DevSecOps › Module 5 › Lesson 1
DAST Named
DAST named literacy covers dynamic scanning triggers, crawl scope, authentication modes, and findings categories — read DAST anatomy for YOUR $DEVSEC_LAB URL before running ZAP.
Visual · t36_dast_named
DAST named literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
DAST exercises running apps — literacy teaches dynamic scan vocabulary so ZAP targets YOUR lab URL only, never stranger production sites.
DAST — Dynamic Application Security Testing — probes a running web app for XSS, SQLi, misconfigurations, and exposed endpoints by sending crafted requests. Unlike SAST, DAST needs a live target — on Cyberlium that target is YOUR authorized lab URL under $DEVSEC_LAB, not third-party production domains. CI triggers DAST post-deploy to staging lab or scheduled against localhost tunnel you control. Cyberlium outlines DAST anatomy on YOUR $DEVSEC_LAB — write DAST row for target URL, scan mode, severity gate on one fictional lab app. Next: ZAP Literacy.
1. DAST components (named)
Target: YOUR lab URL only — e.g., https://lab.example.local/app on $DEVSEC_LAB. Mode: baseline passive vs active scan with scope limits. Auth: test account on YOUR lab app, never prod user creds. Output: HTML/JSON report with CWE-mapped findings for triage.
On $DEVSEC_LAB, write DAST row — lab URL, scan mode, severity gate for one fictional web app.
Command guide
Try these commands — DAST components (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: curl, grep. Reference sites: Aqua Trivy (https://aquasecurity.github.io/trivy/); Trivy fs (https://aquasecurity.github.io/trivy/latest/docs/target/filesystem/); Trivy image (https://aquasecurity.github.io/trivy/latest/docs/target/container_image/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why DAST literacy requires URL scope discipline
Active DAST sends attack payloads — legal and ethical only against apps you own. Stranger production URLs cause unauthorized testing incidents. Lab URL scope documentation precedes every ZAP run.
Students draft lab DAST notes — production DAST follows change windows and written authorization.
3. Lab boundary
Forbidden: pointing DAST at stranger production or staging URLs. Allowed: DAST named card — skeleton with $DEVSEC_LAB lab URL and scope limits.
Ship: DAST named card for YOUR lab app URL. Next: ZAP Literacy.
4. What you ship: DAST named card for $DEVSEC_LAB
Lab URL, scan mode, severity gate, scope limit. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. DAST named card. $DEVSEC_LAB named. File t36-m05-l01-dast-named.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run active DAST against stranger e-commerce site. Skip scope limits because 'ZAP defaults are fine.'
Right
Write DAST named card for YOUR $DEVSEC_LAB lab URL. Next: ZAP Literacy.
Mission: draft DAST scope on YOUR lab URL
1) Name YOUR authorized lab URL. 2) Define passive vs active mode. 3) Write scope limit and severity gate. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
DAST target = YOUR lab URL — stranger sites stay off the scan list.
Knowledge Check
APPLY: DAST on Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: Active DAST sends attack payloads and requires apps you own.
True or False
Knowledge Check
APPLY: DAST named literacy on Cyberlium uses:
Multiple choice