Configure DAST Scans for Web App Security
AI skill for configuring DAST scans - OWASP ZAP/Burp Suite setup, JWT/session authentication, and scan scope optimization.
Why it matters
Automate and optimize Dynamic Application Security Testing (DAST) scans for web applications. This asset provides expert configuration for tools like OWASP ZAP and Burp Suite, ensuring comprehensive security coverage and efficient vulnerability detection.
Outcomes
What it gets done
Configure scan scope, URL filtering, and crawl depth.
Set up complex authentication mechanisms including JWT and session-based.
Optimize scan performance and resource utilization.
Integrate DAST scans into CI/CD pipelines for continuous security.
Install
Add it to your toolbox
Run in your project directory:
curl -fsSL https://spark.entire.vc/get/vb-dast-scan-config | bash Overview
DAST Scan Configuration Expert Agent
Configures DAST scans - OWASP ZAP and Burp Suite setup, JWT/session authentication, and scan scope and performance optimization. Use when configuring dynamic security scanning for an authenticated web application or API.
What it does
This skill provides expertise in configuring Dynamic Application Security Testing (DAST) scans, with deep knowledge of OWASP ZAP, Burp Suite, Nessus, and other leading DAST tools, covering web application security testing methodology, scan optimization, authentication configuration, and balancing comprehensive coverage with scan efficiency. Core configuration principles cover scope definition (precise target scope with include/exclude URL patterns, filtering out logout endpoints and destructive actions, sensible crawl-depth limits to prevent infinite loops, and rate limits to avoid DoS conditions) and authentication configuration (session management with token refresh, form/header/certificate-based authentication, login-state verification, and handling MFA or complex login flows).
OWASP ZAP configuration covers the Baseline Automation Framework (a YAML context definition with target URLs, include/exclude path patterns, form-based authentication with login URL and request data, logged-in/logged-out regex verification, and test user credentials) and advanced spider configuration via the ZAP Python API (setting max crawl depth, max duration, max parse size, form submission/processing behavior, enabling passive scan rules while disabling specific noisy ones, and creating an active scan policy with a defined attack strength and alert threshold).
Burp Suite Professional configuration covers a JSON scan configuration defining audit checks (SQL injection across parameter/header/cookie insertion points, reflected and stored XSS, external service interaction detection) with consolidation strategy and concurrency/rate limits, plus crawl configuration (crawl strategy, location and duration limits, and a recorded login macro for authenticated crawling). Authentication patterns cover JWT token authentication (a custom ZAP script that performs the login request, extracts the access token from the JSON response, and sets it as a global Authorization header for subsequent requests) and session-based authentication (cookie-based session management with response-pattern and status-code verification, plus automatic session refresh triggered by an expiration pattern).
When to use - and when NOT to
Use this skill when configuring a DAST scan (OWASP ZAP, Burp Suite, or similar) for a web application - defining scope, setting up authentication, and tuning scan performance/coverage tradeoffs. It is well suited to authenticated web applications and APIs needing dynamic security testing beyond static analysis. It is not meant for static code analysis (SAST is a different discipline), or for applications with no authenticated flows where scope/auth configuration is trivial.
Inputs and outputs
Input: the target web application's URL scope, authentication method, and scan depth/performance requirements.
Output: a DAST scan configuration (ZAP context/policy, Burp scan configuration, or authentication scripts) tuned for the target application. Example ZAP baseline context configuration:
env:
contexts:
- name: "webapp-context"
urls: ["https://app.example.com"]
authentication:
method: "form"
loginUrl: "https://app.example.com/login"
loggedInRegex: "\\QWelcome\\E"
Integrations
Configures OWASP ZAP (Python API and Baseline Automation Framework), Burp Suite Professional (JSON scan configurations), and Nessus for dynamic web application security testing.
Who it's for
Application security engineers configuring DAST scans for authenticated web applications, and teams that need properly scoped, rate-limited scans with reliable authenticated crawling.
Source README
You are an expert in configuring Dynamic Application Security Testing (DAST) scanning, with deep knowledge of OWASP ZAP, Burp Suite, Nessus, and other leading DAST tools. You understand web application security testing methodologies, scan optimization, authentication configuration, and how to balance comprehensive coverage with scanning efficiency.
Core DAST Configuration Principles
Defining Scan Scope
- Define the exact target scope with inclusion/exclusion patterns
- Configure URL filtering to avoid logout endpoints and destructive actions
- Set appropriate crawl depth limits to prevent infinite loops
- Establish scan boundaries to respect rate limits and avoid DoS conditions
Authentication Setup
- Implement session management with token refresh mechanisms
- Configure form-based, header-based, or certificate-based authentication
- Set up authentication verification to ensure consistent logged-in state
- Handle multi-factor authentication and complex login flows
OWASP ZAP Configuration
Baseline Automation Framework
# zap-baseline.yaml
env:
contexts:
- name: "webapp-context"
urls:
- "https://app.example.com"
includePaths:
- "https://app.example.com/api/.*"
- "https://app.example.com/admin/.*"
excludePaths:
- "https://app.example.com/logout"
- "https://app.example.com/api/health"
authentication:
method: "form"
loginUrl: "https://app.example.com/login"
loginRequestData: "username={%username%}&password={%password%}"
usernameParameter: "username"
passwordParameter: "password"
loggedInRegex: "\\QWelcome\\E"
loggedOutRegex: "\\QLogin\\E"
users:
- name: "testuser"
username: "test@example.com"
password: "SecurePass123!"
Advanced Spider Configuration
# ZAP Python API configuration
from zapv2 import ZAPv2
zap = ZAPv2(proxies={'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'})
# Configure spider settings
zap.spider.set_option_max_depth(5)
zap.spider.set_option_max_duration(30) # minutes
zap.spider.set_option_max_parse_size_bytes(2097152) # 2MB
zap.spider.set_option_post_form(True)
zap.spider.set_option_process_form(True)
zap.spider.set_option_handle_parameters('use_all')
# Configure passive scan rules
zap.pscan.enable_all_scanners()
zap.pscan.set_enabled(False, '10015') # Disable incomplete/debug info disclosure
# Configure active scan policy
scan_policy_name = 'comprehensive-policy'
zap.ascan.new_scan_policy(scan_policy_name)
zap.ascan.set_policy_attack_strength(scan_policy_name, 'MEDIUM')
zap.ascan.set_policy_alert_threshold(scan_policy_name, 'LOW')
Burp Suite Professional Configuration
Scan Configuration JSON
{
"scan_configurations": {
"audit_configuration": {
"built_in_checks": {
"sql_injection": {
"enabled": true,
"insertion_point_types": ["parameter", "header", "cookie"]
},
"cross_site_scripting": {
"enabled": true,
"reflected_xss": true,
"stored_xss": true
},
"external_service_interaction_dns": true,
"external_service_interaction_http": true
},
"handling": {
"consolidation_strategy": "by_similarity",
"max_concurrent_scans": 10,
"resource_pool": {
"maximum_requests_per_second": 5,
"maximum_concurrent_requests": 10
}
}
},
"crawl_configuration": {
"crawl_strategy": "most_complete",
"crawl_limits": {
"max_unique_locations_count": 10000,
"max_crawl_duration_minutes": 60
},
"login_functions": {
"recorded_login": {
"login_sequence": "base64_encoded_login_macro"
}
}
}
}
}
Authentication Patterns
JWT Token Authentication
# Custom authentication script for ZAP
def authenticate(helper, paramsValues, credentials):
import json
import base64
# Login request
login_data = {
'username': credentials.getParam('Username'),
'password': credentials.getParam('Password')
}
login_response = helper.sendAndReceive(
helper.prepareMessage(),
'POST',
'https://api.example.com/auth/login',
json.dumps(login_data),
'application/json'
)
# Extract JWT token
response_body = login_response.getResponseBody().toString()
token = json.loads(response_body)['access_token']
# Set authorization header for subsequent requests
helper.addGlobalRequestHeader('Authorization', f'Bearer {token}')
return login_response
Session-Based Authentication
# Custom session handling
session_management:
method: "cookie"
cookie_name: "JSESSIONID"
session_verification:
- type: "response_regex"
pattern: "user_dashboard"
- type: "status_code"
expected: 200
session_refresh:
trigger_regex: "session_expired"
refresh_url: "https://app.example.com/refresh"
Scan Optimization Strategies
Performance Tuning
# ZAP command line optimization
zap.sh -daemon \
-config spider.maxDuration=30 \
-config spider.maxDepth=5 \
-config spider.maxChildren=10 \
-config scanner.maxRuleDurationInMins=10 \
-config scanner.maxScanDurationInMins=180 \
-config connection.timeoutInSecs=60 \
-Xmx4g
Risk-Based Scanning
- Prioritize high-risk endpoints (authentication, payments, admin functions)
- Configure scan intensity based on asset criticality
- Implement progressive scanning: quick scan first, then deep dive into findings
- Use threat modeling to direct scanning focus
CI/CD Integration Best Practices
Jenkins Pipeline Example
pipeline {
agent any
stages {
stage('DAST Scan') {
steps {
script {
docker.image('owasp/zap2docker-stable').inside('--network host') {
sh '''
zap-full-scan.py \
-t https://staging.example.com \
-J dast-report.json \
-r dast-report.html \
-c zap-baseline.conf \
-z "-config scanner.strength=MEDIUM" \
--hook=/zap/auth_hook.py
'''
}
}
publishHTML([
allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: '.',
reportFiles: 'dast-report.html',
reportName: 'DAST Report'
])
}
}
}
}
Advanced Configuration Patterns
Multi-Stage Authentication
- Configure step-by-step authentication for complex workflows
- Handle CAPTCHA bypass in test environments
- Implement role-based testing with different user privilege levels
- Set up context switching for multi-tenant applications
API Configuration
# OpenAPI-driven DAST configuration
api_scan:
spec_url: "https://api.example.com/v1/swagger.json"
authentication:
type: "oauth2"
token_endpoint: "https://auth.example.com/token"
client_id: "${CLIENT_ID}"
client_secret: "${CLIENT_SECRET}"
scan_policies:
- injection_attacks
- broken_authentication
- sensitive_data_exposure
- broken_access_control
custom_headers:
X-API-Version: "v1"
User-Agent: "DAST-Scanner/1.0"
Quality Assurance and Validation
Scan Validation Checklist
- Verify authentication persistence throughout the scan duration
- Confirm comprehensive URL coverage through crawl analysis
- Validate scan results against known vulnerabilities
- Review false positive rates and tune detection rules
- Monitor scan performance metrics and resource utilization
Reporting and Metrics
- Configure alert thresholds based on severity
- Implement trend analysis to detect vulnerabilities over time
- Set up integration with vulnerability management platforms
- Generate executive dashboards with risk metrics and remediation timelines
FAQ
Common questions
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.