DAST Deps Lab
Baseline DAST on $LAB_URL + dependency audit fix on $REPO — RoE and lockfile evidence.
Visual · t17_dast_deps_lab
Lab: DAST baseline + deps on YOUR assets. Original Cyberlium.
One baseline scan and one lockfile bump — both on assets you own.
Combine module skills on YOUR assets: (1) run ZAP baseline (or equivalent) against $LAB_URL from RoE; save redacted summary; (2) run dependency audit on $REPO and fix or document one CVE with test note; (3) store evidence chmod 600 in $HOME/cyberlium-lab. No active scan on unauthorized hosts, no committing exploit payloads, no dependency 'research' on repos outside $REPO.
1. DAST baseline
Command and scope URL recorded. Top 3 findings summarized with severity.
Note false positives (e.g., missing header on static dev server).
Command guide
Try these commands — DAST baseline
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
pip-audit — https://pypi.org/project/pip-audit/
OWASP dependency — https://owasp.org/www-project-dependency-check/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t17-deps-notes.txt" <<'EOF' dast: only 127.0.0.1 toy deps: npm audit / pip-audit on MY_REPO never: zap strangers EOF
Command — copy this
grep never "$HOME/cyberlium-lab/t17-deps-notes.txt" curl -sS -I -m 2 http://127.0.0.1:8820/ 2>/dev/null | head -5 || echo 'Optional: start toy for DAST literacy'
Primary tools to practice this lesson: grep, curl. Reference sites: pip-audit (https://pypi.org/project/pip-audit/); OWASP dependency (https://owasp.org/www-project-dependency-check/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Dependency fix
Before/after audit counts. Commit hash or patch plan for one update.
If no fix available — document compensating control and monitor advisory.
3. Teardown
Stop lab app scanner contexts. Do not leave ZAP proxy intercepting system traffic.
Secure notes chmod 600.
4. What you ship: DAST + deps lab pack
Baseline summary + audit fix evidence + RoE reference — chmod 600.
5. What you record before the next lesson
DAST deps lab notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Baseline-scan a public government site without authorization.
- Right: DAST + deps on YOUR lab. Next: quiz.
Mission: DAST and deps lab
1) Baseline DAST $LAB_URL per RoE. 2) Fix or defer one CVE in $REPO. 3) Secure combined notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Dev server header gaps OK?”
APPLY: DAST deps lab uses:
APPLY: True or False: Unauthorized DAST is course credit.
APPLY: After dependency fix: