Dynamic Testing (DAST) with ZAP

Testing from the outside

Dynamic application security testing probes a running application over HTTP, the way an attacker would, without reading the source. A DAST tool crawls pages and API endpoints, then sends crafted requests and watches responses for signs of problems: reflected script in the HTML (XSS), database error messages (possible injection), missing security headers, cookies without Secure or HttpOnly, open redirects and verbose server banners. ZAP (formerly OWASP ZAP) is the widely used open-source option; its baseline scan is passive and quick, suitable for every deployment to staging, while the full scan actively attacks and should run only against environments you own and can afford to break. DAST complements SAST: it finds runtime and configuration issues and has fewer false positives for what it reports, but it only tests what it can reach, so authentication setup and an OpenAPI definition for API scanning make a big difference to coverage.

Security beyond the build

Once code is running, three layers need attention: the application tested from outside with DAST, the Kubernetes workload settings, and the cloud account permissions around it.

A ZAP baseline scan in CI

The packaged script spiders the target and reports passive findings. Run it only against systems you are authorised to test.

docker run --rm -v "$(pwd)":/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://staging.shop.example.com -r zap-report.html

# For an API described by OpenAPI:
# zap-api-scan.py -t https://staging.shop.example.com/openapi.json -f openapi

Permission first

Active scanning a system you do not own or have written permission to test can be illegal, even with good intentions. Bug bounty programmes publish their scope; stay inside it.

त्वरित जाँच: Which issue is DAST better placed to find than SAST?

• A missing security header in the deployed web server configuration
• An unused variable in the code
• A hard-coded password in a test file
• A vulnerable version in a lockfile