DAST tests a running application from the outside — like an attacker. It finds runtime vulnerabilities that SAST cannot see.

OWASP ZAP¶

Docker — automatic scan¶

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ -t https://target.com -r report.html

Full scan¶

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \ -t https://target.com

Nuclei¶

Installation¶

go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Scanning¶

nuclei -u https://target.com -t cves/ nuclei -u https://target.com -t vulnerabilities/

CI/CD¶

GitHub Actions — ZAP baseline¶

• name: ZAP Scan uses: zaproxy/[email protected] with: target: ‘https://staging.example.com’

Key Takeaway¶

DAST = testing a running application. ZAP for web apps, Nuclei for infra. Combine with SAST for complete coverage.