skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-web-application-vulnerability-triage

Triage DAST and SAST findings using OWASP risk rating to prioritize remediation.

1|1|Updated Apr 3, 2026
Search Tags:#owasp#sast#web security#risk rating#dast#false positive#vulnerability triage
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill performing-web-application-vulnerability-triage-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-web-application-vulnerability-triage
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/reporting/performing-web-application-vulnerability-triage
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill performing-web-application-vulnerability-triage-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, beautifulsoup4.

What problem does it solve? Security teams are overwhelmed by scanner output from DAST and SAST tools, where false positives and unprioritized findings cause alert fatigue and let real vulnerabilities slip through. This Skill provides a structured triage process that validates findings, applies the OWASP Risk Rating Methodology, and produces prioritized remediation guidance. ## Core Features & Use Cases - OWASP Risk Rating: Calculates likelihood and impact scores across 16 factors and maps results to Critical/High/Medium/Low/Note severity levels. - False Positive Filtering: Classifies findings as true positive, false positive, or needs review using scanner confidence, evidence, and CWE-based heuristics. - OWASP Top 10 Categorization: Maps CWE identifiers to OWASP Top 10 2021 categories for consistent reporting. - Use Case: After an OWASP ZAP scan of a customer-facing application, run the triage pipeline to separate genuine SQL injection findings from informational header warnings, score each by business context (PCI scope, PII handling), and generate a prioritized triage report for the development team. ## Quick Start Triage the findings in zap_results.json using the app context in app_config.json and produce a prioritized triage report.

Frequently Asked Questions about performing-web-application-vulnerability-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage DAST and SAST scan results?▼

Triage DAST and SAST results by first categorizing findings via CWE-to-OWASP Top 10 mapping, then classifying each as true positive, false positive, or needs review based on scanner confidence and evidence. Finally, calculate an OWASP risk score using likelihood and impact factors to prioritize remediation.

How does the OWASP Risk Rating Methodology calculate severity?▼

The OWASP Risk Rating Methodology computes Risk as Likelihood multiplied by Impact, each scored 0-9 across eight factors. Likelihood covers threat agent and vulnerability factors; impact covers technical and business factors. The product maps to Critical, High, Medium, Low, or Note levels.

What tools work with web vulnerability triage workflows?▼

This triage process consumes results from DAST tools like OWASP ZAP, Burp Suite, and Acunetix, plus SAST tools like Semgrep, SonarQube, Checkmarx, and Snyk Code. DefectDojo or a similar platform is recommended for finding management.

How do I tell if a scanner finding is a false positive?▼

A finding is likely a false positive when it matches common informational patterns, such as missing CSP or X-Content-Type-Options headers, at info or low severity. Findings with confirmed exploitation evidence and certain confidence are true positives; SAST injection findings need manual code review.

Why do SAST injection findings require manual validation?▼

SAST tools flag potential injection sinks like CWE-89, CWE-78, and CWE-79 without runtime context, so they cannot confirm exploitability. Manual code review verifies whether untrusted input actually reaches the sink without sanitization before marking the finding a true positive.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

performing-web-application-vulnerability-triage

Triage DAST and SAST scan findings using OWASP risk rating to prioritize remediation.

Community
Intermediate
irvinesundayirvinesunday

triage

Classify audit findings into prioritized work queues with deduplication.

Community
Advanced
bingookbingook

WAF BYPASS MASTERY

Automate WAF bypass and penetration testing with SQL injection, XSS, and SSRF techniques.

Community
Advanced
starwreckntxstarwreckntx

Vulnerability Management Agent

Track vulnerabilities across assets using CVE/CVSS standards and CVSS scoring.

Community
Basic