Penetration Testing Fundamentals

Automated DAST scanning in CI with OWASP ZAP

// .github/workflows/security-scan.yml
// name: DAST Security Scan
// on:
//   pull_request:
//     branches: [main]
//
// jobs:
//   zap-scan:
//     runs-on: ubuntu-latest
//     services:
//       app:
//         image: ghcr.io/my-org/my-app:pr-${{ github.event.number }}
//         ports: ['3000:3000']
//         options: --health-cmd "curl -f http://localhost:3000/health"
//
//     steps:
//       - name: Run OWASP ZAP baseline scan
//         uses: zaproxy/action-baseline@v0.12.0
//         with:
//           target: 'http://localhost:3000'
//           rules_file_name: '.zap/rules.tsv'
//           cmd_options: '-a -j -T 60'
//           fail_action: false  # Set to true to break the build on findings
//
//       - name: Upload ZAP report
//         uses: actions/upload-artifact@v4
//         with:
//           name: zap-report
//           path: report_html.html

// .zap/rules.tsv - configure false positive suppression
// 10021	IGNORE	(Application Error Disclosure)	.*health.*

ZAP baseline scan checks for common vulnerabilities (missing headers, exposed stack traces, insecure cookies) without active attack attempts. Active scan (zaproxy/action-full-scan) sends attack payloads but takes longer and may cause side effects on stateful endpoints.

Manual authentication testing checklist in Ruby console

# Manual pen test verification script (run in test environment only)
# Tests for common authentication vulnerabilities

require 'net/http'
require 'json'

BASE_URL = 'https://app.staging.example.com'

# Test 1: Verify rate limiting on login endpoint
def test_rate_limiting(http)
  puts "Testing rate limiting on /api/v1/auth/login..."
  responses = 20.times.map do
    req = Net::HTTP::Post.new('/api/v1/auth/login', 'Content-Type' => 'application/json')
    req.body = { email: 'test@example.com', password: 'wrong-password' }.to_json
    http.request(req).code
  end
  rate_limited = responses.count { |c| c == '429' }
  puts rate_limited > 0 ? "PASS: Rate limited after #{20 - rate_limited} attempts" : "FAIL: No rate limiting detected"
end

# Test 2: Verify session invalidation on logout
def test_session_invalidation(http)
  puts "Testing session invalidation..."
  login_resp = login(http, 'user@example.com', 'correct-password')
  token = JSON.parse(login_resp)['token']
  logout(http, token)
  reuse_resp = http.get('/api/v1/me', 'Authorization' => "Bearer #{token}")
  puts reuse_resp.code == '401' ? 'PASS: Token invalidated after logout' : "FAIL: Token still valid after logout"
end

Scripted tests verify specific security controls consistently across environments. This supplements automated DAST by testing semantic security properties (rate limit counts, session lifetime, token reuse after logout) that scanners miss.