Top 100 Web Vulnerabilities Reference
Master Web Vulnerability Assessment with OWASP Reference
Security professionals struggle to keep track of the full spectrum of web application vulnerabilities. This comprehensive reference provides 100 categorized vulnerabilities with clear definitions, root causes, and actionable mitigations.
スキルZIPをダウンロード
Claudeでアップロード
設定 → 機能 → スキル → スキルをアップロードへ移動
オンにして利用開始
テストする
「Top 100 Web Vulnerabilities Reference」を使用しています。 What is Server-Side Request Forgery and how do I test for it?
期待される結果:
SSRF allows attackers to make requests from your server to internal resources. Test by: (1) Identifying URL parameters, (2) Attempting internal IP addresses (127.0.0.1, 169.254.169.254 for cloud metadata), (3) Using out-of-band DNS callbacks to confirm. Mitigate with URL allowlists, egress filtering, and network segmentation.
「Top 100 Web Vulnerabilities Reference」を使用しています。 Give me a checklist for testing authentication vulnerabilities.
期待される結果:
Authentication Testing Checklist: [ ] Session fixation - check session ID regeneration on login, [ ] Brute force - test account lockout and rate limiting, [ ] Credential stuffing - verify breach password detection, [ ] Session hijacking - validate token randomness and HTTPS enforcement, [ ] Remember me tokens - assess predictability and expiration, [ ] CAPTCHA bypass - test automated submission resistance.
セキュリティ監査
安全This skill is purely educational documentation about web security vulnerabilities. All 32 static analysis findings are false positives - the detected patterns appear in markdown code blocks and vulnerability descriptions, not executable code. The file contains no actual security risks and is safe for publication.
品質スコア
作れるもの
Security Assessment Planning
Use the vulnerability reference to build comprehensive testing checklists for web application security assessments, ensuring coverage across all major vulnerability categories.
Developer Security Training
Educate development teams on common vulnerability patterns, their root causes, and secure coding practices to prevent security flaws during development.
Incident Response Analysis
Reference vulnerability definitions and attack vectors when investigating security incidents to understand potential exploitation methods and scope.
これらのプロンプトを試す
Explain the SQL Injection vulnerability including its definition, root cause, typical impact, and recommended mitigations. Provide a simple example of how the attack works.
Compare and contrast XSS, CSRF, and clickjacking attacks. Explain how each works, what makes them different, and what specific defenses protect against each one.
Create a comprehensive vulnerability testing checklist for an API security assessment. Include test cases for authentication flaws, injection vulnerabilities, rate limiting, and data exposure risks.
Map all authentication-related vulnerabilities from the reference to the OWASP Top 10 2021 categories. For each mapping, explain the relationship and identify any gaps in coverage.
ベストプラクティス
- Always verify vulnerability findings manually - automated scanners produce false positives
- Adapt mitigation recommendations to your specific technology stack and architecture
- Use the OWASP mapping to prioritize remediation based on industry-recognized risk rankings
回避
- Applying mitigations without understanding the underlying root cause
- Relying solely on automated scanning without manual verification
- Implementing security controls inconsistently across application endpoints