performing-web-application-vulnerability-triage

name	performing-web-application-vulnerability-triage
description	Triages web application vulnerability findings from DAST/SAST scanners such as Burp Suite and ZAP, using the OWASP Risk Rating Methodology to confirm true positives, dismiss false positives, and prioritize remediation. Use when reviewing scanner output to reduce alert fatigue and rank vulnerabilities for development teams to fix.
domain	cybersecurity
subdomain	vulnerability-management
tags	["web-application","vulnerability-triage","owasp","dast","sast","burp-suite","zap","false-positive","risk-rating"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]
mitre_attack	["T1190","T1203","T1068"]

Performing Web Application Vulnerability Triage

Overview

Web application vulnerability triage is the process of reviewing findings from DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) tools to validate true positives, dismiss false positives, assign risk ratings using the OWASP Risk Rating Methodology, and prioritize remediation. Effective triage reduces alert fatigue and focuses development teams on the vulnerabilities that matter most.

When to Use

• When conducting security assessments that involve performing web application vulnerability triage
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• DAST scan results (OWASP ZAP, Burp Suite, Acunetix)
• SAST scan results (Semgrep, SonarQube, Checkmarx, Snyk Code)
• Python 3.9+ with requests, beautifulsoup4
• Burp Suite Professional or OWASP ZAP for manual validation
• DefectDojo or similar for finding management

OWASP Risk Rating Methodology

Risk Calculation

Risk = Likelihood x Impact

Likelihood Factors (0-9 scale)

Factor Group	Factor	Description
Threat Agent	Skill Level	How technically skilled is the attacker?
Threat Agent	Motive	How motivated is the attacker?
Threat Agent	Opportunity	What resources/access are needed?
Threat Agent	Size	How large is the potential threat agent group?
Vulnerability	Ease of Discovery	How easy is it to find the vulnerability?
Vulnerability	Ease of Exploit	How easy is it to exploit?
Vulnerability	Awareness	How well known is the vulnerability?
Vulnerability	Intrusion Detection	How likely is exploitation to be detected?

Impact Factors (0-9 scale)

Factor Group