DAST in the pipeline: ZAP automation and API scanning
You run ZAP headless, turn authenticated and API scans into an automation plan and add a pipeline step that scans the test environment on every deploy and stops on bad results.
Level 301 · 16 lessons · 15 practice labs
Lessons
Headless ZAP
- Running ZAP in a container
- The automation framework: the plan file
- Plan jobs: spider, passive wait, active scan, report
- Short task: write your first plan file for a test environment
Authenticated scans
- Authentication methods: form, header, script
- Verifying the session stays alive
- Scanning with different roles
- Short task: automatically scan a token-protected app
API scanning
- Importing an OpenAPI definition
- Scanning GraphQL endpoints
- Scanning without overwhelming the test environment: rate and scope
- Short task: scan every endpoint of a REST API
Into the pipeline
- Spinning up a temporary test environment
- Thresholds: which findings stop the pipeline
- Sending results to findings tracking as SARIF
- Capstone: a pipeline step that scans the API on every deploy
Practice labs
- Run ZAP in a container: Start the ZAP image and run a baseline scan against the app in the test environment.
- Write your first plan file for a test environment: Write and run an automation framework plan defining the context, spider, passive wait and report.
- Add an active scan and exit condition to the plan: Add an active scan job with a time limit and make the plan exit non-zero when a high finding appears.
- Choose the authentication method for the application: Decide which of form, header or script methods suits each of three sample apps.
- Automatically scan a token-protected app: Configure the plan to fetch a token from the login endpoint and send it in the header, and verify the session holds throughout the scan.
- Scan with two roles and extract the authorisation differences: Run separate scans as standard and admin users and report the admin endpoints a standard user can reach.
- Import an OpenAPI definition: Load the definition into ZAP and state how many endpoints appear in the site tree.
- Scan every endpoint of a REST API: Import the definition, fix the example values and scan after confirming each endpoint returns a valid response at least once.
- Scan a GraphQL endpoint without overwhelming the test environment: Import the schema, limit request rate and depth, exclude destructive mutations and measure that the environment stays healthy.
- Write in a threshold table which findings stop the pipeline: Decide stop, warn or pass for high, medium and low findings.
- Send results to findings tracking as SARIF: Convert the plan output to SARIF and publish it as a pipeline artefact.
- Apply the threshold to new findings only: Take the previous scan as baseline, write a comparison step that stops the pipeline only on a new high finding and test both cases.
- Bring up a temporary test environment inside the pipeline: Start the app and database as pipeline services and move on once the health check passes.
- Add the step that runs the baseline scan in the pipeline: Write a job that runs the plan against the temporary environment and keeps the report as an artefact.
- Complete the pipeline step that scans the API on every deploy: Build the environment, run the authenticated API scan, apply the threshold, send SARIF and show the pipeline stops on a deliberate flaw.
About this course
You run ZAP headless, turn authenticated and API scans into an automation plan and add a pipeline step that scans the test environment on every deploy and stops on bad results.
What you will learn
- Headless ZAP
- Authenticated scans
- API scanning
- Into the pipeline
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.