<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# DAST Scanning — API Reference

## OWASP ZAP CLI

```bash
# Baseline scan (passive only, fast)
zap-baseline.py -t https://target.com -J report.json -a

# Full scan (active + passive)
zap-full-scan.py -t https://target.com -J report.json -a -m 10

# API scan (OpenAPI/Swagger)
zap-api-scan.py -t https://target.com/openapi.json -f openapi -J report.json

# With custom rules
zap-baseline.py -t https://target.com -c rules.tsv -J report.json

# Ajax spider enabled
zap-full-scan.py -t https://target.com -j -a -J report.json

# Docker execution
docker run --rm -v $(pwd):/zap/wrk/ ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://target.com -J report.json
```

## Nuclei CLI

```bash
# Basic scan
nuclei -u https://target.com -severity critical,high -json

# Multiple targets
nuclei -l targets.txt -severity critical,high -json -o results.json

# Specific templates
nuclei -u https://target.com -tags cve,misconfig -json

# Rate limiting
nuclei -u https://target.com -rate-limit 50 -bulk-size 25

# With authentication
nuclei -u https://target.com -H "Authorization: Bearer $TOKEN" -json

# Update templates
nuclei -update-templates

# Template list
nuclei -tl
```

## ZAP Rule Severity Levels

| Level | Action |
|-------|--------|
| IGNORE | Suppress alert |
| INFO | Log only |
| WARN | Non-blocking warning |
| FAIL | Block pipeline |

## Common ZAP Alert IDs

| ID | Alert |
|----|-------|
| 10021 | X-Content-Type-Options missing |
| 10038 | CSP header missing |
| 40012 | Reflected XSS |
| 40014 | Persistent XSS |
| 40018 | SQL Injection |
| 40019 | SQL Injection (MySQL) |
| 90033 | Loosely Scoped Cookie |
| 10202 | Absence of Anti-CSRF Tokens |
