Intake & Assumption Parser

139 TEMPLATES READY

Browse the 139 static template library (Categories A-O) or use the Claude AI Parser (`assumption_parser.py`) to convert plain-English security claims into structured test cases.

Claude AI Assumption Parser (`assumption_parser.py`)1 Credit / Prompt

State your organizational security assumption in plain English. The AI engine will parse it into a executable test case with structured conditions and router mappings.

139 Security Assumption Catalog

CAT ACAP_HTTP

Strict Transport Security (HSTS) Enforced

Verify that HTTP requests receive Strict-Transport-Security header with max-age >= 31536000 and includeSubDomains.

Pass: HSTS header present with max-age >= 31536000

Fail: HSTS header missing or max-age < 31536000

Route: run_headers (0.5 cr)

CAT ACAP_HTTP

Content Security Policy (CSP) Restrictions

Verify CSP does not contain 'unsafe-inline' or wildcard '*' in script-src directives.

Pass: CSP header present without unsafe script directives

Fail: CSP missing or contains unsafe-inline in script-src

Route: run_headers (0.5 cr)

CAT BCAP_HTTP

Parameterized Query Immunity on Authentication API

Verify SQL injection payloads in auth request bodies return 400/401 without SQL syntax errors or delay.

Pass: Clean rejection (HTTP 400/401/422) with sanitized response

Fail: Database syntax error, status 500, or time-based delay > 5s

Route: run_sqli (0.5 cr)

CAT CCAP_HTTP

Reflected XSS Sanitization on Search & Parameters

Verify GET parameters automatically HTML-entity encode HTML tags in response bodies.

Pass: Input correctly encoded or stripped from HTML output

Fail: Raw <script> tags or executable JS reflected in response

Route: run_xss (0.5 cr)

CAT DCAP_HTTP

Cloud Metadata (169.254.169.254) Reachability Guard

Verify webhook and fetch parameters reject internal IP ranges and cloud metadata endpoints.

Pass: HTTP 400 Bad Request on internal IP requests

Fail: HTTP 200 containing IAM metadata or internal server response

Route: run_ssrf (0.5 cr)

CAT ECAP_HTTP

.env & .git Directory Protection

Verify requests to /.env, /.git/config, and /backup.sql are blocked at web server layer.

Pass: HTTP 403 Forbidden or 404 Not Found without file content

Fail: HTTP 200 OK returning environment variables or source code

Route: run_exposure (0.5 cr)

CAT FCAP_HTTP

GraphQL Production Introspection Disabled

Verify introspection query `{ __schema { types { name } } }` is disabled in production.

Pass: GraphQL introspection query rejected or disabled

Fail: Full schema returned via GraphQL introspection

Route: run_graphql (0.5 cr)

CAT GCAP_HTTP

JWT 'alg: none' Confusion Guard

Verify JWT authentication endpoints reject tokens with algorithm modified to 'none' or asymmetric key swaps.

Pass: HTTP 401 Unauthorized returned for unsigned tokens

Fail: HTTP 200 OK granting access with unsigned JWT

Route: run_auth (0.5 cr)

CAT HCAP_HTTP

Login Endpoint Lockout Enforcement

Verify after 5 consecutive failed login attempts HTTP 429 Too Many Requests is triggered.

Pass: HTTP 429 returned after threshold reached

Fail: Unlimited login attempts allowed without rate restriction

Route: run_rate_limit (0.5 cr)

CAT ICAP_NETWORK

Dangerous Infrastructure Port Isolation

Verify ports 21 (FTP), 22 (SSH), 3389 (RDP), 6379 (Redis), and 27017 (MongoDB) are not publicly exposed.

Pass: All target database/mgmt ports filtered or closed

Fail: Unprotected open socket detected on public IP

Route: run_network (0.5 cr)

CAT JCAP_NETWORK

Public S3 Bucket Bucket-ACL Restrictions

Verify associated storage buckets reject unauthenticated list and read operations.

Pass: AccessDenied status on anonymous list requests

Fail: Public directory listing or object access enabled

Route: run_cloud (0.5 cr)

CAT KCAP_STATE_CHANGING

File Extension & MIME Type Polyglot Bypass Guard

Verify uploaded files undergo extension validation, SVG script stripping, and execution blocking.

Pass: Executable extensions rejected or sanitized without script execution

Fail: Uploaded php/html file executed directly on server

Route: run_file_upload (0.5 cr)

CAT LCAP_STATE_CHANGING

Webhook HMAC-SHA256 Signature Verification

Verify webhook receivers reject payload requests missing valid HMAC-SHA256 signature headers.

Pass: HTTP 401/403 for unverified webhook payloads

Fail: Unsigned webhook executed successfully

Route: run_webhook (0.5 cr)

CAT MCAP_STATE_CHANGING

Payment Amount Tampering & Negative Balance Prevention

Verify checkout parameters reject negative numbers, floating point manipulation, and currency overrides.

Pass: Server-side price verification rejects altered unit prices

Fail: Transaction completes with modified amount or negative price

Route: run_payment_access (0.5 cr)

CAT NCAP_HTTP

DMARC Policy Enforcement

Verify DNS TXT record for _dmarc has p=reject or p=quarantine policy.

Pass: Valid DMARC record found with strict policy

Fail: No DMARC record or p=none policy set

Route: run_email (0.5 cr)

CAT OCAP_HTTP

Vertical Escalation Prevention on /admin Routes

Verify standard non-admin session tokens receive HTTP 403 when requesting administrative control routes.

Pass: HTTP 403 Forbidden for non-admin user tokens

Fail: Admin panel or endpoint data accessible to low-privilege user

Route: run_admin_access (0.5 cr)