What is the difference between DAST and SAST?

DAST tests a running application from the outside, as an attacker would. SAST analyzes source code without running it. They find different problems, so many teams use both.

Can I scan a site I do not own as practice?

No. Only scan systems you own or have explicit written permission to test. Use intentionally vulnerable practice applications or authorized platforms instead.

Automated Security Testing with OWASP ZAP Against a Local Practice App

Introduction

Dynamic application security testing, DAST, probes a running application the way an attacker would. ZAP, the open-source Zed Attack Proxy from Checkmarx, is the most popular free tool for it. In this lesson you run ZAP against OWASP Juice Shop, a deliberately vulnerable application, on an isolated Docker network, so you practice legally and safely.

Prerequisites

Docker installed
The Docker networking lesson from the DevOps track is helpful

Step-by-Step Guide

Step 1: Only test what you are allowed to test

Scanning a system you do not own or have written permission to test can be illegal, and active scans can damage the target. Practice only on your own machines and on applications built for the purpose. Juice Shop is intentionally insecure and meant for one user at a time, so never expose it to the internet or a shared network. Automated attacks can also crash it, which is acceptable in a throwaway lab.

Step 2: Start Juice Shop on a private Docker network

Create a user-defined network and start Juice Shop on it without publishing any port to your host, so nothing outside your Docker network can reach it. Other containers on the same network can use the container name as the host name. If you want to browse it yourself, run a second copy bound to the loopback address only, for example with the publish option 127.0.0.1:3000:3000.

docker network create zap-lab
docker run -d --name juice --network zap-lab bkimminich/juice-shop

Step 3: Run the ZAP baseline scan

The baseline scan spiders the site for a short time and then waits for passive scanning to finish. It performs no active attacks, which is why it is considered safe to use in CI, even against production sites you own. Mount a folder so the report is saved to your machine. On Windows PowerShell, use the PWD variable in place of the dollar-parenthesis pwd form.

docker run --rm --network zap-lab \
  -v "$(pwd)":/zap/wrk/:rw \
  -t ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t http://juice:3000 -r zap-report.html

Step 4: Read the results and exit codes

Open zap-report.html and review each alert, its risk level, the evidence, and the suggested fix. Scripts exit with 0 for success, 1 if any check is a failure, 2 if there are warnings and no failures, and 3 for other errors. By default every alert is a warning, so a scan that finds issues exits with 2. Use the configuration options to promote chosen rules to failures or ignore known false positives, so the exit code reflects your policy.

Step 5: Know the other scan types and add it to CI

The full scan adds an active scan that really attacks the application and can run for a long time, so run it only against test environments you own. The API scan imports an OpenAPI, SOAP, or GraphQL definition and scans the API. In a pipeline, run the baseline scan against a deployed test environment on every change, save the report as an artifact, and fail the build on high-risk findings. Automated scans find only a portion of problems, so they complement code review, penetration testing, and secure design.

Step 6: Clean up

Remove the practice containers and network when you finish so a vulnerable application is not left running.

docker rm -f juice
docker network rm zap-lab

FAQs

What is the difference between DAST and SAST?: DAST tests a running application from the outside, as an attacker would. SAST analyzes source code without running it. They find different problems, so many teams use both.
Can I scan a site I do not own as practice?: No. Only scan systems you own or have explicit written permission to test. Use intentionally vulnerable practice applications or authorized platforms instead.

Summary

Run Juice Shop on a private Docker network, scan it with ZAP's safe baseline scan, read the report and exit codes, and reserve active full scans for test systems you own. Always have permission before scanning anything.