Lion Cipher Lab
Scan your local web app for vulnerabilities with OWASP ZAP
- AppSec / DevSecOps
- Beginner
- ~40 min
- Free · no account required
Why it matters
Almost every web-security workflow eventually reaches for a dynamic application security testing (DAST) tool — a scanner that pokes at a running app from the outside the way an attacker would — and OWASP ZAP is the free, open-source one the field learns on. Knowing what a scanner does, how to run it against a target you are authorized to test, and above all how to read its output turns a wall of findings into something you can actually act on. That last skill matters most: a scanner produces alerts, not verdicts, and learning to weigh an alert by its risk and confidence and to recognize the…
What you'll learn
- what a DAST scanner does
- running OWASP ZAP (desktop and Docker)
- spider + passive scanning a web app
- reading alerts by risk and confidence
- mapping findings to CWE and the OWASP Top 10
- authorized-testing discipline
Steps in this lab
- The one rule, before you scan anything
- What a DAST scanner is, and what ZAP does
- Confirm your target is up
- Route A - ZAP Desktop: run an Automated Scan
- Route B - ZAP in Docker: a passive baseline scan
- Read the alerts: risk and confidence
- Map a finding to CWE and the OWASP Top 10
- What you just learned - and how to carry it