DevOps-Security-Agent-Skills/security/scanning/dast-scanning/references/dast-tools.md

DAST Tools Reference

Tool Comparison

Tool	Type	License	Best For
OWASP ZAP	Proxy/Scanner	Apache 2.0	General DAST
Nuclei	Template-based	MIT	Vulnerability checks
Nikto	Web scanner	GPL	Quick scans
Burp Suite	Proxy/Scanner	Commercial	Manual testing

OWASP ZAP

CLI Scanning

# Quick scan
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://target.com

# Full scan
docker run -t owasp/zap2docker-stable zap-full-scan.py -t https://target.com

# API scan
docker run -t owasp/zap2docker-stable zap-api-scan.py \
  -t https://target.com/openapi.json -f openapi

Automation Framework

# zap-config.yaml
env:
  contexts:
    - name: "Default Context"
      urls: ["https://target.com"]
      authentication:
        method: "form"
        parameters:
          loginUrl: "https://target.com/login"
          loginRequestData: "user={%username%}&pass={%password%}"
jobs:
  - type: spider
    parameters:
      maxDuration: 5
  - type: activeScan
    parameters:
      maxScanDurationInMins: 60
  - type: report
    parameters:
      template: "traditional-html"
      reportFile: "zap-report.html"

Nuclei

# Install
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Scan with all templates
nuclei -u https://target.com

# Specific templates
nuclei -u https://target.com -t cves/
nuclei -u https://target.com -t exposures/

# Critical and high only
nuclei -u https://target.com -severity critical,high

# Output
nuclei -u https://target.com -json -o results.json

Custom Template

id: custom-check
info:
  name: Custom Security Check
  severity: high
requests:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
    matchers:
      - type: status
        status:
          - 200

CI Integration

# GitHub Actions
- name: OWASP ZAP Scan
  uses: zaproxy/action-baseline@v0.9.0
  with:
    target: 'https://target.com'
    rules_file_name: '.zap/rules.tsv'

Best Practices

1. Run in staging, not production
2. Use authentication for full coverage
3. Exclude logout/destructive endpoints
4. Set reasonable timeouts
5. Review and triage findings