mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
106 lines
2.2 KiB
Markdown
106 lines
2.2 KiB
Markdown
# DAST Tools Reference
|
|
|
|
## Tool Comparison
|
|
|
|
| Tool | Type | License | Best For |
|
|
|------|------|---------|----------|
|
|
| **OWASP ZAP** | Proxy/Scanner | Apache 2.0 | General DAST |
|
|
| **Nuclei** | Template-based | MIT | Vulnerability checks |
|
|
| **Nikto** | Web scanner | GPL | Quick scans |
|
|
| **Burp Suite** | Proxy/Scanner | Commercial | Manual testing |
|
|
|
|
## OWASP ZAP
|
|
|
|
### CLI Scanning
|
|
```bash
|
|
# Quick scan
|
|
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://target.com
|
|
|
|
# Full scan
|
|
docker run -t owasp/zap2docker-stable zap-full-scan.py -t https://target.com
|
|
|
|
# API scan
|
|
docker run -t owasp/zap2docker-stable zap-api-scan.py \
|
|
-t https://target.com/openapi.json -f openapi
|
|
```
|
|
|
|
### Automation Framework
|
|
```yaml
|
|
# zap-config.yaml
|
|
env:
|
|
contexts:
|
|
- name: "Default Context"
|
|
urls: ["https://target.com"]
|
|
authentication:
|
|
method: "form"
|
|
parameters:
|
|
loginUrl: "https://target.com/login"
|
|
loginRequestData: "user={%username%}&pass={%password%}"
|
|
jobs:
|
|
- type: spider
|
|
parameters:
|
|
maxDuration: 5
|
|
- type: activeScan
|
|
parameters:
|
|
maxScanDurationInMins: 60
|
|
- type: report
|
|
parameters:
|
|
template: "traditional-html"
|
|
reportFile: "zap-report.html"
|
|
```
|
|
|
|
## Nuclei
|
|
|
|
```bash
|
|
# Install
|
|
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
|
|
|
|
# Scan with all templates
|
|
nuclei -u https://target.com
|
|
|
|
# Specific templates
|
|
nuclei -u https://target.com -t cves/
|
|
nuclei -u https://target.com -t exposures/
|
|
|
|
# Critical and high only
|
|
nuclei -u https://target.com -severity critical,high
|
|
|
|
# Output
|
|
nuclei -u https://target.com -json -o results.json
|
|
```
|
|
|
|
### Custom Template
|
|
```yaml
|
|
id: custom-check
|
|
info:
|
|
name: Custom Security Check
|
|
severity: high
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/admin"
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
```
|
|
|
|
## CI Integration
|
|
|
|
```yaml
|
|
# GitHub Actions
|
|
- name: OWASP ZAP Scan
|
|
uses: zaproxy/action-baseline@v0.9.0
|
|
with:
|
|
target: 'https://target.com'
|
|
rules_file_name: '.zap/rules.tsv'
|
|
```
|
|
|
|
## Best Practices
|
|
|
|
1. Run in staging, not production
|
|
2. Use authentication for full coverage
|
|
3. Exclude logout/destructive endpoints
|
|
4. Set reasonable timeouts
|
|
5. Review and triage findings
|