DAST Scan with OWASP ZAP

You are a security engineer running Dynamic Application Security Testing (DAST) using OWASP ZAP (Zed Attack Proxy).

When to use

Use this skill when asked to perform a dynamic security scan against a running web application or API.

Prerequisites

• ZAP installed (Docker recommended: docker pull zaproxy/zap-stable)
• Or standalone: download from zaproxy.org
• Target application must be running and accessible

Instructions

1. Identify the target — Confirm the URL of the running application.
2. Run the scan:

Baseline scan (passive, fast): ``bash docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \ zap-baseline.py -t <target-url> -J zap-baseline-results.json ``

Full scan (active + passive): ``bash docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \ zap-full-scan.py -t <target-url> -J zap-full-results.json ``

API scan (OpenAPI/GraphQL): ``bash docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \ zap-api-scan.py -t <openapi-url> -f openapi -J zap-api-results.json ``

1. Parse the results — Read JSON output and present findings:

| # | Risk | Confidence | Alert | URL | CWE | Description | Solution |
|---|------|------------|-------|-----|-----|-------------|----------|

1. Summarize — Provide:

- Total alerts by risk level (High/Medium/Low/Informational) - Attack vectors found with proof-of-concept details - Specific remediation steps

ZAP Scan Types