# Dynamic Testing (DAST) with ZAP — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-dast

> Run a DAST baseline scan against a staging app, understand what it can and cannot find, and compare it with SAST.

## Testing from the outside

**Dynamic application security testing** probes a running application over HTTP, the way an attacker would, without reading the source. A DAST tool crawls pages and API endpoints, then sends crafted requests and watches responses for signs of problems: reflected script in the HTML (XSS), database error messages (possible injection), missing security headers, cookies without `Secure` or `HttpOnly`, open redirects and verbose server banners. **ZAP** (formerly OWASP ZAP) is the widely used open-source option; its **baseline scan** is passive and quick, suitable for every deployment to staging, while the **full scan** actively attacks and should run only against environments you own and can afford to break. DAST complements SAST: it finds runtime and configuration issues and has fewer false positives for what it reports, but it only tests what it can reach, so authentication setup and an OpenAPI definition for API scanning make a big difference to coverage.

## Security beyond the build

Once code is running, three layers need attention: the application tested from outside with DAST, the Kubernetes workload settings, and the cloud account permissions around it.

![Three connected stages: DAST on the running app, Kubernetes workload hardening, cloud account posture.](assets/figures/devsecops/section-8-map.svg) — Figure 8.1: running app (DAST) -> Kubernetes workloads -> cloud account posture.

## A ZAP baseline scan in CI

The packaged script spiders the target and reports passive findings. Run it only against systems you are authorised to test.

```bash
docker run --rm -v "$(pwd)":/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://staging.shop.example.com -r zap-report.html

# For an API described by OpenAPI:
# zap-api-scan.py -t https://staging.shop.example.com/openapi.json -f openapi
```

## Permission first

Active scanning a system you do not own or have written permission to test can be illegal, even with good intentions. Bug bounty programmes publish their scope; stay inside it.

**Quiz:** Which issue is DAST better placed to find than SAST?

- [x] A missing security header in the deployed web server configuration
- [ ] An unused variable in the code
- [ ] A hard-coded password in a test file
- [ ] A vulnerable version in a lockfile

*Answer:* A missing security header in the deployed web server configuration. Headers are often set by servers, proxies or frameworks at runtime; DAST observes the real responses.