DevSecOps › Module 5 › Lesson 4
Lab — DAST
Pack DAST named, ZAP literacy, and when-to-scan cards — DAST file from $DEVSEC_LAB only.
Visual · t36_dast_lab
Lab: DAST literacy pack. $DEVSEC_LAB only. Original Cyberlium.
Opening
DAST pack merges anatomy to ZAP to schedule — paperwork before IaC module.
Lessons 5-1–5-3 named DAST, ZAP workflow, and when to scan. This lab merges three sections into one $DEVSEC_LAB DAST artifact with M1 ethics and M4 SAST cross-references. No third-party URL scans or stranger org targets — DAST literacy paperwork only; ZAP runs against YOUR lab URL when you execute locally. Next: Quiz — DAST Literacy.
1. Lab contract: DAST literacy pack
Create $HOME/cyberlium-lab/t36-m05-l04-dast-lab.txt merging DAST named, ZAP literacy, and when-to-scan sections with $DEVSEC_LAB lab URL and M1/M4 cross-references.
Optional: note lab URL from M1 repo inventory — still YOUR URL only for any ZAP execution.
Command guide
Try these commands — Lab contract: DAST literacy pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Aqua Trivy — https://aquasecurity.github.io/trivy/ NIST SSDF RV.1 — https://csrc.nist.gov/Projects/ssdf CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu): Install from https://aquasecurity.github.io/trivy/
macOS:
Command — copy this
brew install trivy
Windows: Download Trivy releases / use WSL
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/container-scan-lab-summary.md" <<'EOF'
# Container Scan Lab Summary — YOUR lab
- Dockerfile: alpine:3.14 stub — expect CVE findings on old tag
- trivy fs container/ — IaC + Dockerfile misconfigs
- trivy image cyberlium-lab:dev — optional after docker build
## Remediation literacy
- Pin newer base image; run as non-root USER; minimal packages
## Refusals
- No scanning stranger container registries
EOFCommand — copy this
grep -E 'trivy|Remediation|Refusals' "$DEVSEC_LAB/notes/container-scan-lab-summary.md" ls -la "$DEVSEC_CONTAINER/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/container/Dockerfile | Select-String MISCONFIG Get-Content $HOME/cyberlium-lab/t36-devsec/notes/trivy-named.txt | Select-String trivy
Primary tools to practice this lesson: grep, trivy. Reference sites: Aqua Trivy (https://aquasecurity.github.io/trivy/); NIST SSDF RV.1 (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for stranger production URLs, third-party API targets, live credential auth — remove. Confirm all DAST targets are $DEVSEC_LAB lab URLs.
ZAP scope uses include/exclude for lab domain only — no open internet scans.
3. Lock the proof
chmod 600 on the pack. Quiz next — then IaC Threats.
DAST literacy feeds IaC security lessons in M6.
4. What you ship: DAST literacy pack for $DEVSEC_LAB
Merged DAST, ZAP, schedule sections. $DEVSEC_LAB lab URL. NO stranger URLs. chmod 600.
5. What you record before the next lesson
Date. DAST pack path. $DEVSEC_LAB named. File t36-m05-l04-dast-lab.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include stranger production URL in ZAP scope. Skip when-to-scan section.
Right
Write YOUR DAST literacy pack for $DEVSEC_LAB. chmod 600. Next: Quiz — DAST Literacy.
Mission: freeze YOUR DAST literacy pack on disk
1) Merge M5 literacy sections. 2) Confirm lab URL targets only. 3) Link M1/M4 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed DAST pack beats scanning stranger production without scope.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: ZAP active scan on Cyberlium stays within YOUR lab URL context.
True or False
Knowledge Check
APPLY: DAST pack supports:
Multiple choice