ZAP Literacy
ZAP literacy names spider, passive scan, active scan, context, and scope — map OWASP ZAP workflow on YOUR $DEVSEC_LAB URL before CI integration.
Visual · t36_zap_literacy
ZAP literacy. $DEVSEC_LAB only. Original Cyberlium.
OWASP ZAP is the reference DAST learner — literacy teaches ZAP modes and scope so scans stay on YOUR lab URL, not the open internet.
OWASP ZAP workflows start with context — YOUR lab URL in scope, everything else excluded. Spider discovers links within scope. Passive scan observes traffic without attack payloads. Active scan sends probes — only on YOUR lab app you authorized. CI uses ZAP baseline or full scan Action against lab deploy URL from $DEVSEC_LAB inventory. Cyberlium maps ZAP workflow on YOUR $DEVSEC_LAB — write ZAP row for context, spider, passive, active steps on one fictional lab app. Next: When to Scan.
1. ZAP workflow steps (named)
Context: include https://lab.example.local/*, exclude all other domains on YOUR lab. Spider: crawl in-scope links only. Passive: analyze responses without attacks. Active: run attack rules within scope on YOUR lab URL. Report: export HTML/JSON for triage ticket.
On $DEVSEC_LAB, write ZAP row — step, tool mode, scope rule for one fictional lab app.
Command guide
Try these commands — ZAP workflow steps (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: Aqua Trivy (https://aquasecurity.github.io/trivy/); Trivy misconfig (https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why ZAP literacy prevents scope creep
Unscoped spider follows external links to third-party sites — unauthorized DAST. Context regex limits protect you and others. Lab ZAP runs practice scope discipline before production CI integration.
Students document lab ZAP context on notes — production ZAP follows app ownership and maintenance windows.
3. Lab boundary
Forbidden: ZAP active scan against stranger URLs or cloud apps you do not own. Allowed: ZAP literacy card — workflow with $DEVSEC_LAB lab URL context only.
Ship: ZAP literacy card for YOUR lab app. Next: When to Scan.
4. What you ship: ZAP literacy card for $DEVSEC_LAB
Context scope, spider, passive, active steps. $DEVSEC_LAB lab URL. chmod 600.
5. What you record before the next lesson
Date. ZAP literacy card. $DEVSEC_LAB named. File t36-m05-l02-zap-literacy.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run ZAP without context limits on public site. Enable active scan against stranger API.
- Right: Write ZAP literacy card for YOUR $DEVSEC_LAB lab URL. Next: When to Scan.
Mission: map ZAP workflow on YOUR lab URL
1) Define context include/exclude for lab URL. 2) List spider, passive, active order. 3) Confirm zero stranger URLs in scope. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Set ZAP context before spider — scope creep is an ethics failure.
APPLY: ZAP context primarily:
APPLY: True or False: Passive ZAP scan analyzes traffic without sending attack payloads.
APPLY: ZAP literacy on Cyberlium uses: