DAST with OWASP ZAP | DevOps Peach

DAST tests the running application from outside like an attacker; ZAP has a passive baseline scan safe for every PR, an active full scan for test environments, and an API scan that reads OpenAPI.

How DAST complements SAST

DAST (Dynamic Application Security Testing) sends real HTTP requests to the running application and observes the responses. It needs no source code, so it finds things SAST cannot see: missing security headers, cookies without Secure/HttpOnly, information leaks in error pages, TLS configuration, wrong CORS, and some injection flaws that are really exploitable.

ZAP (Zed Attack Proxy) is the most popular open-source DAST tool, formerly under OWASP, now sponsored by Checkmarx and still free.

Three packaged scan types

Script	How it works	Use when
`zap-baseline.py`	Spider, then passive scanning only (reading responses)	Every PR or test deploy; minutes; safe
`zap-full-scan.py`	Spider plus active attacks	A dedicated test environment on a schedule; may create junk data
`zap-api-scan.py`	Reads OpenAPI, SOAP or GraphQL and attacks the API	Backend APIs

docker run --rm -v "$(pwd)":/zap/wrk -t ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://staging.example.com -r zap-report.html
docker run --rm -v "$(pwd)":/zap/wrk -t ghcr.io/zaproxy/zaproxy:stable \
  zap-api-scan.py -t https://staging.example.com/openapi.json -f openapi

Exit codes: 0 no alerts, 1 at least one FAIL, 2 at least one WARN. A -c rules.conf file switches individual rules to IGNORE, WARN or FAIL.

flowchart LR
  B["Build + deploy<br/>to staging"] --> Z["ZAP baseline"]
  Z --> R{"Any FAIL?"}
  R -- "yes" --> X["Block promotion to prod"]
  R -- "no" --> P["Promote"]
  N["Nightly schedule"] --> F["ZAP full scan<br/>dedicated test env"]

Reading results

WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 4
WARN-NEW: Cookie Without Secure Flag [10011] x 1
FAIL-NEW: 0  WARN-NEW: 2  INFO: 3  PASS: 52

Each alert has a plugin ID (for example 10038), the affected URLs, evidence and remediation advice. The HTML report suits people; JSON or SARIF suits machines.

Important notes

Only scan systems you are authorised to scan. A full scan sends attack payloads; running it against someone else's system may be illegal.
Do not run active scans against production: they may create orders, send emails or delete data.
Applications with logins need an authentication context (form, header token); otherwise ZAP only sees the login page.

Traps: treating a "clean" baseline as total safety; ignoring every WARN instead of fixing cheap security headers; scanning a staging setup configured differently from production.