DAST: Scanning a Running Application with ZAP — Baseline, API Scan and Authenticated Scanning
DAST sends requests to the running application from outside and finds behavioral flaws such as headers, cookies, error leaks and reflected input; but it only scans the endpoints it can reach and cannot see authorization bugs. We scan Bookstore.Api with ZAP 2.17 using baseline, API scan and an Automation Framework plan, and show with real output how to catch a dropped session in a token-based scan, turn findings into integration tests and run DAST on main.
14 Nov 2026
·
15 min
·
7
