dast-zap

name	dast-zap
description	Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection. Use when: (1) Performing runtime security testing of web applications and APIs, (2) Detecting vulnerabilities like XSS, SQL injection, and authentication flaws in deployed applications, (3) Automating security scans in CI/CD pipelines with Docker containers, (4) Conducting authenticated testing with session management, (5) Generating security reports with OWASP and CWE mappings for compliance.
version	0.1.0
maintainer	SirAppSec
category	appsec
tags	["dast","zap","web-security","owasp","vulnerability-scanning","api-testing","penetration-testing"]
frameworks	["OWASP","CWE"]
dependencies	{"tools":["docker"],"optional":["python3","java"]}
references	["https://www.zaproxy.org/docs/","https://www.zaproxy.org/docs/docker/","https://www.zaproxy.org/docs/desktop/start/features/"]

DAST with OWASP ZAP

Overview

OWASP ZAP (Zed Attack Proxy) is an open-source DAST tool that acts as a manipulator-in-the-middle proxy to intercept, inspect, and test web application traffic for security vulnerabilities. ZAP provides automated passive and active scanning, API testing capabilities, and seamless CI/CD integration for runtime security testing.

Quick Start

Baseline Scan (Docker)

Run a quick passive security scan:

docker run -t zaproxy/zap-stable zap-baseline.py -t https://target-app.com -r baseline-report.html

Full Active Scan (Docker)

Perform comprehensive active vulnerability testing:

docker run -t zaproxy/zap-stable zap-full-scan.py -t https://target-app.com -r full-scan-report.html

API Scan with OpenAPI Spec

Test APIs using OpenAPI/Swagger specification:

docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-api-scan.py \
  -t https://api.target.com \
  -f openapi \
  -d /zap/wrk/openapi-spec.yaml \
  -r /zap/wrk/api-report.html

Core Workflow

Step 1: Define Scan Scope and Target

Identify the target application URL and define scope:

# Set target URL
TARGET_URL="https://target-app.com"

# For authenticated scans, prepare authentication context
# See references/authentication_guide.md for detailed setup

Scope Considerations:

• Exclude third-party domains and CDN URLs
• Include all application subdomains and API endpoints
• Respect scope limitations in penetration testing engagements

Step 2: Run Passive Scanning

Execute passive scanning to analyze traffic without active attacks:

# Baseline scan performs spidering + passive scanning
docker run -t zaproxy/zap-stable zap-baseline.py \
  -t $TARGET_URL \
  -r baseline-report.html \
  -J baseline-report.json

What Passive Scanning Detects:

• Missing security headers (CSP, HSTS, X-Frame-Options)
• Information disclosure in responses
• Cookie security issues (HttpOnly, Secure flags)
• Basic authentication weaknesses
• Application fingerprinting data