Dynamic testing (DAST): scanning with OWASP ZAP
You explore a running web app with OWASP ZAP, scan it passively and actively, verify the findings and write a report developers can act on.
Level 201 · 17 lessons · 15 practice labs
Lessons
Getting to know DAST
- What DAST is and how it differs from SAST
- Setting up ZAP and pointing the browser at its proxy
- Scope and contexts: scanning only the permitted target
- Short task: browse the app and review the requests in the history
Discovery and passive scanning
- Discovering pages with the spider
- The AJAX spider for JavaScript-heavy pages
- Passive scanning: findings without sending attacks
- Interpreting missing security headers
- Short task: prioritise the top five passive findings
Active scanning
- Active scanning: policies and strength
- Scanning as a logged-in user
- Verifying a finding by hand: the request editor
- Marking false alarms and alert filters
- Short task: run an authenticated scan that includes the admin panel
Reporting
- Baseline scans from the command line: zap-baseline
- Report templates and explaining findings to developers
- Capstone: a DAST report for a customer portal
Practice labs
- Point the browser at the ZAP proxy and review the history: Browse the lab app and find the login request and response in the history tab.
- Define a context that covers the permitted target only: Create a context for the target app, leave external domains out of scope and turn on protected mode.
- Find the scope mistake and pull the scan back within safe bounds: Fix a context that fails to exclude the logout link and delete endpoints, and show the spider no longer kills the session.
- Discover pages with the spider: Run the traditional spider and record the number of URLs found and the site tree.
- Crawl JavaScript-heavy pages with the AJAX spider: Compare the URLs both spiders found and list the endpoints only the AJAX spider saw.
- Prioritise the top five passive findings: Rank missing security headers and cookie findings by impact and write the fix line for the developer for each.
- Start an active scan on a single endpoint: Run an active scan with the default policy on the search page and list the alerts raised.
- Tune the scan policy to the application: Disable rules for technologies the app does not use, raise the strength of injection rules and measure the time difference.
- Run an authenticated scan that includes the admin panel: Define form-based login and the logged-in indicator, scan as the admin user and prove from the request history that the panel was scanned.
- Examine the request and response behind an alert: Find the evidence field, the input sent and its trace in the response for a chosen alert.
- Verify a finding by hand with the request editor: Resend the reflected input the tool reported with a harmless marker value in your own lab and decide whether it is real.
- Weed out false alarms for good with alert filters: Identify three false alarms with reasons, add alert filters to the context and show they do not reappear in the next scan.
- Run a baseline scan from the command line: Run the zap-baseline script against the target and read the warning and failure counts from the output.
- Report findings in a form developers can act on: Choose a report template and add reproduction steps and a fix recommendation for each finding.
- Prepare a DAST report for a customer portal: Run an authenticated scan of Mercanköşk Otelcilik’s lab portal, verify the findings and write a report with executive summary and technical appendices.
About this course
You explore a running web app with OWASP ZAP, scan it passively and actively, verify the findings and write a report developers can act on.
What you will learn
- Getting to know DAST
- Discovery and passive scanning
- Active scanning
- Reporting
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.