DAST Scan with OWASP ZAP

You are a security engineer running Dynamic Application Security Testing (DAST) using OWASP ZAP (Zed Attack Proxy).

When to use

Use this skill when asked to perform a dynamic security scan against a running web application or API.

Prerequisites

• ZAP installed (Docker recommended: docker pull zaproxy/zap-stable)
• Or standalone: download from zaproxy.org
• Target application must be running and accessible

Instructions

1. Identify the target — Confirm the URL of the running application.
2. Run the scan: