owasp-top10-2025

Provides OWASP Top 10 2025 risk explanations, mitigations, and payload references for web security work.

Updated Jun 5, 2026

Search Tags:#vulnerability #owasp #threat modeling #penetration testing #web security #payloads #waf bypass

Ready to run

npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill owasp-top10-2025-yogiex

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: owasp-top10-2025
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/owasp-top10-2025
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill owasp-top10-2025-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security professionals and developers need accurate, up-to-date guidance on the OWASP Top 10 2025 categories when performing threat modeling, code review, or penetration testing, without searching through scattered documentation. ## Core Features & Use Cases - Complete Category Reference: Detailed breakdowns of all ten A01–A10:2025 risks with examples, mitigations, and changes from the 2021 list. - Payload Cheatsheet: A references file with vulnerable parameters, HTTP request examples, and bypass techniques for SQLi, XSS, SSRF, XXE, SSTI, and more. - Tooling & Resource Matrices: SAST/DAST/SCA tool mappings per category, real-world CVE examples, cloud-specific guidance, training, and certification resources. - Use Case: During a penetration test, ask for SSRF testing guidance and receive the A01:2025 context plus concrete payload examples and filter bypass techniques from the cheatsheet. ## Quick Start Ask the agent to explain the OWASP A03:2025 Software Supply Chain Failures category and list practical mitigations for your CI/CD pipeline.

Frequently Asked Questions about owasp-top10-2025

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What changed in OWASP Top 10 2025 compared to 2021?▼

The 2025 list adds Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10) as new categories. Security Misconfiguration rose from #5 to #2, and SSRF moved under Broken Access Control (A01).

How do I test for SQL injection and XSS vulnerabilities?▼

The payloads cheatsheet lists vulnerable parameters, HTTP request examples, and filter bypass techniques for SQLi and XSS. It covers inline comment bypasses, CHAR() encoding, alternative HTML event handlers, and WAF polymorphism methods.

Which tools detect each OWASP Top 10 category?▼

The skill includes a SAST/DAST/SCA effectiveness matrix per category. For example, injection flaws are well covered by Semgrep, sqlmap, and Burp Suite, while supply chain failures require SCA tools like Snyk or OWASP Dependency-Check.

Does this skill cover SSRF testing techniques?▼

Yes, SSRF is covered under A01:2025 Broken Access Control. The cheatsheet includes localhost filter bypasses using decimal and octal IP formats, cloud metadata endpoints for AWS and GCP, and non-HTTP protocol schemes like gopher and dict.

What are common WAF bypass techniques for web attacks?▼

The reference documents platform-specific bypasses for Cloudflare, ModSecurity, AWS WAF, and Akamai, plus encoding methods like Unicode normalization, HTTP parameter pollution, and request smuggling. Each technique includes blue team mitigation guidance.

When should I not rely on automated scanners for OWASP risks?▼

Automated tools are weak for A06 Insecure Design, which requires threat modeling methods like STRIDE or LINDDUN instead. Logging failures and integrity failures also need manual review of SIEM configuration and deserialization controls.