What it does. Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill integrating-dast-with-owasp-zap-in-pipeline, or copy the skill folder into ~/.claude/skills/integrating-dast-with-owasp-zap-in-pipeline/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md

SKILL.md (verbatim)

name: integrating-dast-with-owasp-zap-in-pipeline
description: Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.
domain: cybersecurity
subdomain: devsecops
tags:
- devsecops
- cicd
- dast
- owasp-zap
- dynamic-testing
- secure-sdlc
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- GV.SC-07
- ID.IM-04
- PR.PS-04
mitre_attack:
- T1195
- T1554
- T1059.004

Integrating DAST with OWASP ZAP in Pipeline

When to Use

• When testing running web applications for vulnerabilities like XSS, SQLi, CSRF, and misconfigurations
• When SAST alone is insufficient and runtime behavior testing is required
• When compliance mandates dynamic security testing of web applications before production
• When testing APIs (REST/GraphQL) for authentication, authorization, and injection flaws
• When establishing continuous DAST scanning in staging environments before production deployment

Do not use for scanning source code (use SAST), for scanning dependencies (use SCA), or for infrastructure configuration scanning (use IaC scanning tools).

Prerequisites

• OWASP ZAP Docker image or installed locally (zaproxy/zap-stable or zaproxy/action-*)
• Running target application accessible from the CI/CD runner (staging URL or Docker service)
• ZAP scan rules configuration (optional, for tuning)
• OpenAPI/Swagger specification for API scanning (optional)

Workflow

Step 1: Configure ZAP Baseline Scan in GitHub Actions

# .github/workflows/dast-scan.yml
name: DAST Security Scan

on:
  deployment_status:
  workflow_dispatch:
    inputs:
      target_url:
        description: 'Target URL to scan'
        required: true

jobs:
  zap-baseline:
    name: ZAP Baseline Scan
    runs-on: ubuntu-latest
    services:
      webapp:
        image: ${{ github.repository }}:${{ github.sha }}
        ports:
          - 8080:8080
        options: --health-cmd="curl -f http://localhost:8080/health" --health-interval=10s --health-timeout=5s --health-retries=5

    steps:
      - uses: actions/checkout@v4

      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'http://webapp:8080'
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a -j'
          allow_issue_writing: false

      - name: Upload ZAP Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: zap-baseline-report
          path: report_html.html

Step 2: Configure ZAP Full Scan for Comprehensive Testing

  zap-full-scan:
    name: ZAP Full Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.12.0
        with:
          target: ${{ github.event.inputs.target_url || 'https://staging.example.com' }}
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a -j -T 60'

      - name: Upload Reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: zap-full-report
          path: |
            report_html.html
            report_json.json

Step 3: Configure API Scan with OpenAPI Specification

  zap-api-scan:
    name: ZAP API Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: ZAP API Scan
        uses: zaproxy/action-api-scan@v0.12.0
        with:
          target: 'https://staging.example.com/api/openapi.json'
          format: openapi
          rules_file_name: '.zap/api-rules.tsv'
          cmd_options: '-a -j'

Step 4: Configure ZAP Scan Rules

# .zap/rules.tsv
# Rule ID	Action (IGNORE/WARN/FAIL)	Description
10003	IGNORE	# Vulnerable JS Library (handled by SCA)
10015	WARN	# Incomplete or No Cache-control Header
10021	FAIL	# X-Content-Type-Options Missing
10035	FAIL	# Strict-Transport-Security Missing
10038	FAIL	# Content Security Policy Missing
10098	IGNORE	# Cross-Domain Misconfiguration (CDN)
40012	FAIL	# Cross Site Scripting (Reflected)
40014	FAIL	# Cross Site Scripting (Persistent)
40018	FAIL	# SQL Injection
40019	FAIL	# SQL Injection (MySQL)
40032	FAIL	# .htaccess Information Leak
90033	FAIL	# Loosely Scoped Cookie

Step 5: Run ZAP with Docker Compose for Local Testing

# docker-compose.zap.yml
version: '3.8'
services:
  webapp:
    build: .
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 10s
      retries: 5

  zap:
    image: zaproxy/zap-stable:latest
    depends_on:
      webapp:
        condition: service_healthy
    command: >
      zap-baseline.py
        -t http://webapp:8080
        -r /zap/wrk/report.html
        -J /zap/wrk/report.json
        -c /zap/wrk/rules.tsv
        -I
    volumes:
      - ./zap-reports:/zap/wrk
      - ./.zap/rules.tsv:/zap/wrk/rules.tsv

Key Concepts

Term	Definition
DAST	Dynamic Application Security Testing — tests running applications by sending requests and analyzing responses
Baseline Scan	Quick passive scan that spiders the application without active attacks, suitable for CI/CD
Full Scan	Active scan including attack payloads for XSS, SQLi, and other injection vulnerabilities
API Scan	Targeted scan using OpenAPI/Swagger specs to test all documented API endpoints
Spider	ZAP's crawler that discovers application pages and endpoints by following links
Active Scan	Phase where ZAP sends attack payloads to discovered endpoints to find exploitable vulnerabilities
Passive Scan	Analysis of HTTP responses for security headers, cookies, and information disclosure without sending attacks
Scan Policy	Configuration defining which attack types to enable and their intensity levels

Tools & Systems

• OWASP ZAP: Open-source web application security scanner for DAST testing
• zaproxy/action-baseline: GitHub Action for ZAP passive baseline scanning
• zaproxy/action-full-scan: GitHub Action for ZAP active full scanning
• zaproxy/action-api-scan: GitHub Action for API-focused scanning with OpenAPI support
• Nuclei: Alternative vulnerability scanner with template-based detection for CI/CD integration

Common Scenarios

Scenario: Integrating DAST into a Staging Deployment Pipeline

Context: A team deploys to staging before production and needs automated DAST scanning between stages to catch runtime vulnerabilities.

Approach:

1. Add a DAST job in the pipeline that triggers after successful staging deployment
2. Run ZAP baseline scan first for quick passive feedback (2-5 minutes)
3. Follow with a targeted API scan using the application's OpenAPI specification
4. Configure rules.tsv to FAIL on critical findings (XSS, SQLi) and WARN on headers/cookies
5. Upload ZAP reports as pipeline artifacts for review
6. Block production deployment if any FAIL-level findings are detected
7. Schedule weekly full scans against staging for deeper coverage

Pitfalls: ZAP full scans can take 30+ minutes and may overwhelm staging servers with attack traffic. Use baseline scans in CI and full scans on schedule. Running DAST against production without coordination can trigger WAF blocks and incident alerts.

Output Format

ZAP DAST Scan Report
======================
Target: https://staging.example.com
Scan Type: Baseline + API
Date: 2026-02-23
Duration: 4m 32s

FINDINGS:
  FAIL: 3
  WARN: 7
  INFO: 12
  PASS: 45

FAILING ALERTS:
  [HIGH] 40012 - Cross Site Scripting (Reflected)
    URL: https://staging.example.com/search?q=<script>
    Method: GET
    Evidence: <script>alert(1)</script>

  [MEDIUM] 10021 - X-Content-Type-Options Missing
    URL: https://staging.example.com/api/v1/*
    Evidence: Response header missing

  [MEDIUM] 10035 - Strict-Transport-Security Missing
    URL: https://staging.example.com/
    Evidence: HSTS header not present

QUALITY GATE: FAILED (1 HIGH, 2 MEDIUM findings)

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

DAST with OWASP ZAP Templates

ZAP Rules File

# .zap/rules.tsv
# Rule ID	Action	Description
10003	IGNORE	# Vulnerable JS Library (handled by SCA tools)
10015	WARN	# Incomplete Cache-control Header
10020	WARN	# X-Frame-Options Header Not Set
10021	FAIL	# X-Content-Type-Options Missing
10035	FAIL	# Strict-Transport-Security Missing
10038	FAIL	# Content Security Policy Missing
10098	IGNORE	# Cross-Domain Misconfiguration (CDN expected)
40012	FAIL	# XSS Reflected
40014	FAIL	# XSS Persistent
40018	FAIL	# SQL Injection
40019	FAIL	# SQL Injection (MySQL)
40024	FAIL	# SQL Injection (PostgreSQL)
40032	WARN	# .htaccess Info Leak
90033	WARN	# Loosely Scoped Cookie

GitHub Actions: Complete DAST Pipeline

# .github/workflows/dast.yml
name: DAST Pipeline

on:
  workflow_run:
    workflows: ["Deploy to Staging"]
    types: [completed]

jobs:
  zap-scan:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - uses: actions/checkout@v4

      - name: Wait for staging
        run: |
          for i in $(seq 1 30); do
            if curl -sf https://staging.example.com/health; then break; fi
            sleep 10
          done

      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'https://staging.example.com'
          rules_file_name: '.zap/rules.tsv'

      - name: ZAP API Scan
        uses: zaproxy/action-api-scan@v0.12.0
        with:
          target: 'https://staging.example.com/api/v1/openapi.json'
          format: openapi
          rules_file_name: '.zap/rules.tsv'

      - name: Upload Reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: dast-reports
          path: report_*.html

Docker Compose for Local DAST Testing

# docker-compose.dast.yml
services:
  app:
    build: .
    ports: ["8080:8080"]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 5s
      retries: 10

  zap:
    image: zaproxy/zap-stable:latest
    depends_on:
      app:
        condition: service_healthy
    volumes:
      - ./zap-reports:/zap/wrk
      - ./.zap/rules.tsv:/zap/wrk/rules.tsv
    command: >
      zap-baseline.py
        -t http://app:8080
        -r /zap/wrk/report.html
        -J /zap/wrk/report.json
        -c /zap/wrk/rules.tsv
        -I

references/api-reference.md (verbatim)

API Reference: OWASP ZAP DAST Pipeline Integration

ZAP Docker Scan Scripts

Baseline Scan (Passive Only)

docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
  zap-baseline.py -t https://target.com -J report.json -I

Full Scan (Active + Passive)

docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
  zap-full-scan.py -t https://target.com -J report.json -m 5 -I

API Scan (OpenAPI/Swagger)

docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
  zap-api-scan.py -t https://target.com/openapi.json -f openapi -J report.json

Return Codes

Code	Meaning
0	No alerts above threshold
1	Warnings found
2	Failures found

Common Flags

Flag	Description
-t	Target URL
-J	JSON report filename
-m	Max scan duration in minutes
-I	Do not return failure on warnings
-f	API spec format (openapi, soap)
-r	HTML report filename
-c	Config file for rule tuning

ZAP JSON Report Structure

{"site": [{"alerts": [{"name": "...", "riskdesc": "High (Medium)",
  "cweid": "79", "count": 3, "solution": "..."}]}]}

Risk Levels

Level	Action
High	Block deployment
Medium	Require review
Low	Track as tech debt
Informational	Log only

References

• ZAP Docker: https://www.zaproxy.org/docs/docker/
• ZAP Automation: https://www.zaproxy.org/docs/automate/

references/standards.md (verbatim)

Standards Reference: DAST with OWASP ZAP

OWASP Top 10 - DAST Coverage

OWASP Category	ZAP Detection	Alert IDs
A01: Broken Access Control	Partial	10020, 10035, 40012
A02: Cryptographic Failures	Yes	10003, 10041
A03: Injection	Yes	40012, 40014, 40018, 40019
A05: Security Misconfiguration	Yes	10015, 10020, 10021, 10035
A07: Auth Failures	Partial	10010, 10054
A09: Logging Failures	Yes	10035
A10: SSRF	Partial	Custom scan

OWASP SAMM - Verification: Security Testing

Level 2: DAST Integration

• Automated DAST scanning in CI/CD pipelines
• Baseline scans on every deployment, full scans weekly
• Findings tracked and triaged with defined SLAs

Level 3: Advanced DAST

• Authenticated scanning with session management
• API-specific scanning with OpenAPI specifications
• Custom scan policies tuned for application-specific risks

NIST SSDF (SP 800-218)

PW.8: Test Executable Code

• PW.8.1: Test executable code using dynamic analysis
• DAST validates running application behavior against security requirements
• Integration into CI/CD automates regular testing

PCI DSS v4.0

• 6.2.4: Use automated methods to prevent common attacks (XSS, SQLi)
• 6.4.1: Web applications are protected against known attacks
• 11.3.1: Internal vulnerability scans performed at least quarterly

references/workflows.md (verbatim)

Workflow Reference: DAST with OWASP ZAP

DAST Pipeline Integration

Build & Deploy to Staging
       │
       ▼
┌──────────────────┐
│ Health Check      │
│ (wait for ready)  │
└──────┬───────────┘
       │
       ├──────────────┐
       ▼              ▼
┌───────────┐  ┌───────────┐
│ ZAP       │  │ ZAP API   │
│ Baseline  │  │ Scan      │
│ Scan      │  │ (OpenAPI) │
└─────┬─────┘  └─────┬─────┘
      │               │
      └───────┬───────┘
              ▼
       ┌──────────────┐
       │ Report Gen   │
       │ + Upload     │
       └──────┬───────┘
              │
       ┌──────┴──────┐
       ▼             ▼
     PASS          FAIL
     Deploy to     Block +
     Production    Alert

ZAP Scan Types Comparison

Scan Type	Duration	Coverage	CI/CD Suitable	Active Attacks
Baseline	2-5 min	Passive only	Yes	No
Full Scan	30-120 min	Comprehensive	Scheduled	Yes
API Scan	5-15 min	API endpoints	Yes	Yes

ZAP Docker Commands

# Baseline scan (passive)
docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
  zap-baseline.py -t http://target:8080 \
  -r report.html -J report.json -c rules.tsv

# Full scan (active)
docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
  zap-full-scan.py -t http://target:8080 \
  -r report.html -J report.json -c rules.tsv -T 60

# API scan (OpenAPI)
docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
  zap-api-scan.py -t http://target:8080/openapi.json \
  -f openapi -r report.html -J report.json

Authenticated Scanning Configuration

# zap-auth-config.yaml
authentication:
  method: form
  loginUrl: http://target:8080/login
  parameters:
    username: testuser
    password: testpass123
  loggedInIndicator: "\\QWelcome\\E"
  loggedOutIndicator: "\\QSign In\\E"

context:
  name: "auth-context"
  include:
    - "http://target:8080/.*"
  exclude:
    - "http://target:8080/logout"
    - "http://target:8080/static/.*"

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.