Configure DAST Scans for Web App Security

This skill provides expertise in configuring Dynamic Application Security Testing (DAST) scans, with deep knowledge of OWASP ZAP, Burp Suite, Nessus, and other leading DAST tools, covering web application security testing methodology, scan optimization, authentication configuration, and balancing comprehensive coverage with scan efficiency. Core configuration principles cover scope definition (precise target scope with include/exclude URL patterns, filtering out logout endpoints and destructive actions, sensible crawl-depth limits to prevent infinite loops, and rate limits to avoid DoS conditions) and authentication configuration (session management with token refresh, form/header/certificate-based authentication, login-state verification, and handling MFA or complex login flows).

OWASP ZAP configuration covers the Baseline Automation Framework (a YAML context definition with target URLs, include/exclude path patterns, form-based authentication with login URL and request data, logged-in/logged-out regex verification, and test user credentials) and advanced spider configuration via the ZAP Python API (setting max crawl depth, max duration, max parse size, form submission/processing behavior, enabling passive scan rules while disabling specific noisy ones, and creating an active scan policy with a defined attack strength and alert threshold).

Burp Suite Professional configuration covers a JSON scan configuration defining audit checks (SQL injection across parameter/header/cookie insertion points, reflected and stored XSS, external service interaction detection) with consolidation strategy and concurrency/rate limits, plus crawl configuration (crawl strategy, location and duration limits, and a recorded login macro for authenticated crawling). Authentication patterns cover JWT token authentication (a custom ZAP script that performs the login request, extracts the access token from the JSON response, and sets it as a global Authorization header for subsequent requests) and session-based authentication (cookie-based session management with response-pattern and status-code verification, plus automatic session refresh triggered by an expiration pattern).

Use this skill when configuring a DAST scan (OWASP ZAP, Burp Suite, or similar) for a web application - defining scope, setting up authentication, and tuning scan performance/coverage tradeoffs. It is well suited to authenticated web applications and APIs needing dynamic security testing beyond static analysis. It is not meant for static code analysis (SAST is a different discipline), or for applications with no authenticated flows where scope/auth configuration is trivial.

Input: the target web application's URL scope, authentication method, and scan depth/performance requirements.

Output: a DAST scan configuration (ZAP context/policy, Burp scan configuration, or authentication scripts) tuned for the target application. Example ZAP baseline context configuration:

env:
  contexts:
    - name: "webapp-context"
      urls: ["https://app.example.com"]
      authentication:
        method: "form"
        loginUrl: "https://app.example.com/login"
        loggedInRegex: "\\QWelcome\\E"

Configures OWASP ZAP (Python API and Baseline Automation Framework), Burp Suite Professional (JSON scan configurations), and Nessus for dynamic web application security testing.

Application security engineers configuring DAST scans for authenticated web applications, and teams that need properly scoped, rate-limited scans with reliable authenticated crawling.