skills.rest
BagelHole
BagelHoleCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

46|4|Updated Jan 27, 2026
Search Tags:#security scanning#api security#web application security#dast#nikto#owasp zap#burp suite
One-click install
npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill dast-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dast-scanning
Source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/scanning/dast-scanning
Command: npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill dast-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of finding security vulnerabilities in live web applications and APIs, helping to secure your deployed software.

Core Features & Use Cases

  • Automated Vulnerability Scanning: Utilizes tools like OWASP ZAP, Burp Suite, and Nikto to discover common web security flaws.
  • API Security Testing: Scans APIs based on specifications like OpenAPI.
  • CI/CD Integration: Provides examples for integrating scans into GitHub Actions and GitLab CI pipelines.
  • Use Case: You've just deployed a new version of your web application to a staging environment. Use this Skill to perform a dynamic scan and identify any newly introduced security weaknesses before they reach production.

Quick Start

Run a baseline OWASP ZAP scan against https://target.example.com.

Frequently Asked Questions about dast-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform dynamic application security testing on a running web app?▼

Dynamic application security testing (DAST) scans live web applications and APIs using tools like OWASP ZAP, Burp Suite, and Nikto to identify runtime vulnerabilities and test authentication flows.

Can I automate API security testing within my CI/CD pipeline?▼

Yes, API security testing can be automated within CI/CD pipelines like GitHub Actions and GitLab CI to perform dynamic scans and validate API security against specifications like OpenAPI.

When do I need to run a DAST scan instead of static code analysis?▼

You need DAST scanning when you want to discover runtime vulnerabilities in live web applications and APIs, test authentication flows, and validate deployed security rather than reviewing source code.

What's the best way to scan my staging environment for newly introduced vulnerabilities?▼

The best way to scan a staging environment is running an automated DAST scan using OWASP ZAP, Burp Suite, or Nikto to identify newly introduced security weaknesses before they reach production.

Does DAST scanning work with OpenAPI specifications for API security validation?▼

Yes, DAST scanning works with OpenAPI specifications to perform targeted API security testing, validating endpoints and authentication flows to uncover runtime vulnerabilities.

Do I need a running application to use OWASP ZAP and Nikto for vulnerability scanning?▼

Yes, OWASP ZAP, Burp Suite, and Nikto require a running web application or API endpoint to perform DAST scanning, as they test runtime behavior and authentication flows dynamically.

Related Skills

Explore More Software Engineering Skills→
sheriaxsheriax

clerk-backend-api

Manage Clerk resources via the Backend REST API with OpenAPI validation.

Official
Intermediate
HelloEverybobyHelloEveryboby
17

SDLCOrchestrator

Automate SAST, DAST, and SCA security scans in CI/CD pipelines.

Community
Intermediate
bugrabilgebugrabilge
10

vulnerability-scanner

Detect security vulnerabilities in code, running apps, and dependencies.

Community
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced