# Owasp Top 10 Testing > Prueba una aplicación contra el OWASP Top 10:2025 con Strix: agentes de IA que intentan exploits reales y reportan solo lo probado, con PoC. Fuente: https://skillsagentes.com/skills/usestrix/strix/owasp-top-10-testing Markdown: https://skillsagentes.com/skills/usestrix/strix/owasp-top-10-testing.md Repositorio: https://github.com/usestrix/strix Autor: usestrix Licencia: Apache-2.0 Actualizado: hace 5 días Coste de contexto: 176 tok instalada, 1.5k tok al activarse, 1.5k tok con todos los archivos del bundle Bundle: 1 archivo, 6 KB Permisos que pide: ninguno declarado ## Instalación Un skill son archivos markdown: los mismos archivos valen para cualquier agente y lo único que cambia es el directorio de destino, es decir la bandera `--agent`. Añade `-g` para instalarlo en todos los proyectos de la máquina. ```bash # Claude Code npx -y skills add usestrix/strix --skill owasp-top-10-testing --agent claude-code # Cursor npx -y skills add usestrix/strix --skill owasp-top-10-testing --agent cursor # Codex npx -y skills add usestrix/strix --skill owasp-top-10-testing --agent codex # Gemini CLI npx -y skills add usestrix/strix --skill owasp-top-10-testing --agent gemini # Windsurf npx -y skills add usestrix/strix --skill owasp-top-10-testing --agent windsurf # Cline npx -y skills add usestrix/strix --skill owasp-top-10-testing --agent cline ``` ## Qué hace - Ejecuta pruebas categoría por categoría del OWASP Top 10:2025 (acceso, configuración, cadena de suministro, criptografía, inyección, etc.) - Reporta honestamente qué categorías son testeables por un agente ('Strong', 'Partial' o 'Not testable from outside') en vez de afirmar cobertura total - Usa `--scan-mode deep` con dos cuentas de distinto privilegio para probar control de acceso entre usuarios - Cubre también el OWASP API Security Top 10 (2023) ## Cuándo usarla - El usuario pide una evaluación OWASP Top 10, pruebas de cumplimiento OWASP, o una revisión mapeada a categorías OWASP ## Qué la activa - "Haz una evaluación completa del OWASP Top 10 sobre esta app" - "Prueba el control de acceso entre usuarios según OWASP A01" ## Antes de instalar - Para máxima cobertura se necesitan código fuente y una instancia en ejecución, más credenciales de al menos dos niveles de privilegio. - makes network requests ## Archivos - SKILL.md — 6 KB ## SKILL.md Reproducido tal cual desde usestrix/strix bajo Apache-2.0. Esta sección es el documento original y está en inglés. # Test against the OWASP Top 10 The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP Top 10 testing" means exercising each category against the real application and reporting what's actually exploitable. Strix's agents do the exploitation; this skill covers running it category-by-category and reporting coverage honestly. **Use the current edition: [OWASP Top 10:2025](https://owasp.org/Top10/)** (8th installment, superseding 2021). Ask the user before targeting an older edition — some compliance checklists still reference 2021, and a report labelled with the wrong edition is misleading. Key differences from 2021: **SSRF is folded into A01**, **A03 Software Supply Chain Failures** expands the old "Vulnerable and Outdated Components", and **A10 Mishandling of Exceptional Conditions** is new; A02 Security Misconfiguration moved 5→2. Install, LLM setup, and the managed-cloud alternative: **penetration-testing-with-strix**. ## What is and is not testable by an agent Be straight with the user about this — claiming a clean sweep of all ten is misleading. | Category (2025) | Coverage | |---|---| | A01 Broken Access Control (incl. SSRF) | **Strong** — cross-user/tenant access, privilege escalation, IDOR, and SSRF (including blind, via out-of-band callbacks) are all exploit-validated. Needs two accounts plus a privileged one to prove the authorization half. | | A02 Security Misconfiguration | **Strong** — debug endpoints, verbose errors, permissive CORS, missing hardening, default credentials, exposed admin surfaces. | | A03 Software Supply Chain Failures | **Partial** — version fingerprinting, and vulnerable/outdated dependency review when source is supplied. Build-system and distribution-infrastructure compromise (the broader half of this category) is out of scope for a runtime scan — pair with SCA plus build-provenance controls. | | A04 Cryptographic Failures | **Partial** — transport config, unencrypted data in transit, secrets and tokens leaked in responses. At-rest crypto and key management need source or infra review. | | A05 Injection | **Strong** — SQL/NoSQL/command/template injection and XSS, exploit-validated. | | A06 Insecure Design | **Partial** — business-logic abuse (price/quantity tampering, workflow skipping, race conditions) is found where reachable; design intent still needs human review and threat modelling. | | A07 Authentication Failures | **Strong** — auth bypass, weak session/token handling, password-reset and MFA flaws. | | A08 Software or Data Integrity Failures | **Partial** — insecure deserialization and unsigned-update paths where reachable; CI/CD trust boundaries are not runtime-testable. | | A09 Security Logging & Alerting Failures | **Not testable from outside** — requires reviewing the logging and alerting pipeline. State this rather than reporting it as passed. | | A10 Mishandling of Exceptional Conditions | **Partial** — agents actively probe error handling and fail-open behavior (malformed input, forced errors, race and timeout conditions) and report what leaks or bypasses a control; exhaustive coverage of internal error paths needs source review. | For APIs, run the same exercise against the **OWASP API Security Top 10 (2023)** — API1 BOLA, API3 Broken Object Property Level Authorization (2019's excessive data exposure + mass assignment merged), API5 broken function-level authorization — using the **api-security-testing** skill. ## Run it Maximum category coverage comes from giving the agents both the source and a running instance, plus credentials at two privilege levels: ```bash strix -n \ -t https://github.com/org/app \ -t https://staging.example.com \ --scan-mode deep --max-budget 30 \ --instruction "OWASP Top 10:2025 assessment. Cover every category systematically and map each finding to its 2025 category id. Accounts: userA@example.com/ (org 1), userB@example.com/ (org 2), admin@example.com/. Prioritise A01 (cross-org access, privilege escalation, SSRF), A02, A05, A07, A10. Out of scope: /billing/*, outbound email." ``` - `--scan-mode deep` matters here: systematically walking ten categories is not a quick scan. - Without a second account, A01 results are structurally incomplete — say so in the report rather than leaving it implied. - Need an auditor-facing PDF? Run it through the managed platform and pull the technical report (**managed-pentesting-with-strix**). ## Report honestly From `strix_runs//`, group `vulnerabilities/*.md` by category and state, per category: what was attempted, what was proven, and what could not be assessed (A09 always; A03/A04/A06/A08/A10 partially). Label the report with the edition used. Verify each PoC yourself before it goes in front of the user. A `0` exit code means nothing exploitable was proven **in what was analyzed** — check `run.json` status and cost against `--max-budget`; a budget-capped run is not a completed assessment. ## Then fix and re-test Remediate with **fix-security-vulnerabilities-with-strix** and re-run to prove each exploit is closed. For ongoing coverage as the app changes, gate pull requests using **ci-security-scanning-with-strix**. ## Dónde encaja - Categoría: [Seguridad](https://skillsagentes.com/categorias/seguridad.md) — Auditorías, revisión de dependencias, manejo de secretos y modelado de amenazas. - Creador: [usestrix](https://skillsagentes.com/creators/usestrix.md) — 9 skills en el directorio - [Todas las skills](https://skillsagentes.com/skills.md) - [Ranking de instalaciones](https://skillsagentes.com/ranking.md) ## Otras skills del mismo repositorio - [Api Security Testing](https://skillsagentes.com/skills/usestrix/strix/api-security-testing.md): Pon a prueba una API REST, GraphQL o gRPC con Strix: agentes autónomos enumeran endpoints y explotan el OWASP API Security Top 10 (2023) con una PoC funcional por cada hallazgo. - [Penetration Testing With Strix](https://skillsagentes.com/skills/usestrix/strix/penetration-testing-with-strix.md): Pentestea una app web, API, código, repo, URL, dominio o IP con Strix: agentes autónomos que explotan y demuestran vulnerabilidades con PoC, por CLI autoalojada o nube gestionada app.strix.ai. - [Managed Pentesting With Strix](https://skillsagentes.com/skills/usestrix/strix/managed-pentesting-with-strix.md): Ejecuta un pentest gestionado de una app web o API vía la API REST de app.strix.ai, sin Docker local, clave LLM ni instalación. - [Web App Penetration Testing](https://skillsagentes.com/skills/usestrix/strix/web-app-penetration-testing.md): Pentestea una app web o sitio de extremo a extremo: testeo de caja negra que encuentra y explota vulnerabilidades reales (auth bypass, IDOR, inyección, XSS, SSRF, lógica de negocio) con Strix. - [Fix Security Vulnerabilities With Strix](https://skillsagentes.com/skills/usestrix/strix/fix-security-vulnerabilities-with-strix.md): Corrige vulnerabilidades encontradas por un pentest de Strix: clasifica por severidad, parchea la causa raíz y vuelve a escanear para probar el fix. --- Skills Agentes · [Índice de páginas en markdown](https://skillsagentes.com/sitemap.md) · [Inicio](https://skillsagentes.com/index.md)