dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

46|4|Updated Jan 27, 2026

Search Tags:#security scanning #api security #web application security #dast #nikto #owasp zap #burp suite

Ready to run

npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill dast-scanning

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dast-scanning
Source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/scanning/dast-scanning
Command: npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill dast-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of finding security vulnerabilities in live web applications and APIs, helping to secure your deployed software.

Core Features & Use Cases

Automated Vulnerability Scanning: Utilizes tools like OWASP ZAP, Burp Suite, and Nikto to discover common web security flaws.
API Security Testing: Scans APIs based on specifications like OpenAPI.
CI/CD Integration: Provides examples for integrating scans into GitHub Actions and GitLab CI pipelines.
Use Case: You've just deployed a new version of your web application to a staging environment. Use this Skill to perform a dynamic scan and identify any newly introduced security weaknesses before they reach production.

Quick Start

Run a baseline OWASP ZAP scan against https://target.example.com.

Frequently Asked Questions about dast-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform dynamic application security testing on a running web app?▼

Dynamic application security testing (DAST) scans live web applications and APIs using tools like OWASP ZAP, Burp Suite, and Nikto to identify runtime vulnerabilities and test authentication flows.

Can I automate API security testing within my CI/CD pipeline?▼

Yes, API security testing can be automated within CI/CD pipelines like GitHub Actions and GitLab CI to perform dynamic scans and validate API security against specifications like OpenAPI.

When do I need to run a DAST scan instead of static code analysis?▼

You need DAST scanning when you want to discover runtime vulnerabilities in live web applications and APIs, test authentication flows, and validate deployed security rather than reviewing source code.

What's the best way to scan my staging environment for newly introduced vulnerabilities?▼

The best way to scan a staging environment is running an automated DAST scan using OWASP ZAP, Burp Suite, or Nikto to identify newly introduced security weaknesses before they reach production.

Does DAST scanning work with OpenAPI specifications for API security validation?▼

Yes, DAST scanning works with OpenAPI specifications to perform targeted API security testing, validating endpoints and authentication flows to uncover runtime vulnerabilities.

Do I need a running application to use OWASP ZAP and Nikto for vulnerability scanning?▼

Yes, OWASP ZAP, Burp Suite, and Nikto require a running web application or API endpoint to perform DAST scanning, as they test runtime behavior and authentication flows dynamically.