/dast-zap

name: dast-zap
description: >
  Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning,
  API testing, and OWASP Top 10 vulnerability detection. Use when: (1) Performing runtime security testing of web
  applications and APIs, (2) Detecting vulnerabilities like XSS, SQL injection, and authentication flaws in deployed
  applications, (3) Automating security scans in CI/CD pipelines with Docker containers, (4) Conducting authenticated
  testing with session management, (5) Generating security reports with OWASP and CWE mappings for compliance.
version: 0.1.0
maintainer: SirAppSec
category: appsec
tags: [dast, zap, web-security, owasp, vulnerability-scanning, api-testing, penetration-testing]
frameworks: [OWASP, CWE]
dependencies:
  tools: [docker]
  optional: [python3, java]
references:
  - https://www.zaproxy.org/docs/
  - https://www.zaproxy.org/docs/docker/
  - https://www.zaproxy.org/docs/desktop/start/features/

DAST with OWASP ZAP

Overview

OWASP ZAP (Zed Attack Proxy) is an open-source DAST tool that acts as a manipulator-in-the-middle proxy to intercept, inspect, and test web application traffic for security vulnerabilities. ZAP provides automated passive and active scanning, API testing capabilities, and seamless CI/CD integration for runtime security testing.

Quick Start

Baseline Scan (Docker)

Run a quick passive security scan:

docker run -t zaproxy/zap-stable zap-baseline.py -t https://target-app.com -r baseline-report.html

Full Active Scan (Docker)

Perform comprehensive active vulnerability testing:

docker run -t zaproxy/zap-stable zap-full-scan.py -t https://target-app.com -r full-scan-report.html

API Scan with OpenAPI Spec

Test APIs using OpenAPI/Swagger specification:

docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-api-scan.py \
  -t https://api.target.com \
  -f openapi \
  -d /zap/wrk/openapi-spec.yaml \
  -r /zap/wrk/api-report.html

Core Workflow

Step 1: Define Scan Scope and Target

Identify the target application URL and define scope:

# Set target URL
TARGET_URL="https://target-app.com"

# For authenticated scans, prepare authentication context
# See references/authentication_guide.md for detailed setup

**Scope Considerations:**

• Exclude third-party domains and CDN URLs
• Include all application subdomains and API endpoints
• Respect scope limitations in penetration testing engagements

Step 2: Run Passive Scanning

Execute passive scanning to analyze traffic without active attacks:

# Baseline scan performs spidering + passive scanning
docker run -t zaproxy/zap-stable zap-baseline.py \
  -t $TARGET_URL \
  -r baseline-report.html \
  -J baseline-report.json

**What Passive Scanning Detects:**

• Missing security headers (CSP, HSTS, X-Frame-Options)
• Information disclosure in responses
• Cookie security issues (HttpOnly, Secure flags)
• Basic authentication weaknesses
• Application fingerprinting data

Step 3: Execute Active Scanning

Perform active vulnerability testing (requires authorization):

# Full scan includes spidering + passive + active scanning
docker run -t zaproxy/zap-stable zap-full-scan.py \
  -t $TARGET_URL \
  -r full-scan-report.html \
  -J full-scan-report.json \
  -z "-config api.addrs.addr.name=.* -config api.addrs.addr.regex=true"

**Active Scanning Coverage:**

• SQL Injection (SQLi)
• Cross-Site Scripting (XSS)
• Path Traversal
• Command Injection
• XML External Entity (XXE)
• Server-Side Request Forgery (SSRF)
• Security Misconfigurations

**WARNING:** Active scanning performs real attacks. Only run against applications you have explicit authorization to test.

Step 4: Test APIs with Specifications

Scan REST, GraphQL, and SOAP APIs:

# OpenAPI/Swagger API scan
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-api-scan.py \
  -t https://api.target.com \
  -f openapi \
  -d /zap/wrk/openapi.yaml \
  -r /zap/wrk/api-report.html

# GraphQL API scan
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-api-scan.py \
  -t https://api.target.com/graphql \
  -f graphql \
  -d /zap/wrk/schema.graphql \
  -r /zap/wrk/graphql-report.html

Consult `references/api_testing_guide.md` for advanced API testing patterns including authentication and rate limiting.

Step 5: Handle Authentication

For testing authenticated application areas:

# Use bundled script for authentication setup
python3 scripts/zap_auth_scanner.py \
  --target $TARGET_URL \
  --auth-type form \
  --login-url https://target-app.com/login \
  --username testuser \
  --password-env ZAP_AUTH_PASSWORD \
  --output auth-scan-report.html

Authentication methods supported:

• Form-based authentication
• HTTP Basic/Digest authentication
• OAuth 2.0 flows
• API key/token authentication
• Script-based custom authentication

See `references/authentication_guide.md` for detailed authentication configuration.

Step 6: Analyze Results and Generate Reports

Review findings by risk level:

# Generate multiple report formats
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-full-scan.py \
  -t $TARGET_URL \
  -r /zap/wrk/report.html \
  -J /zap/wrk/report.json \
  -x /zap/wrk/report.xml

**Risk Levels:**

• **High**: Critical vulnerabilities requiring immediate remediation (SQLi, RCE, authentication bypass)
• **Medium**: Significant security weaknesses (XSS, CSRF, sensitive data exposure)
• **Low**: Security concerns with lower exploitability (information disclosure, minor misconfigurations)
• **Informational**: Security best practices and observations

Map findings to OWASP Top 10 using `references/owasp_mapping.md`.

Automation & CI/CD Integration

GitHub Actions Integration

Add ZAP scanning to GitHub workflows:

# .github/workflows/zap-scan.yml
name: ZAP Security Scan
on: [push, pull_request]

jobs:
  zap_scan:
    runs-on