performing-web-application-vulnerability-triage

name	performing-web-application-vulnerability-triage
description	Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and prioritize remediation.
domain	cybersecurity
subdomain	vulnerability-management
tags	["web-application","vulnerability-triage","owasp","dast","sast","burp-suite","zap","false-positive","risk-rating"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]

Performing Web Application Vulnerability Triage

Overview

Web application vulnerability triage is the process of reviewing findings from DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) tools to validate true positives, dismiss false positives, assign risk ratings using the OWASP Risk Rating Methodology, and prioritize remediation. Effective triage reduces alert fatigue and focuses development teams on the vulnerabilities that matter most.

When to Use

• When conducting security assessments that involve performing web application vulnerability triage
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Common Misconfigurations & Verification

• Auto-trusting scanner severity — DAST/SAST confidence varies. Verify true positives by manual reproduction (the SQLi/XSS payloads here) before rating.
• Blanket false-positive dismissal — verify "informational header" findings are context-checked, not auto-closed when on a sensitive app.
• Likelihood/impact guessed — verify OWASP factors use real app context (internet-facing, PII, PCI, WAF) rather than defaults.
• CWE→OWASP miscategorization — verify the mapping so findings route to the right owner.
• SAST injection closed without code review — verify data-flow to a real sink before dismissing.
• No dedupe across DAST+SAST — verify the same flaw isn't counted twice across tools.

Prerequisites

• DAST scan results (OWASP ZAP, Burp Suite, Acunetix)
• SAST scan results (Semgrep, SonarQube, Checkmarx, Snyk Code)
• Python 3.9+ with requests, beautifulsoup4
• Burp Suite Professional or OWASP ZAP for manual validation
• DefectDojo or similar for finding management

OWASP Risk Rating Methodology

Risk Calculation

Risk = Likelihood x Impact

Likelihood Factors (0-9 scale)

Factor Group	Factor	Description
Threat Agent	Skill Level	How technically skilled is the attacker?
Threat Agent	Motive	How motivated is the attacker?