melikhanmutlu/vulnerability-scanner

Vulnerability Scanner

"Security is not a product, but a process." -- Bruce Schneier

When to Use

• Scanning code for security vulnerabilities (SAST)
• Running dynamic application security testing (DAST)
• Auditing dependencies for known vulnerabilities (SCA)
• Tracking and prioritizing CVEs affecting your software
• Implementing automated security checks in CI/CD pipelines
• Developing remediation plans for discovered vulnerabilities
• Performing compliance checks (SOC 2, PCI DSS, HIPAA)

Vulnerability Scanning Categories

SAST (Static Application Security Testing)

Analyzes source code without executing it. Catches vulnerabilities early in development.

Tools:

• Semgrep: Rule-based, fast, supports 30+ languages, community rules
• SonarQube/SonarCloud: Comprehensive code quality and security analysis
• CodeQL (GitHub): Deep semantic code analysis, built into GitHub Advanced Security
• Bandit: Python-specific security linter
• Brakeman: Ruby on Rails security scanner
• ESLint security plugins: eslint-plugin-security, eslint-plugin-no-unsanitized

What SAST catches:

• SQL injection patterns
• Cross-site scripting (XSS) sinks
• Hardcoded secrets and credentials
• Insecure cryptographic usage
• Path traversal vulnerabilities
• Command injection
• Deserialization flaws

DAST (Dynamic Application Security Testing)

Tests a running application by sending crafted requests. Finds runtime vulnerabilities.

Tools:

• OWASP ZAP: Open-source, full-featured web app scanner
• Burp Suite: Professional-grade web security testing
• Nuclei: Template-based vulnerability scanner, fast and extensible
• Nikto: Web server scanner for misconfigurations
• DAST in CI: Use ZAP baseline scan or Nuclei in pipelines

What DAST catches:

• Authentication and session management flaws
• Server misconfigurations
• Missing security headers
• CORS misconfigurations
• Exposed sensitive endpoints
• Runtime injection vulnerabilities

SCA (Software Composition Analysis)

Scans dependencies for known vulnerabilities and license compliance.

Tools:

• npm audit / pnpm audit: Built-in Node.js dependency scanning
• pip-audit: Python dependency vulnerability scanner
• Trivy: Container and filesystem vulnerability scanner
• Snyk: Commercial SCA with fix suggestions and PR automation
• Dependabot (GitHub): Automated dependency update PRs
• OSV-Scanner (Google): Open-source vulnerability database scanner
• Safety: Python dependency checker against safety-db

Dependency Auditing

Node.js / npm Ecosystem

# Basic audit
npm audit

# Only production dependencies
npm audit --omit=dev

# Auto-fix compatible updates
npm audit fix

# Generate JSON for CI processing
npm audit --json

Python Ecosystem

# Using pip-audit
pip-audit --requirement requirements.txt

# Using safety
safety check --file requirements.txt

# With output format for CI
pip-audit --format json --output audit-results.json

Container Scanning

# Scan a Docker image with Trivy
trivy image myapp:latest

# Scan filesystem (works without Docker)
trivy fs --scanners vuln,secret,misconfig .

# Scan with severity filter
trivy image --severity HIGH,CRITICAL myapp:latest

Key Auditing Practices

• Run dependency audits in CI on every PR
• Set severity thresholds: fail builds on HIGH and CRITICAL
• Distinguish between production and development dependency vulnerabilities
• Use lock files (package-lock.json, poetry.lock) for reproducible audits
• Update dependencies regularly; don't let them rot for months
• Pin major versions but allow patch updates for security fixes

CVE Tracking and Prioritization

Understanding CVE Severity

• CVSS Score 9.0-10.0 (Critical): Remote code execution, authentication bypass -- fix immediately
• CVSS Score 7.0-8.9 (High): Significant impact -- fix within days
• CVSS Score 4.0-6.9 (Medium): Moderate impact -- fix within weeks
• CVSS Score 0.1-3.9 (Low): Minimal impact -- fix in next maintenance cycle

Prioritization Beyond CVSS

CVSS alone is insufficient. Consider:

• Exploitability: Is there a public exploit? (Check Exploit-DB, CISA KEV catalog)
• Reachability: Is the vulnerable code path actually used in your application?
• Environment: Is the vulnerability relevant to your deployment (e.g., Linux-only CVE on a Linux server)?
• Compensating controls: Do you have WAF rules, network segmentation, or other mitigations?
• Data sensitivity: What data could be exposed if exploited?

CVE Resources

• NVD (National Vulnerability Database): Comprehensive CVE details and CVSS scores
• CISA KEV: Known Exploited Vulnerabilities catalog (actively exploited in the wild)
• GitHub Advisory Database: Security advisories for open-source packages
• OSV.dev: Open Source Vulnerability database by Google
• VulnDB: Commercial vulnerability intelligence

CI/CD Security Integration

Pipeline Security Gates

# Example GitHub Actions security pipeline
security-scan:
  steps:
    - name: SAST with Semgrep
      uses: returntocorp/semgrep-action@v1
      with:
        config: p/default p/owasp-top-ten
    - name: Dependency audit
      run: npm audit --audit-level=high
    - name: Secret scanning
      uses: trufflesecurity/trufflehog@main
    - name: Container scan
      run: trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE

Secret Scanning

Prevent credentials from being committed:

• TruffleHog: Scans git history for secrets (high-entropy strings, known patterns)
• GitLeaks: Fast secret scanner for git repos
• GitHub Secret Scanning: Built-in for GitHub repos (public and private with GHAS)
• Pre-commit hooks: Run secret detection before code is committed

Security Headers Check

Verify your application sets proper security headers:

• Content-Security-Policy -- Prevent XSS and data injection
• Strict-Transport-Security -- Force HTTPS
• X-Content-Type-Options: nosniff -- Prevent MIME sniffing
• X-Frame-Options or CSP frame-ancestors -- Prevent clickjacking
• Referrer-Policy -- Control referrer information leakage
• Permissions-Policy -- Control browser feature access

Remediation Strategies

Triage Workflow

1. Discover: Automated scans find vulnerabilities
2. Assess: Determine severity, exploitability, and reachability
3. Prioritize: Rank by risk (Critical + Exploitable + Reachable = fix now)
4. Remediate: Update dependency, patch code, apply workaround
5. Verify: Rescan to confirm the fix
6. Document: Record the vulnerability, decision, and resolution

Common Remediation Actions

• Dependency update: Upgrade to a patched version
• Patch application: Apply a vendor-supplied patch
• Code fix: Rewrite vulnerable code pattern
• Workaround: WAF rule, input validation, or configuration change
• Accept risk: Document why the vulnerability is acceptable (low impact, not reachable)
• Remove dependency: Replace with a more secure alternative

When You Cannot Update

• Fork the dependency and apply the security patch
• Use overrides (npm) or resolutions (yarn) to force a transitive dependency version
• Add compensating controls (input validation, WAF rules)
• Isolate the vulnerable component (sandboxing, network segmentation)
• Plan migration to an alternative library

Compliance Mapping

• OWASP Top 10: Map findings to OWASP categories for developer understanding
• CWE: Reference Common Weakness Enumeration for precise vulnerability classification
• PCI DSS: Requirement 6 (Secure Systems), Requirement 11 (Regular Testing)
• SOC 2: Trust Service Criteria CC7 (System Operations), CC8 (Change Management)
• HIPAA: Technical safeguards for ePHI (access controls, audit controls, integrity)