integrating-dast-with-owasp-zap-in-pipeline

name	integrating-dast-with-owasp-zap-in-pipeline
description	Use when this skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab CI.
domain	cybersecurity
tags	["devsecops","cicd","dast","owasp-zap","dynamic-testing","secure-sdlc"]
subdomain	devsecops
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"]

Integrating Dast With Owasp Zap In Pipeline

Overview

Cybersecurity skill for integrating dast with owasp zap in pipeline. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "integrating dast with owasp zap in pipeline"

• "This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Applicati"

• When testing running web applications for vulnerabilities like XSS, SQLi, CSRF, and misconfigurations

• When SAST alone is insufficient and runtime behavior testing is required

• When compliance mandates dynamic security testing of web applications before production

• When testing APIs (REST/GraphQL) for authentication, authorization, and injection flaws

• When establishing continuous DAST scanning in staging environments before production deployment

Do not use for scanning source code (use SAST), for scanning dependencies (use SCA), or for infrastructure configuration scanning (use IaC scanning tools).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• OWASP ZAP Docker image or installed locally (zaproxy/zap-stable or zaproxy/action-*)
• Running target application accessible from the CI/CD runner (staging URL or Docker service)
• ZAP scan rules configuration (optional, for tuning)
• OpenAPI/Swagger specification for API scanning (optional)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}