Secure › Module 8 › Lesson 2
Lab-Only DAST
Scope file, rate limits, and RoE before any dynamic scan — YOUR $LAB_URL only.
Visual · t17_lab_only_dast
DAST without scope is a vulnerability scan on someone else's bill. Original Cyberlium.
Opening
Active scan on production you do not own is not 'shift left' — it is out of bounds.
Before DAST: write RoE with exact $LAB_URL (localhost:port or lab subdomain you control), scan window, authenticated test account creds disposable, excluded paths, and stop conditions. Use passive or baseline modes first; active scan only on disposable lab deploy. Throttle requests — do not DOS your lab or anyone else's. Never add classmate URLs, bug bounty targets without enrollment, or employer staging without ticket. Defenders run DAST in pre-prod pipelines they own.
1. RoE fields
URL, owner, date, scan type, creds source, max duration, emergency stop contact (you).
Include statement: no production stranger targets.
Command guide
Try these commands — RoE fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SSRF prevention — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html DAST scope — https://owasp.org/www-project-web-security-testing-guide/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t17-lab.env" 2>/dev/null
curl -sS -m 2 -o /dev/null -w 'toy GET %{http_code}
' "${TOY_APP:-http://127.0.0.1:8820}/" || echo 'Start YOUR toy first'
curl -sS -m 2 -o /dev/null -w 'loopback SSRF literacy %{http_code}
' http://127.0.0.1/ || true═══ WINDOWS ═══
Command — copy this
try { (Invoke-WebRequest http://127.0.0.1:8820/ -TimeoutSec 2).StatusCode } catch { 'Start YOUR toy on 127.0.0.1:8820' }Primary tools to practice this lesson: curl. Reference sites: SSRF prevention (https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html); DAST scope (https://owasp.org/www-project-web-security-testing-guide/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Safe modes
Spider limited to scope; exclude logout and destructive routes in lab config.
Use test data — no real user PII in lab DB.
3. Pipeline fit
Nightly DAST against $LAB_URL deploy from CI artifact — isolated network.
Findings feed same triage workflow as SAST — fix in $REPO.
4. What you ship: DAST RoE template
RoE fields list + baseline-first rule + NEVER stranger URL line.
5. What you record before the next lesson
DAST RoE template path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Active-scan a competitor marketing site 'for comparison.'
Right
RoE before DAST. Next: dependencies.
Mission: DAST RoE draft
1) Fill RoE for your $LAB_URL. 2) Name baseline vs active scan. 3) Write NEVER stranger production DAST.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Exclude URLs in ZAP context?”
Knowledge Check
APPLY: DAST RoE must pin:
Multiple choice
Knowledge Check
APPLY: True or False: Active scan on employer prod without ticket is lab.
True or False
Knowledge Check
APPLY: Baseline scan is:
Multiple choice