owasp-probe-library·execution·active

OWASP Probe Library

Curated probes for the OWASP API + Web Top 10. Read-only and non-destructive — safe to run in shared environments and lower production tiers.

SARAtrigger · agent

OWASP Probe Library

A curated set of probes for the OWASP API + Web Top 10. Read-only and non-destructive — safe to run in shared environments and lower production tiers.

When this skill fires

·An engineer kicks off a security scan against a target environment

·A pre-merge check runs the probe library against the staging deployment of a PR

·ARIA requests a fresh security baseline for a quality report

What "non-destructive" means

→Probes never write data, modify state, or trigger side effects. They check whether a vulnerabilityexists, not whether it can be exploited end-to-end.

This is a deliberate trade-off. Some vulnerabilities (stored XSS, IDOR-with-write) require an actual write to confirm. The probe library will detect theprerequisites — unsanitized input reflection, missing authorization on a write endpoint — and flag them with a confidence score, but it won't actually write.

For destructive verification, the *Payload Mutator* runs in a separate, gated mode against a target tagged destructive-testing-allowed.

Coverage

OWASP API Top 10 (2023)

·BOLA / IDOR — by URL pattern detection + role enumeration

·Broken authentication — by token replay, expiry handling, weak rotation

·Property-level authorization — by field enumeration on responses

·Unrestricted resource consumption — by rate-limit absence

·Function-level authorization — by HTTP method + endpoint combination

·Server-side request forgery — by URL parameter detection

·Misconfiguration — by header analysis (CORS, CSP, HSTS, etc.)

·Inventory mgmt — by old API version reachability

·Improper inventory — by undocumented endpoint discovery

OWASP Web Top 10 (2021)

·Broken access control

·Cryptographic failures (weak TLS, missing HSTS, exposed PII over HTTP)

·Injection (reflection patterns)

·Insecure design (rate-limit absence on auth endpoints, predictable IDs)

·Security misconfiguration

·Vulnerable / outdated components (via dependency manifest scan)

·Identification + auth failures

·Software + data integrity failures

·Logging + monitoring failures (test that auth events generate logs)

·Server-side request forgery

Confidence scoring

Each finding has a confidence:

·Confirmed — the probe directly observed the vulnerability

·High — the probe observed all prerequisites; exploitation is highly likely

·Medium — the probe observed some prerequisites; manual verification needed

·Low — heuristic match only; treat as a lead, not a finding

→Only Confirmed and High findings are surfaced by default. Medium and Low are available with a flag, for security engineers who want to triage them manually.

What it produces

A structured findings document feedingEvidence Capture andRemediation Generator. Each finding includes the probe name, the exact request, the observed response, the confidence, and a CVSS-style severity.

Related · execution

Locator Healer

locator-healer

When a locator fails in CI, proposes a replacement based on accessibility tree diff and test history. Cuts maintenance churn by ~35%.

Scenario Synthesizer

scenario-synthesizer

Builds ramp-up, soak, spike, and chaos scenarios from a single SLO definition. Wires them to ARIA's reporting pipeline by default.

Observability Hookup

observability-hookup

Auto-correlates load test runs with APM metrics (Datadog, New Relic, Grafana) so saturation signals — pool exhaustion, GC pauses — show up in the report.

Payload Mutator

payload-mutator

Generates targeted attack payloads for injection, deserialization, SSRF, prototype pollution. Backs off on first signal of damage to stay non-destructive.

Evidence Capture

evidence-capture

For every confirmed finding, records the exact request, response, and timing. Output is replayable in seconds for engineering verification.

Adversarial Probes

nora-adversarial-probes

Red-team test suite covering the OWASP LLM Top 10 — prompt injection (direct + indirect), jailbreaks, system-prompt extraction, guardrail bypass, tool-scope escalation, insecure output handling, model DoS. Generates attack variants automatically and scores severity.