mcpField
D
dast-scanning

dast-scanning

github.com/bagelhole安全1.2k368 次安装23 周前更新
代码仓库

关于 dast-scanning

dast-scanning 是一项动态应用安全测试技能，面向测试已运行 Web 应用和 API 的团队。它提供 OWASP ZAP 等工具的扫描、认证配置、自动化及 CI/CD 示例。

主要功能

  1. 01扫描运行中的应用
  2. 02支持认证流程测试
  3. 03使用 OpenAPI 规范扫描 API
  4. 04自动化扫描并生成报告
  5. 05集成 GitHub Actions 与 GitLab CI

适用场景

  1. 01测试已部署的应用
  2. 02在暂存环境执行定期扫描
  3. 03验证 API 安全与认证流程
  4. 04将 DAST 检查纳入 CI/CD

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill dast-scanning

安装后在 Claude Code 中输入/dast-scanning确认已加载。

附带文件references/dast-tools.md

详细介绍

DAST 扫描

通过动态分析测试运行中的应用，查找安全漏洞。

何时使用此技能

在以下情况下使用此技能：

  • 测试已部署的应用
  • 执行自动化安全扫描
  • 查找运行时漏洞
  • 测试身份验证流程
  • 验证 API 安全性

前置条件

  • 正在运行的应用实例
  • 可访问目标网络
  • 测试授权
  • 了解 Web 安全

工具概览

工具类型最适合
OWASP ZAPOSS自动化扫描、CI
Burp Suite商业版手动测试、高级测试
NiktoOSSWeb 服务器扫描
NucleiOSS基于模板的扫描
ArachniOSS全面扫描

OWASP ZAP

Docker 设置
# Run ZAP in daemon mode
docker run -d --name zap \
  -p 8080:8080 \
  -v $(pwd)/reports:/zap/reports \
  ghcr.io/zaproxy/zaproxy:stable \
  zap.sh -daemon -host 0.0.0.0 -port 8080 \
  -config api.addrs.addr.name=.* \
  -config api.addrs.addr.regex=true
基线扫描
# Quick baseline scan
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://target.example.com \
  -r baseline-report.html

# With authentication
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://target.example.com \
  -r report.html \
  --auth-login-url https://target.example.com/login \
  --auth-username user \
  --auth-password pass
全面扫描
# Comprehensive scan
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-full-scan.py -t https://target.example.com \
  -r full-report.html \
  -J full-report.json
API 扫描
# OpenAPI specification scan
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-api-scan.py -t https://target.example.com/openapi.json \
  -f openapi \
  -r api-report.html
ZAP 自动化框架
# zap-automation.yaml
env:
  contexts:
    - name: "Default Context"
      urls:
        - "https://target.example.com"
      includePaths:
        - "https://target.example.com/.*"
      excludePaths:
        - "https://target.example.com/logout.*"
      authentication:
        method: "form"
        parameters:
          loginUrl: "https://target.example.com/login"
          loginRequestData: "username={%username%}&password={%password%}"
        verification:
          method: "response"
          loggedInRegex: "\\QWelcome\\E"
      users:
        - name: "testuser"
          credentials:
            username: "[email protected]"
            password: "password123"

jobs:
  - type: spider
    parameters:
      context: "Default Context"
      user: "testuser"
      maxDuration: 10
      
  - type: spiderAjax
    parameters:
      context: "Default Context"
      user: "testuser"
      maxDuration: 10
      
  - type: passiveScan-wait
    parameters:
      maxDuration: 5
      
  - type: activeScan
    parameters:
      context: "Default Context"
      user: "testuser"
      policy: "Default Policy"
      
  - type: report
    parameters:
      template: "traditional-html"
      reportDir: "/zap/reports"
      reportFile: "zap-report"

# Run automation
docker run --rm -v $(pwd):/zap/wrk \
  ghcr.io/zaproxy/zaproxy:stable \
  zap.sh -cmd -autorun /zap/wrk/zap-automation.yaml

CI/CD 集成

GitHub Actions
name: DAST Scan

on:
  workflow_dispatch:
  schedule:
    - cron: '0 2 * * *'

jobs:
  dast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Start Application
        run: |
          docker-compose up -d
          sleep 30  # Wait for app to be ready

      - name: OWASP ZAP Scan
        uses: zaproxy/[email protected]
        with:
          target: 'http://localhost:8080'
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a'

      - name: Upload Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: zap-report
          path: report_html.html
GitLab CI
dast:
  stage: security
  image: ghcr.io/zaproxy/zaproxy:stable
  variables:
    TARGET_URL: $DAST_TARGET_URL
  script:
    - mkdir -p /zap/wrk/reports
    - zap-baseline.py -t $TARGET_URL -r /zap/wrk/reports/zap-report.html -I
  artifacts:
    paths:
      - reports/
    expire_in: 1 week
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

Burp Suite 自动化

REST API 用法
import requests

class BurpScanner:
    def __init__(self, api_url, api_key):
        self.api_url = api_url
        self.headers = {'Authorization': api_key}
    
    def create_scan(self, target_url):
        """Create and start a new scan."""
        payload = {
            'scan_configurations': [
                {'name': 'Crawl and Audit - Balanced'}
            ],
            'scope': {
                'include': [{'rule': target_url}]
            },
            'urls': [target_url]
        }
        response = requests.post(
            f'{self.api_url}/v0.1/scan',
            json=payload,
            headers=self.headers
        )
        return response.headers.get('Location')
    
    def get_scan_status(self, scan_id):
        """Get scan status."""
        response = requests.get(
            f'{self.api_url}/v0.1/scan/{scan_id}',
            headers=self.headers
        )
        return response.json()
    
    def get_issues(self, scan_id):
        """Get scan issues."""
        response = requests.get(
            f'{self.api_url}/v0.1/scan/{scan_id}/issues',
            headers=self.headers
        )
        return response.json()

# Usage
scanner = BurpScanner('http://burp:1337', 'api-key')
scan_id = scanner.create_scan('https://target.example.com')

while True:
    status = scanner.get_scan_status(scan_id)
    if status['scan_status'] == 'succeeded':
        break
    time.sleep(30)

issues = scanner.get_issues(scan_id)

Nikto

基本扫描
# Install
apt-get install nikto

# Basic scan
nikto -h https://target.example.com

# With specific options
nikto -h https://target.example.com \
  -ssl \
  -Tuning 123bde \
  -output nikto-report.html \
  -Format html

# Scan specific ports
nikto -h target.example.com -p 80,443,8080

常见 DAST 发现

OWASP Top 10
owasp_findings:
  A01_Broken_Access_Control:
    - IDOR vulnerabilities
    - Missing function-level access control
    - Privilege escalation
    
  A02_Cryptographic_Failures:
    - Sensitive data in URLs
    - Missing HTTPS
    - Weak ciphers
    
  A03_Injection:
    - SQL injection
    - Command injection
    - XSS
    
  A05_Security_Misconfiguration:
    - Default credentials
    - Verbose error messages
    - Missing security headers
    
  A07_Auth_Failures:
    - Weak passwords accepted
    - Session fixation
    - Missing MFA

安全标头检查

# Check security headers
curl -I https://target.example.com | grep -i "x-\|content-security\|strict"

# Expected headers:
# X-Content-Type-Options: nosniff
# X-Frame-Options: DENY
# X-XSS-Protection: 1; mode=block
# Content-Security-Policy: default-src 'self'
# Strict-Transport-Security: max-age=31536000

自定义测试用例

# Test authentication
tests:
  - name: "Authentication Bypass"
    steps:
      - Access protected resource without auth
      - Verify 401/403 response
      - Access with valid auth
      - Verify 200 response
    
  - name: "Session Management"
    steps:
      - Login and capture session token
      - Logout
      - Attempt to use old session
      - Verify session invalidated
    
  - name: "Input Validation"
    steps:
      - Submit XSS payload in all inputs
      - Submit SQL injection in all inputs
      - Verify proper sanitization

常见问题

问题：误报

问题：扫描器报告了并非漏洞的问题 解决方案：配置扫描策略，手动审查发现项

问题：缺少身份验证

问题：无法扫描需要身份验证的区域 解决方案：配置身份验证上下文，使用会话令牌

问题：覆盖不完整

问题：扫描器遗漏了端点 解决方案：导入 API 规范，改进爬取，使用经过身份验证的扫描

最佳实践

  • 先在预发布环境中测试
  • 配置适当的身份验证
  • 导入 API 规范以实现完整覆盖
  • 报告前审查发现项
  • 结合手动测试
  • 定期运行扫描（至少每周一次）
  • 持续跟踪发现项
  • 与开发团队协调

相关技能

评论

支持 Markdown