Run dynamic security scans on live web applications using Nuclei and OWASP ZAP.
npx skills add https://github.com/camgrimsec/grimsec-suite --skill dast-scanner
Please help me install this Agent Skill. Skill: dast-scanner Source: https://github.com/camgrimsec/grimsec-suite/tree/main/agents/07-dast-scanner Command: npx skills add https://github.com/camgrimsec/grimsec-suite --skill dast-scanner
This Skill addresses the challenge of identifying exploitable vulnerabilities in running web applications without source code access, reducing noise from static scans by focusing on dynamic, black-box testing to uncover real-world risks like SQL injection and XSS.
Run a full DAST scan on the live application at https://example-app.com including Nuclei for exposures and ZAP for active testing.
High-intent search queries and answers about installing and using this skill.
Dynamic application security testing on live web apps is performed by executing Nuclei for rapid exposure checks and OWASP ZAP for active spidering and injection attacks to detect runtime vulnerabilities like SQL injection and XSS.
Validating OWASP Top 10 vulnerabilities against Docker-hosted services uses ZAP to perform API-aware scanning and passive header analysis, mapping findings to CWEs and generating unified markdown reports with remediation guidance.
Yes, you can combine Nuclei templates and OWASP ZAP in a DevSecOps pipeline to deduplicate findings, correlate results from both tools, and produce a unified security report ready for a pull request.
Black-box scanning does not require source code access; it dynamically tests running web applications to identify exploitable vulnerabilities and reduces noise from static scans by focusing on real-world runtime risks.
Detecting CVEs and misconfigurations in deployed web applications uses Nuclei's rapid template-based scanning tailored to the app's tech stack to quickly identify exposures and security issues.
DAST focuses on runtime black-box testing of running web applications, meaning it validates live URLs and Docker-hosted services but does not analyze source code or detect non-runtime vulnerabilities without deployed endpoints.
manutejOrchestrate multi-container deployments with Docker Compose configurations.
jpoleyClassify security findings with OWASP, CWE, and CVSS v3.1 scoring.
Logos-LiberIdentifies security vulnerabilities in code, dependencies, and container images.
djankiesDetect security vulnerabilities in JavaScript/TypeScript codebases with Semgrep and pattern checks.
