, and authorization flaws.

Features

• OWASP Top 10 testing - Complete coverage of critical web vulnerabilities
• Injection testing - SQL, NoSQL, command, LDAP, template injection
• XSS detection - Reflected, stored, and DOM-based XSS
• Authentication testing - Weak passwords, session management, JWT flaws
• Authorization testing - Privilege escalation, IDOR, access control
• Security misconfiguration - Default credentials, verbose errors, headers
• API security - Rate limiting, CORS, input validation
• Comprehensive reporting - Severity ratings, PoC, remediation steps

Installation

/plugin install security-test-scanner@claude-code-plugins-plus

Usage

The security scanner agent activates when discussing security testing:

Test the API for SQL injection vulnerabilities
Generate security tests for the authentication system
Check for OWASP Top 10 vulnerabilities in the application
Scan for XSS vulnerabilities in the comment system

Vulnerability Coverage

OWASP Top 10 (2021)

1. A01: Broken Access Control - Authorization bypass, privilege escalation
2. A02: Cryptographic Failures - Weak encryption, exposed data
3. A03: Injection - SQL, NoSQL, command injection
4. A04: Insecure Design - Design flaws, missing controls
5. A05: Security Misconfiguration - Defaults, verbose errors
6. A06: Vulnerable Components - Outdated dependencies, CVEs
7. A07: Authentication Failures - Weak passwords, sessions
8. A08: Integrity Failures - Insecure deserialization
9. A09: Logging Failures - Missing logs, monitoring
10. A10: SSRF - Server-side request forgery

Test Examples

SQL Injection Tests

describe('SQL Injection Prevention', () => {
  const sqlPayloads = [
    "' OR '1'='1",
    "'; DROP TABLE users--",
    "' UNION SELECT * FROM passwords--",
    "admin'--"
  ];

  sqlPayloads.forEach(payload => {
    it(`should block SQL injection: ${payload}`, async () => {
      const response = await api.get(`/api/users?query=${payload}`);
      expect(response.status).not.toBe(200);
      expect(response.data).not.toContain('SQL');
    });
  });
});

XSS Prevention Tests

describe('XSS Prevention', () => {
  it('should sanitize script tags in user input', async () => {
    const xssPayload = '<script>alert("XSS")</script>';
    const response = await api.post('/api/comments', { text: xssPayload });

    const comment = await api.get(`/api/comments/${response.data.id}`);
    expect(comment.data.text).not.toContain('<script>');
  });
});

Authentication Tests

describe('Authentication Security', () => {
  it('should prevent brute force attacks', async () => {
    const attempts = Array(10).fill().map(() =>
      api.post('/api/auth/login', { email: '[email protected]', password: 'wrong' })
    );

    const responses = await Promise.all(attempts);
    expect(responses[9].status).toBe(429); // Rate limited
  });

  it('should reject expired JWT tokens', async () => {
    const expiredToken = 'expired.jwt.token';
    const response = await api.get('/api/users/me', {
      headers: { Authorization: `Bearer ${expiredToken}` }
    });
    expect(response.status).toBe(401);
  });
});

Authorization Tests

describe('Authorization Security', () => {
  it('should prevent horizontal privilege escalation', async () => {
    const userAToken = await loginAs('[email protected]');
    const response = await api.get('/api/users/user-b-id', {
      headers: { Authorization: `Bearer ${userAToken}` }
    });
    expect(response.status).toBe(403);
  });

  it('should prevent vertical privilege escalation', async () => {
    const userToken = await loginAs('[email protected]');
    const response = await api.delete('/api/admin/users', {
      headers: { Authorization: `Bearer ${userToken}` }
    });
    expect(response.status).toBe(403);
  });
});

Security Report

The plugin generates detailed security reports:

Security Test Report
====================
Date: 2025-10-11
Application: API v2.0
Tests Run: 87
Vulnerabilities: 5

CRITICAL (1)
   SQL Injection in /api/users/search
     CVSS: 9.8
     Impact: Database access, data exfiltration
     PoC: GET /api/users/search?query=' OR '1'='1'--
     Fix: Use parameterized queries or ORM

HIGH (2)
  ️ Missing authentication on /api/admin/*
     CVSS: 8.5
     Impact: Unauthorized admin access
…

Severity Ratings

• CRITICAL - Immediate exploitation, severe impact
• HIGH - Easy exploitation, significant impact
• MEDIUM - Moderate difficulty, limited impact
• LOW - Difficult exploitation, minimal impact
• INFO - No direct security impact