<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: application-security
description: >-
  Application security testing and secure development covering source code review,
  authentication and authorization bypass, injection vulnerabilities, session
  management, insecure deserialization, file upload attacks, client-side security,
  SSTI, XXE, business logic flaws, and secure SDLC implementation. Maps to
  OWASP Top 10, OWASP Testing Guide, and OWASP ASVS.
domain: cybersecurity
subdomain: application-security
tags:
  - application-security
  - owasp-top10
  - source-code-review
  - injection
  - authentication
  - authorization
  - session-management
  - deserialization
  - file-upload
  - ssti
  - xxe
  - business-logic
  - sdlc
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1059", "T1055", "T1505", "T1211"]
  owasp-top10: ["A01", "A02", "A03", "A04", "A05", "A06", "A07", "A08", "A09", "A10"]
  frameworks: ["OWASP Top 10 2021", "OWASP Testing Guide v4.2", "OWASP ASVS 4.0"]
---

# Application Security

## When to Use

Activate when the operator asks about web application penetration testing,
source code security review, authentication or authorization bypass, injection
attacks (SQLi, XSS, SSTI, XXE), session management flaws, insecure
deserialization, file upload vulnerabilities, client-side security, business
logic testing, or implementing a secure development lifecycle.

Mode: `[MODE: RED]` for application testing; `[MODE: BLUE]` for hardening; `[MODE: ARCHITECT]` for secure design.

## Prerequisites

- Burp Suite Professional or OWASP ZAP for traffic interception
- Semgrep, CodeQL, or Bandit for static analysis
- Nuclei, sqlmap, and tplmap for automated vulnerability scanning
- Application credentials and scope documentation

## Quick Reference

| Test | Command / Technique | OWASP |
|------|---------------------|-------|
| Source code review | `semgrep --config=auto src/` | A06 |
| Authentication bypass | JWT attacks, credential stuffing, MFA bypass | A07 |
| SQL injection | `sqlmap -u "https://target.com/page?id=1" --batch` | A03 |
| Session fixation | Observe session ID before/after login | A07 |
| Authorization bypass | IDOR, forced browsing, privilege escalation | A01 |
| Insecure deserialization | Gadget chain analysis, ysoserial payloads | A08 |
| File upload attacks | Polyglot files, MIME bypass, path traversal | A04 |
| Client-side testing | DOM XSS, postMessage abuse, storage leaks | A03 |
| SSTI | `{{7*7}}` → `49` in template contexts | A03 |
| XXE | External entity injection in XML parsers | A05 |
| Business logic | Price manipulation, workflow bypass, race conditions | A04 |
| Secure SDLC | Threat modeling, SAST/DAST pipeline integration | A06 |

## Workflow

### 1. Reconnaissance & Mapping

```bash
# Spider the application
katana -u https://target.com -d 5 -jc -o endpoints.txt

# Discover hidden content
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302,403

# Identify technology stack
whatweb https://target.com
wappalyzer https://target.com
```

### 2. Static Analysis (Source Code Review)

```bash
# Semgrep comprehensive scan
semgrep --config=auto --config=p/owasp-top-ten --json src/ | jq '.results[] | {path: .path, line: .start.line, rule: .check_id, severity: .extra.severity}'

# Bandit for Python
bandit -r src/ -f json -ll

# CodeQL analysis
codeql database create codeql-db --language=python
codeql database analyze codeql-db codeql/python-queries --format=sarif-latest
```

### 3. Dynamic Testing

```bash
# OWASP ZAP baseline scan
zap-cli quick-scan -s all -r https://target.com

# Nuclei vulnerability scan
nuclei -u https://target.com -t http/vulnerabilities/ -severity critical,high

# sqlmap injection testing
sqlmap -u "https://target.com/page?id=1" --batch --risk=3 --level=5
```

### 4. Authentication & Authorization Testing

```bash
# Test IDOR on object references
for id in $(seq 1 50); do
  curl -s -H "Authorization: Bearer $TOKEN" \
    "https://target.com/api/users/$id" -o /dev/null -w "%{http_code} "
done

# Test forced browsing to admin paths
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -H "Cookie: session=$USER_SESSION" -mc 200
```

### 5. Injection Testing

```bash
# SSTI detection
tplmap -u "https://target.com/page?name=test"

# XXE detection with nuclei
nuclei -u https://target.com -t http/vulnerabilities/generic-xxe.yaml

# DOM XSS sources/sinks analysis
# Check: location.hash, document.URL, window.name → innerHTML, eval, document.write
```

## Techniques

| # | Technique | Description |
|---|-----------|-------------|
| 1 | performing-source-code-review | SAST with semgrep, CodeQL, Bandit |
| 2 | testing-authentication-vulnerabilities | Auth bypass, credential attacks, MFA flaws |
| 3 | detecting-injection-vulnerabilities | SQLi, XSS, command injection, LDAP injection |
| 4 | testing-session-management-security | Session fixation, hijacking, token entropy |
| 5 | performing-authorization-bypass-testing | IDOR, forced browsing, privilege escalation |
| 6 | detecting-insecure-deserialization | Gadget chains, object injection, RCE via deser |
| 7 | testing-file-upload-vulnerabilities | Unrestricted upload, MIME bypass, webshell |
| 8 | performing-client-side-security-testing | DOM XSS, postMessage, storage, CSP bypass |
| 9 | detecting-server-side-template-injection | SSTI in Jinja2, Twig, Freemarker, Velocity |
| 10 | testing-xml-external-entity-attacks | XXE, SSRF via XML, blind XXE exfiltration |
| 11 | performing-business-logic-testing | Race conditions, price tampering, workflow abuse |
| 12 | implementing-secure-development-lifecycle | Threat modeling, SAST/DAST CI/CD, security gates |

## Verification

- [ ] All OWASP Top 10 categories tested
- [ ] Source code review completed with SAST tooling
- [ ] Authentication and session management validated
- [ ] Authorization tested at every access point
- [ ] Injection vectors tested across all input surfaces
- [ ] Business logic edge cases explored
- [ ] Detection artifacts documented
