Lion Cipher Lab
Run a guided ZAP active scan and triage the findings
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A scanner is easy to run and hard to trust. Point OWASP ZAP at an app and it produces a wall of alerts — some are genuine, exploitable holes, and some are false positives the tool guessed wrong about. The skill that actually matters in web testing is not clicking "scan"; it is triage: deciding, alert by alert, which findings are real. That means running the active scan — ZAP's real-attack mode — deliberately and only against a target you are allowed to attack, then confirming a finding by reproducing it yourself and dismissing a false positive after testing it, exactly as the OWASP Web…
What you'll learn
- passive vs active scanning
- scoping an active scan with a ZAP Context
- running a deliberate active scan against an owned target
- triaging alerts: confirming a true positive
- dismissing and recording a false positive
- manual verification against OWASP WSTG
- authorized-testing discipline
Steps in this lab
- Where this fits, and the one rule that gets sharper here
- Passive vs active, and what "triage" actually means
- Get the target and a passive baseline up first
- Scope it: make the active scan unable to touch anything but your target
- Run the active scan — deliberately
- Triage 1 - confirm a true positive by hand
- Triage 2 - dismiss a false positive, and record it
- What you just did - and the instinct to keep