DAST Against an Ephemeral Environment
By Richard Augenti
Stand up a per-merge-request environment, run an authenticated dynamic scan against the running application, and turn the results into a pipeline gate that does not flake.
Free to browse. Takes about 60 minutes once you start.
Lab Overview
Static analysis reads your code. Dynamic analysis attacks your running application the way an outsider would - and some problems only exist once the app is running.
The receipts-web front-end serves every response with no security headers. That is invisible to a code scanner and obvious to a tool that looks at actual HTTP responses. In this lab you scan the running app with OWASP ZAP, watch the missing headers fail the gate, add them, and wire the scan into the pipeline so a regression fails the build instead of reaching production.
Everything runs locally on the lab machine. The application is pure Python standard library and no external target is ever scanned.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH. ZAP runs as a container and the target app is already installed. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Timing: the ZAP baseline scan spiders the app and runs a full passive scan, so allow one to two minutes each time you run it.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.