DevSecOps › Module 5 › Lesson 2
ZAP Literacy
ZAP literacy names spider, passive scan, active scan, context, and scope — map OWASP ZAP workflow on YOUR $DEVSEC_LAB URL before CI integration.
Visual · t36_zap_literacy
ZAP literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
OWASP ZAP is the reference DAST learner — literacy teaches ZAP modes and scope so scans stay on YOUR lab URL, not the open internet.
OWASP ZAP workflows start with context — YOUR lab URL in scope, everything else excluded. Spider discovers links within scope. Passive scan observes traffic without attack payloads. Active scan sends probes — only on YOUR lab app you authorized. CI uses ZAP baseline or full scan Action against lab deploy URL from $DEVSEC_LAB inventory. Cyberlium maps ZAP workflow on YOUR $DEVSEC_LAB — write ZAP row for context, spider, passive, active steps on one fictional lab app. Next: When to Scan.
1. ZAP workflow steps (named)
Context: include https://lab.example.local/*, exclude all other domains on YOUR lab. Spider: crawl in-scope links only. Passive: analyze responses without attacks. Active: run attack rules within scope on YOUR lab URL. Report: export HTML/JSON for triage ticket.
On $DEVSEC_LAB, write ZAP row — step, tool mode, scope rule for one fictional lab app.
Command guide
Try these commands — ZAP workflow steps (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Aqua Trivy — https://aquasecurity.github.io/trivy/ Trivy misconfig — https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/ CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_CONTAINER=${DEVSEC_CONTAINER:-$DEVSEC_LAB/container}
cat > "$DEVSEC_CONTAINER/Dockerfile" <<'EOF'
# YOUR lab Dockerfile stub — intentional issues for trivy literacy
FROM alpine:3.14
RUN apk add --no-cache curl
# MISCONFIG: running as root (trivy may flag DS002)
WORKDIR /app
COPY app.sh /app/
RUN chmod +x /app/app.sh
EXPOSE 8080
CMD ["/app/app.sh"]
EOFCommand — copy this
cat > "$DEVSEC_CONTAINER/app.sh" <<'EOF' #!/bin/sh echo 'Cyberlium DevSec lab app — bind YOUR localhost:8080 only' while true; do echo -e 'HTTP/1.1 200 OK\r \r DevSec lab OK' | nc -l -p 8080; done EOF
Command — copy this
chmod +x "$DEVSEC_CONTAINER/app.sh"
grep -E 'MISCONFIG|alpine|8080' "$DEVSEC_CONTAINER/Dockerfile"
python3 -c "print('Dockerfile stub: old base image + root — trivy fs/image targets')"Primary tools to practice this lesson: grep, python3. Reference sites: Aqua Trivy (https://aquasecurity.github.io/trivy/); Trivy misconfig (https://aquasecurity.github.io/trivy/latest/docs/scanner/misconfiguration/); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why ZAP literacy prevents scope creep
Unscoped spider follows external links to third-party sites — unauthorized DAST. Context regex limits protect you and others. Lab ZAP runs practice scope discipline before production CI integration.
Students document lab ZAP context on notes — production ZAP follows app ownership and maintenance windows.
3. Lab boundary
Forbidden: ZAP active scan against stranger URLs or cloud apps you do not own. Allowed: ZAP literacy card — workflow with $DEVSEC_LAB lab URL context only.
Ship: ZAP literacy card for YOUR lab app. Next: When to Scan.
4. What you ship: ZAP literacy card for $DEVSEC_LAB
Context scope, spider, passive, active steps. $DEVSEC_LAB lab URL. chmod 600.
5. What you record before the next lesson
Date. ZAP literacy card. $DEVSEC_LAB named. File t36-m05-l02-zap-literacy.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run ZAP without context limits on public site. Enable active scan against stranger API.
Right
Write ZAP literacy card for YOUR $DEVSEC_LAB lab URL. Next: When to Scan.
Mission: map ZAP workflow on YOUR lab URL
1) Define context include/exclude for lab URL. 2) List spider, passive, active order. 3) Confirm zero stranger URLs in scope. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Set ZAP context before spider — scope creep is an ethics failure.
Knowledge Check
APPLY: ZAP context primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Passive ZAP scan analyzes traffic without sending attack payloads.
True or False
Knowledge Check
APPLY: ZAP literacy on Cyberlium uses:
Multiple choice