Dast Scanner

Input: Target URL or Docker Compose file
  │
  ├─► Phase 1: Target Discovery
  │     - Detect running services, ports, endpoints
  │     - Probe with httpx for live hosts and tech fingerprinting
  │     - Parse inventory.json from devsecops-repo-analyzer (if available)
  │
  ├─► Phase 2: Nuclei Quick Scan
  │     ├── CVE templates          (known CVEs with PoC)
  │     ├── Misconfiguration       (exposed panels, default creds, open redirects)
  │     ├── Exposure templates     (sensitive files, debug endpoints, backups)
  │     └── Technology detection  (stack identification for targeted follow-up)
  │
  ├─► Phase 3: ZAP Deep Scan
  │     ├── Spider/crawl           (discover all application pages/endpoints)
  │     ├── Active scan            (XSS, SQLi, CSRF, path traversal, etc.)
  │     ├── Passive scan           (missing headers, cookie flags, CSP, CORS)
  │     └── API scan mode         (if OpenAPI/Swagger spec available)
  │
  ├─► Phase 4: Finding Correlation
  │     - Deduplicate findings across Nuclei + ZAP
  │     - Map each finding to CWE identifier
  │     - Map each finding to OWASP Top 10 category
  │     - Assign unified severity score
  │
  └─► Phase 5: Report Generation
        - dast-results/nuclei.json       (raw Nuclei findings)
        - dast-results/zap.json          (raw ZAP findings)
        - dast-results/dast-report.md    (unified markdown report)

Severity Mapping

Instructions

Phase 1 — Environment Setup

1. Check whether the bundled install script has been run:

   which nuclei && nuclei -version
   docker image inspect ghcr.io/zaproxy/zaproxy:stable >/dev/null 2>&1
   

2. If either tool is missing, execute scripts/install-dast-tools.sh.
3. Create the output directory: mkdir -p dast-results
4. If inventory.json from devsecops-repo-analyzer is available, read it to determine target ports/services. Otherwise, derive from the provided URL or Docker Compose file.

Phase 2 — Target Discovery

5. Use httpx to probe the target and confirm liveness:

   httpx -u <TARGET_URL> -tech-detect -status-code -title -json -o dast-results/httpx.json
   

6. Extract endpoints and noted technologies for template selection.

Phase 3 — Nuclei Quick Scan

7. Read references/nuclei-templates.md to select the appropriate template categories for the detected tech stack.
8. Execute scripts/run-nuclei.py with appropriate arguments:

   python scripts/run-nuclei.py \
     --target <TARGET_URL> \
     --categories cves,misconfiguration,exposures,technologies,default-logins \
     --severity critical,high,medium \
     --output dast-results/nuclei.json \
     --rate-limit 100 \
     --timeout 300
   

9. Review the parsed findings for any CRITICAL/HIGH items that warrant immediate escalation.

Phase 4 — ZAP Deep Scan

10. Read references/zap-scan-modes.md to choose the appropriate ZAP scan mode:
    • baseline — fast passive scan (CI/CD safe, ~2 min)
    • full — active + passive scan (comprehensive, ~20–60 min)
    • api — OpenAPI/SOAP/GraphQL-aware scan
11. Execute scripts/run-zap.py with appropriate arguments:

    python scripts/run-zap.py \
      --target <TARGET_URL> \
      --mode full \
      --output dast-results/zap.json
    

12. If an OpenAPI spec is available, add --openapi-spec path/to/openapi.yaml and use --mode api.
13. If authentication is required, provide --login-url, --username, and --password.

Phase 5 — Finding Correlation

14. Load both dast-results/nuclei.json and dast-results/zap.json.
15. Deduplicate findings by matching on:
    • Same host + port + path
    • Same vulnerability class (CWE or OWASP category)
16. For each deduplicated finding, assign:
    • cwe_id (e.g., CWE-89 for SQLi)
    • owasp_category (e.g., A03:2021 – Injection)
    • unified_severity (use the higher of the two tool ratings)
    • source_tools list (["nuclei"], ["zap"], or ["nuclei","zap"])

Phase 6 — Report Generation

17. Use assets/templates/dast-report-template.md as the structure for the final report.
18. Populate all sections: executive summary, finding table, per-finding details, remediation recommendations.
19. Write final report to dast-results/dast-report.md.
20. Summarize findings to the user: total count by severity, top 3 most critical findings, and recommended immediate actions.

Inputs

Outputs

Bundled Resources

Important Notes

• Never run active scans against production systems without explicit authorization. Always confirm scope with the user before executing full or API scan modes.
• ZAP active scans are loud and will appear in access logs. Warn users operating in shared or monitored environments.
• Nuclei template updates pull from the internet. Ensure outbound connectivity or use --offline-mode in air-gapped environments.
• If the target is only accessible via Docker internal networking, use --network host or pass the Docker Compose file to run-zap.py for automatic network attachment.
• Rate-limit Nuclei scans against fragile or production-adjacent targets using --rate-limit 25 or lower.