Lion Cipher Lab
Turn a ZAP scan report into a prioritized fix list (severity, exploitability, false positives)
- AppSec / DevSecOps
- Intermediate
- ~35 min
- Free · no account required
Why it matters
A scanner is easy to run and easy to misuse. Point OWASP ZAP — a DAST tool, meaning a Dynamic Application Security Testing scanner that probes a running app from the outside — at a site and it spits out a wall of alerts, each stamped with a scary-looking risk. The rookie move is to export that list and hand it to developers as a to-do list. Half of it is noise, some of it is flat-out wrong, and the one finding that could actually get you breached is buried three screens down. The skill that separates an appsec engineer from a scan-button operator is triage: reading each alert's evidence,…
What you'll learn
- reading a ZAP alert: name, risk, confidence, evidence, CWE/WASC references
- separating RISK (how bad if real) from CONFIDENCE (how sure the tool is)
- validating a finding from its evidence instead of trusting the label
- spotting a scanner false positive (a reflected value that's actually encoded)
- weighing contextual risk — a Medium on login can outrank a High on a static asset
- producing a triaged, prioritized remediation list with a reason per item
- judgment: when a DAST report is trustworthy and when it needs manual confirmation
Steps in this lab
- What you're holding: how to read a single ZAP alert
- Why RISK and CONFIDENCE are two different axes
- The report — read it once, top to bottom, before classifying
- Finding [A] — the genuine High: validate it, then act
- Finding [B] — the false positive: the evidence contradicts the label
- Finding [C] — a real Medium that context deflates
- Findings [D], [E], [F] — the long tail: housekeeping, hardening, and pure noise
- Produce the deliverable: a prioritized fix list with a reason each
- The judgment to keep: when to trust a DAST report, and when not to