<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-dast-scanning
description: >-
  Integrate Dynamic Application Security Testing into CI/CD using OWASP ZAP and
  Nuclei. Scan running applications for runtime vulnerabilities including XSS,
  injection, authentication flaws, and misconfigurations in staging environments.
domain: cybersecurity
subdomain: devsecops
tags:
  - dast
  - owasp-zap
  - nuclei
  - dynamic-analysis
  - web-security
  - ci-cd
  - api-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing DAST Scanning

## Overview

Dynamic Application Security Testing (DAST) scans running applications by sending
crafted requests and analyzing responses for vulnerabilities. Unlike SAST, DAST finds
runtime issues: authentication bypasses, server misconfigurations, CORS flaws, and
injection vulnerabilities that only manifest during execution.

Mode: `[MODE: BLUE]` — Runtime vulnerability detection in staging environments.

## Prerequisites

| Requirement | Details |
|---|---|
| OWASP ZAP (`docker pull ghcr.io/zaproxy/zaproxy:stable`) | Required |
| Nuclei (`go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest`) | Required |
| Target application deployed in staging environment | Required |
| CI/CD platform with Docker support | Required |

## Key Concepts

### OWASP ZAP in GitHub Actions

```yaml
name: DAST Scan
on:
  workflow_run:
    workflows: ["Deploy to Staging"]
    types: [completed]

jobs:
  zap-scan:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'https://staging.example.com'
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a -j'
      - name: ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: 'https://staging.example.com'
          cmd_options: '-a -j -m 10'
```

### ZAP API Scan

```yaml
# Scan OpenAPI/Swagger spec
- name: ZAP API Scan
  uses: zaproxy/action-api-scan@v0.7.0
  with:
    target: 'https://staging.example.com/openapi.json'
    format: openapi
    cmd_options: '-a -j'
```

### Nuclei Scanning

```bash
# Run with default templates
nuclei -u https://staging.example.com -severity critical,high -json -o nuclei-results.json

# Run specific template categories
nuclei -u https://staging.example.com -tags cve,misconfig,exposure -json

# Scan with rate limiting
nuclei -u https://staging.example.com -rate-limit 50 -bulk-size 25 -json

# Authenticated scan with headers
nuclei -u https://staging.example.com \
  -H "Authorization: Bearer $TOKEN" \
  -severity critical,high -json
```

### ZAP Rule Configuration

```tsv
# .zap/rules.tsv — customize alert thresholds
10021	IGNORE	(X-Content-Type-Options)
10038	IGNORE	(Content Security Policy)
40012	FAIL	(Cross Site Scripting Reflected)
40014	FAIL	(Cross Site Scripting Persistent)
40018	FAIL	(SQL Injection)
90033	FAIL	(Loosely Scoped Cookie)
```

### GitLab CI Integration

```yaml
dast:
  stage: dast
  image: ghcr.io/zaproxy/zaproxy:stable
  script:
    - mkdir -p /zap/wrk/
    - zap-baseline.py -t https://staging.example.com -J gl-dast-report.json -a
  artifacts:
    reports:
      dast: gl-dast-report.json
    when: always
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
```

## Workflow

### Step 1: Baseline Scan

```bash
node scripts/agent.js --action baseline --target https://staging.example.com --output /tmp/dast-baseline.json
```

### Step 2: Full Scan

```bash
node scripts/agent.js --action full --target https://staging.example.com --output /tmp/dast-full.json
```

### Step 3: API Scan

```bash
node scripts/agent.js --action api --target https://staging.example.com/openapi.json --output /tmp/dast-api.json
```

## Detection

```yaml
title: Dast Scanning Detection
id: f1e30ce6-2503-4565-865f-c8532fd799f6
status: experimental
description: Detects suspicious activity related to implementing dast scanning techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*dast*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Dast Scanning Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] DAST runs against staging after every deployment
- [ ] ZAP baseline scan completes in under 10 minutes
- [ ] Critical/high findings block promotion to production
- [ ] API endpoints scanned via OpenAPI spec
- [ ] Authentication-aware scanning configured
- [ ] False positives documented in rules.tsv
- [ ] Nuclei templates updated weekly

## References

- [OWASP ZAP Documentation](https://www.zaproxy.org/docs/)
- [Nuclei Documentation](https://docs.projectdiscovery.io/tools/nuclei/)
- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
