Identify Top 100 Web Vulnerabilities

This skill is a structured reference cataloging 100 web application vulnerabilities across 15 categories, each entry giving a definition, root cause, impact, and mitigation. Categories span injection (SQL, XSS, command, XML/LDAP/XPath, SSTI), authentication and session security (session fixation/hijacking, brute force, credential stuffing, insecure "remember me," CAPTCHA bypass), sensitive data exposure (IDOR, data leakage, unencrypted storage, information disclosure), security misconfiguration (missing security headers, default passwords, directory listing, unprotected APIs, misconfigured CORS, unpatched software), XML-specific issues (XXE, XML entity expansion, Billion Laughs, XML DoS), broken access control (privilege escalation, forceful browsing, missing function-level access control), insecure deserialization, API security (key exposure, rate limiting, input validation, API abuse), communication security (MITM, weak TLS, insecure protocols), client-side vulnerabilities (DOM XSS, clickjacking, cache poisoning, HTML5 API issues), denial of service (DDoS, Slowloris, resource exhaustion), SSRF (including blind and time-based blind variants), plus dedicated coverage of mobile/IoT vulnerabilities and advanced/zero-day threats (race conditions, account enumeration, CSP bypass).

It closes with quick-reference tooling: a category-to-vulnerability-number summary table with key controls per category, a ready-to-use block of critical security headers (CSP, X-Content-Type-Options, X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy), and an explicit mapping from each vulnerability group to its corresponding OWASP Top 10 2021 category (A01-A10). A troubleshooting section covers common assessment challenges (false positives, missed business-logic flaws, WAF interference) and verification techniques per vulnerability type (payload testing, out-of-band SSRF callbacks, privilege-escalation testing).

Use this skill for systematic vulnerability identification, impact assessment, and remediation planning during authorized security testing, building vulnerability assessment checklists, or writing security policies - it assumes familiarity with web architecture, common technologies, and authentication/authorization concepts, plus access to testing tools like Burp Suite or OWASP ZAP.

It is explicitly a reference, not an automated scanner substitute - the source notes automated scanners miss certain vulnerability types (especially business logic flaws), mitigations must be adapted to the actual technology stack, and the catalog itself needs updating as new vulnerabilities emerge. This is defensive/authorized security-testing reference material, not an exploitation toolkit.

Input is a web application (or a specific vulnerability class) to assess. Output is a definition, root cause, impact statement, and concrete mitigation per vulnerability, plus the cross-references needed to map findings to OWASP Top 10 categories and to select the right verification technique for confirming a suspected issue.

Content-Security-Policy: default-src 'self'; script-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Built on and cross-referenced against OWASP Top 10 (2021), CWE/SANS Top 25, the OWASP Testing Guide, OWASP ASVS, and NIST's Cybersecurity Framework; sourced from Kumar MS's "Top 100 Web Vulnerabilities" compilation. Pairs naturally with testing tools like Burp Suite and OWASP ZAP.

Security testers, AppSec engineers, and developers doing authorized vulnerability assessment or building security policy/checklists who need a comprehensive, OWASP-mapped reference rather than having to derive root-cause/mitigation pairs from scratch for each finding.