OWASP ZAP (Zed Attack Proxy)

Include ZAP Docker image in Jenkins/GitHub Actions workflow.

Pass the ZAP Automation Framework YAML file to the container.

Execute an authenticated baseline scan on the staging build.

Fail the build if any 'High' severity alerts are detected.

Upload the JSON report to a vulnerability management platform like DefectDojo.

Import the target OpenAPI/Swagger definition URL into ZAP.

Use the API scan script to map all available endpoints.

Inject payloads into request headers and body parameters.

Analyze responses for unauthorized data exposure.

Verify rate limiting and input validation for all API methods.

Launch the ZAP AJAX Spider using a Selenium-controlled browser.

Monitor the 'Sites' tree as the spider interacts with DOM elements.

Capture dynamic URLs and state changes generated by frontend routing.

Pass the discovered dynamic URLs to the Active Scanner.

Verify if client-side logic is bypassing server-side security.

Intercept a checkout request using the ZAP Break Point.

Modify the 'price' or 'quantity' parameter in the ZAP Request tab.

Submit the modified request to the server.

Observe the server's response for lack of server-side validation.

Document the exploit using ZAP's internal request/response logging.

Run a passive scan to check for missing security headers (HSTS, CSP).

Verify SSL/TLS configuration using the built-in certificate inspector.

Check for clear-text sensitive data transmission in request bodies.

Generate a Markdown report specifically focusing on compliance-related alerts.

Present the report to auditors as evidence of regular security testing.

Enable the 'Retire.js' add-on from the ZAP Marketplace.

Browse the site while ZAP passively inspects loaded JS files.

Check the 'Alerts' tab for 'Insecure JS Library' findings.

Review the CVE details provided by the Retire.js integration.

Remediate by updating the library to a patched version.

Provide the GraphQL endpoint URL to the ZAP GraphQL add-on.

Perform introspection to discover the full schema.

Generate automated queries based on the schema types.

Fuzz the query arguments for injection points.

Analyze the responses for excessive data disclosure (IDOR).