DevSecOps › Module 5 › Lesson 1
DAST Named
DAST named literacy covers dynamic scanning triggers, crawl scope, authentication modes, and findings categories — read DAST anatomy for YOUR $DEVSEC_LAB URL before running ZAP.
Visual · t36_dast_named
DAST named literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
DAST exercises running apps — literacy teaches dynamic scan vocabulary so ZAP targets YOUR lab URL only, never stranger production sites.
DAST — Dynamic Application Security Testing — probes a running web app for XSS, SQLi, misconfigurations, and exposed endpoints by sending crafted requests. Unlike SAST, DAST needs a live target — on Cyberlium that target is YOUR authorized lab URL under $DEVSEC_LAB, not third-party production domains. CI triggers DAST post-deploy to staging lab or scheduled against localhost tunnel you control. Cyberlium outlines DAST anatomy on YOUR $DEVSEC_LAB — write DAST row for target URL, scan mode, severity gate on one fictional lab app. Next: ZAP Literacy.
1. DAST components (named)
Target: YOUR lab URL only — e.g., https://lab.example.local/app on $DEVSEC_LAB. Mode: baseline passive vs active scan with scope limits. Auth: test account on YOUR lab app, never prod user creds. Output: HTML/JSON report with CWE-mapped findings for triage.
On $DEVSEC_LAB, write DAST row — lab URL, scan mode, severity gate for one fictional web app.
Command guide
Try these commands — DAST components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Aqua Trivy — https://aquasecurity.github.io/trivy/ Trivy fs — https://aquasecurity.github.io/trivy/latest/docs/target/filesystem/ Trivy image — https://aquasecurity.github.io/trivy/latest/docs/target/container_image/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://aquasecurity.github.io/trivy/ | head -10
cat > "$DEVSEC_LAB/notes/trivy-named.txt" <<'EOF'
Trivy — NAMED LITERACY:
trivy fs PATH — scan filesystem (IaC misconfigs, vuln deps, secrets)
trivy image IMAGE — scan container image OS + app CVEs
Severity: CRITICAL HIGH MEDIUM LOW UNKNOWN
CI gate: exit-code 1 on CRITICAL/HIGH per org policy
Lab: YOUR Dockerfile stub in container/ — build optional, scan fs always
EOFCommand — copy this
grep -E 'trivy fs|trivy image|YOUR' "$DEVSEC_LAB/notes/trivy-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: Aqua Trivy (https://aquasecurity.github.io/trivy/); Trivy fs (https://aquasecurity.github.io/trivy/latest/docs/target/filesystem/); Trivy image (https://aquasecurity.github.io/trivy/latest/docs/target/container_image/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why DAST literacy requires URL scope discipline
Active DAST sends attack payloads — legal and ethical only against apps you own. Stranger production URLs cause unauthorized testing incidents. Lab URL scope documentation precedes every ZAP run.
Students draft lab DAST notes — production DAST follows change windows and written authorization.
3. Lab boundary
Forbidden: pointing DAST at stranger production or staging URLs. Allowed: DAST named card — skeleton with $DEVSEC_LAB lab URL and scope limits.
Ship: DAST named card for YOUR lab app URL. Next: ZAP Literacy.
4. What you ship: DAST named card for $DEVSEC_LAB
Lab URL, scan mode, severity gate, scope limit. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. DAST named card. $DEVSEC_LAB named. File t36-m05-l01-dast-named.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run active DAST against stranger e-commerce site. Skip scope limits because 'ZAP defaults are fine.'
Right
Write DAST named card for YOUR $DEVSEC_LAB lab URL. Next: ZAP Literacy.
Mission: draft DAST scope on YOUR lab URL
1) Name YOUR authorized lab URL. 2) Define passive vs active mode. 3) Write scope limit and severity gate. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
DAST target = YOUR lab URL — stranger sites stay off the scan list.
Knowledge Check
APPLY: DAST on Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: Active DAST sends attack payloads and requires apps you own.
True or False
Knowledge Check
APPLY: DAST named literacy on Cyberlium uses:
Multiple choice