ZAP baseline,auth, Semgrep and SAST/DAST correlation

[Wilikson173]

Goal

Complete Lab 5: run DAST with OWASP ZAP (baseline + authenticated) and SAST with Semgrep against Juice Shop v20.0.0; correlate findings from both tools.

Changes

• submissions/lab5.md – final report with:
  • Task 1: ZAP severity tables, ratio analysis, two auth‑only alerts with explanations
  • Task 2: Semgrep severity breakdown, top‑10 rule frequencies, triage shortcut, false‑positive sample
  • Bonus: SAST/DAST correlation table, deep‑dive on SQL injection, fix and reflection

Testing

All scans completed successfully on a fresh Kali machine.

• ZAP baseline (unauthenticated):
  • Duration: ~2 min
  • Unique alert types: 10 (Medium 2, Low 5, Info 3)
  • Total alert instances: 41
• ZAP authenticated (full scan with Automation Framework):
  • Duration: ~12 min
  • Unique alert types: 8 (High 1, Medium 2, Low 1, Info 4)
  • Total alert instances: 38
  • Ratio (auth/baseline instances): 0.8× – explained in report (Ajax Spider did not run in headless container)
• Semgrep (rules: p/owasp-top-ten, p/javascript, p/secrets):
  • Findings: ERROR 12, WARNING 10 → total 22
  • Top rule: javascript.sequelize.security.audit.sequelize-injection-express (6 occurrences)
• Correlation: SQL Injection identified in both ZAP (/rest/products/search and /rest/user/login) and Semgrep (routes/search.ts, routes/login.ts).

Container health verified:

docker ps --filter name=juice-shop
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
... bkimminich/juice-shop:v20.0.0 "docker-entrypoint.s…" 5 minutes ago Up 5 minutes 127.0.0.1:3000->3000/tcp juice-shop
curl -s -o /dev/null -w "HTTP %{http_code}\n" http://127.0.0.1:3000/rest/products
HTTP 200

Artifacts & Screenshots

• submissions/lab5.md – full analysis (this PR)
• Scanner outputs are not committed (excluded by .gitignore; they are regeneratable).

Checklist

• Title follows feat(labN): <topic> style (this PR is feat(lab5): ...)
• No secrets or large temp files committed
• Submission file exists at submissions/lab5.md